AWS Notify Teams Terraform module

This module creates an SNS topic (or uses an existing one) and an AWS Lambda function that sends notifications to a Microsoft Teams channel through a Workflows webhook.

Start by creating a webhook with the Workflows app in the Teams channel, using the "Post to a channel when a webhook request is received" template.

Office 365 Connectors (the classic Teams "Incoming Webhook") were retired in May 2026. Workflows webhooks accept the MessageCard payloads this module sends, and the messages are posted by the Workflows bot.

Supported Features

• AWS Lambda runtime Python 3.13 (configurable with lambda_runtime)
• Create new SNS topic or use existing one
• Support plaintext and KMS-encrypted version of the Teams webhook URL
• Support different types of SNS messages:
  • AWS CloudWatch Alarms
  • AWS GuardDuty Findings
  • AWS Health Events
  • Payloads that are already Teams messages (MessageCard or Adaptive Card), forwarded as-is
  • Any other JSON or plain-text message (e.g. AWS Budgets), rendered as a generic card

Usage

module "notify_teams" {
  source = "github.com/binbashar/terraform-aws-notify-teams.git?ref=<version>"

  sns_topic_name = "teams-topic"

  teams_webhook_url = "https://xxxxx.logic.azure.com/workflows/xxxxxxxxx"
}

To keep the webhook URL out of the Lambda configuration in plaintext, encrypt it with KMS (e.g. with aws_kms_ciphertext), pass the ciphertext as teams_webhook_url and the key as kms_key_arn. Any value that does not start with http is decrypted with KMS at runtime.

The Lambda function fails when the webhook answers with a non-2xx status, so the invocation shows up in the Lambda Errors metric and SNS retries it.

Using with Terraform Cloud Agents

Terraform Cloud Agents are a paid feature, available as part of the Terraform Cloud for Business upgrade package.

This module packages the Lambda function locally, so it requires Python 3. You can customize tfc-agent to include Python using this sample Dockerfile:

FROM hashicorp/tfc-agent:latest
RUN apt-get -y update && apt-get -y install python3 python3-pip
ENTRYPOINT ["/bin/tfc-agent"]

Use existing SNS topic or create new

If you want to subscribe the AWS Lambda Function created by this module to an existing SNS topic you should specify create_sns_topic = false as an argument and specify the name of existing SNS topic name in sns_topic_name.

Examples

• notify-teams-simple - Creates SNS topic which sends messages to Teams channel.

Testing with pytest

The unit tests run offline (no AWS or Teams calls):

pip install pytest boto3
pytest functions/notify_teams_test.py

Requirements

Name	Version
terraform	>= 1.0
aws	>= 5.79

Providers

Name	Version
aws	>= 5.79

Modules

Name	Source	Version
lambda	terraform-aws-modules/lambda/aws	7.21.1

Resources

Name	Type
aws_cloudwatch_log_group.lambda	resource
aws_sns_topic.this	resource
aws_sns_topic_subscription.sns_notify_teams	resource
aws_caller_identity.current	data source
aws_iam_policy_document.lambda	data source
aws_partition.current	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
cloudwatch_log_group_kms_key_id	The ARN of the KMS Key to use when encrypting log data for Lambda	string	null	no
cloudwatch_log_group_retention_in_days	Specifies the number of days you want to retain log events in log group for Lambda.	number	0	no
cloudwatch_log_group_tags	Additional tags for the Cloudwatch log group	map(string)	{}	no
create	Whether to create all resources	bool	true	no
create_sns_topic	Whether to create new SNS topic	bool	true	no
iam_role_boundary_policy_arn	The ARN of the policy that is used to set the permissions boundary for the role	string	null	no
iam_role_name_prefix	A unique role name beginning with the specified prefix	string	"lambda"	no
iam_role_tags	Additional tags for the IAM role	map(string)	{}	no
kms_key_arn	ARN of the KMS key used for decrypting Teams webhook url	string	""	no
lambda_description	The description of the Lambda function	string	null	no
lambda_function_name	The name of the Lambda function to create	string	"notify_teams"	no
lambda_function_s3_bucket	S3 bucket to store artifacts	string	null	no
lambda_function_store_on_s3	Whether to store produced artifacts on S3 or locally.	bool	false	no
lambda_function_tags	Additional tags for the Lambda function	map(string)	{}	no
lambda_function_vpc_security_group_ids	List of security group ids when Lambda Function should run in the VPC.	list(string)	null	no
lambda_function_vpc_subnet_ids	List of subnet ids when Lambda Function should run in the VPC. Usually private or intra subnets.	list(string)	null	no
lambda_role	IAM role attached to the Lambda Function. If this is set then a role will not be created for you.	string	""	no
lambda_runtime	The Lambda runtime used by the function	string	"python3.13"	no
lambda_source_path	The source path of a custom Lambda function. Defaults to the bundled functions/notify_teams.py	string	null	no
log_events	Boolean flag to enabled/disable logging of incoming events	bool	false	no
reserved_concurrent_executions	The amount of reserved concurrent executions for this lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations	number	-1	no
sns_topic_kms_key_id	ARN of the KMS key used for enabling SSE on the topic	string	""	no
sns_topic_name	The name of the SNS topic to create	string	n/a	yes
sns_topic_tags	Additional tags for the SNS topic	map(string)	{}	no
subscription_filter_policy	(Optional) A valid filter policy that will be used in the subscription to filter messages seen by the target resource.	string	null	no
tags	A map of tags to add to all resources	map(string)	{}	no
teams_webhook_url	The URL of Teams webhook	string	n/a	yes

Outputs

Name	Description
lambda_cloudwatch_log_group_arn	The Amazon Resource Name (ARN) specifying the log group
lambda_iam_role_arn	The ARN of the IAM role used by Lambda function
lambda_iam_role_name	The name of the IAM role used by Lambda function
notify_teams_lambda_function_arn	The ARN of the Lambda function
notify_teams_lambda_function_invoke_arn	The ARN to be used for invoking Lambda function from API Gateway
notify_teams_lambda_function_last_modified	The date Lambda function was last modified
notify_teams_lambda_function_name	The name of the Lambda function
notify_teams_lambda_function_version	Latest published version of your Lambda function
this_teams_topic_arn	The ARN of the SNS topic from which messages will be sent to Teams

Authors

Original code by Anton Babenko with help from these awesome contributors.

License

Apache 2 Licensed. See LICENSE for full details.