Lambda environment changes on every apply when KMS used about terraform-aws-notify-slack HOT 6 CLOSED

data "aws_kms_ciphertext" "slack_url" {
  plaintext = var.slack_webhook_url
  key_id    = aws_kms_key.stack_key.arn
}

module "slack_error_notifications" {
  source  = "terraform-aws-modules/notify-slack/aws"
  version = "4.9.0"
  create  = var.slack_alarms

  sns_topic_name       = "${var.environment}-slack-alerts"
  lambda_function_name = "${var.environment}-slack-alerts"

  slack_webhook_url = data.aws_kms_ciphertext.slack_url.ciphertext_blob
  slack_channel     = var.slack_alert_channel
  slack_username    = "${var.environment}-alerts"
  slack_emoji       = var.slack_alert_emoji

  kms_key_arn         = aws_kms_key.stack_key.arn
  create_with_kms_key = true
}

  # module.mds.module.slack_error_notifications.module.lambda.aws_lambda_function.this[0] will be updated in-place
  ~ resource "aws_lambda_function" "this" {
        arn                            = "arn:aws:lambda:us-west-2:12345678910:function:company-staging-slack-alerts"
        filename                       = "builds/8cdc8be7573f183a30e8af9ce59d511795c17dd9fd51299e8d9e827e1f3de602.zip"
        function_name                  = "company-staging-slack-alerts"
        handler                        = "notify_slack.lambda_handler"
        id                             = "company-staging-slack-alerts"
        invoke_arn                     = "arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:12345678910:function:company-staging-slack-alerts/invocations"
        kms_key_arn                    = "arn:aws:kms:us-west-2:12345678910:key/a92cfa9e-712d-11eb-877b-83c2d3fe191b"
        last_modified                  = "2021-02-17T01:04:08.564+0000"
        layers                         = []
        memory_size                    = 128
        package_type                   = "Zip"
        publish                        = true
      ~ qualified_arn                  = "arn:aws:lambda:us-west-2:12345678910:function:company-staging-slack-alerts:5" -> (known after apply)
        reserved_concurrent_executions = -1
        role                           = "arn:aws:iam::12345678910:role/lambda-company-staging-slack-alerts"
        runtime                        = "python3.8"
        source_code_hash               = "SP923Y4gOpr1DQN9oV+jXPLvNr+SRbqD7IvhrwhdzwI="
        source_code_size               = 1570
        tags                           = {}
        timeout                        = 30
      ~ version                        = "5" -> (known after apply)

      ~ environment {
          ~ variables = {
                "LOG_EVENTS"        = "False"
                "SLACK_CHANNEL"     = "#alerts-nonprod"
                "SLACK_EMOJI"       = ":aws:"
                "SLACK_USERNAME"    = "company-staging-alerts"
              ~ "SLACK_WEBHOOK_URL" = "AQICAHhOH5OVERWRITINGZPARTSjOFETHISUctGu5Soj01/T4QEJ8aZOt6F15U9k8YXx9tfPAAAArzCBrAYJKoZIhvcNAQcGoIGeMIGbAgEAMIGVBgkqTOiRUINBTHEwBASE64ZIAWUDBAEuMBEEDL6mWZ/vpr6R1+H1oQIBEIBoWE5JSFQY6hvL+YsdmYrHdjBVTS3MOhh6Y4/8SEvpf35HeJa34xFfW1P0jOgG8D3UnGkUhAWHB8oqjKL0xTzVXmunbF4xPu/mtsTMcENLcxdzKa0wASsluOoG7KVVjT1O0u8BpRM3xLw=" -> "AQICAHhOH5sCMPQRzK2NOVERWRITINGZBITScHERESTOO1/T4QEwqTyEShWEoyqYRnIGplCDAAAArzCBrAYJKoZIhvcNAQcGoIGeMIGbAgEAMIGVBgkqhkiG9w0BBwEwHgYJYIZIASODBYOUMCANTJDECODEnnC5dc5ragIBEIBoVMsaDMUGk9XgFUxN8gxfIyc/JU2YlAvZvas1Pd1+ChELGmgcu/SSlJETcgyqXWs1519w1fGOjD/8jp5braxDa8bqjfVuLovzsvFWSLCniVRsxHw89IZIOT3d8SMUXNpqYO0Ce/1HvJM="
            }
        }

        tracing_config {
            mode = "PassThrough"
        }
    }

  # module.mds.module.slack_error_notifications.module.lambda.aws_lambda_permission.current_version_triggers["AllowExecutionFromSNS"] must be replaced
-/+ resource "aws_lambda_permission" "current_version_triggers" {
        action        = "lambda:InvokeFunction"
        function_name = "company-staging-slack-alerts"
      ~ id            = "AllowExecutionFromSNS" -> (known after apply)
        principal     = "sns.amazonaws.com"
      ~ qualifier     = "5" -> (known after apply) # forces replacement
        source_arn    = "arn:aws:sns:us-west-2:12345678910:company-staging-slack-alerts"
        statement_id  = "AllowExecutionFromSNS"
    }

Plan: 1 to add, 2 to change, 1 to destroy.