Error: can't find external program "python3"

# CloudWatch rule to schedule Lambda to run acceptance tests
# https://aws.amazon.com/blogs/aws/ec2-run-command-is-now-a-cloudwatch-events-target/
module "cloudwatch_event_rule" {
  source = "../../resource_module/monitoring/cloudwatch_rule"

  ## CloudWatch Event Rule ##
  cloudwatch_rule_name        = var.cloudwatch_rule_name_lambda_acceptance_tests
  cloudwatch_rule_description = var.cloudwatch_rule_description_lambda_acceptance_tests
  schedule_expression         = var.cloudwatch_rule_schedule_expression_lambda_acceptance_tests

  ## CloudWatch Event Target ##
  is_target_ssm_run_command = false
  cloudwatch_event_target_arn = module.lambda_function_container_image_acceptance_tests.this_lambda_function_arn
}

resource "random_id" "this" {
  byte_length = 2
}

# ref: https://github.com/terraform-aws-modules/terraform-aws-lambda
module "lambda_function_container_image_acceptance_tests" {
  source = "../../resource_module/compute/lambda"

  function_name = local.lambda_function_name
  description   = local.lambda_function_description
  create_package = local.lambda_create_package
  image_uri    = "${local.ecr_address}/${local.ecr_lambda_acceptance_tests_name}:${var.acceptance_tests_image_tag}" # or "${module.ecr.repository_url}:latest" # "132367819851.dkr.ecr.eu-west-1.amazonaws.com/complete-cow:1.0" 
  package_type = local.lambda_package_type

  # need to add resource-based policy for lambda to allow CW Event to invoke it: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission
  # Refs: https://github.com/terraform-aws-modules/terraform-aws-lambda/blob/master/examples/event-source-mapping/main.tf#L45-L58
  allowed_triggers = {
    cloudwatchevent = {
      principal  = "events.amazonaws.com"
      source_arn = module.cloudwatch_event_rule.arn
    }
  }

  # Error: Error adding new Lambda Permission for lambda: InvalidParameterValueException: We currently do not support adding policies for $LATEST.
  create_current_version_allowed_triggers = false

  timeout = var.lambda_timeout
  cloudwatch_logs_retention_in_days = var.cloudwatch_logs_retention_in_days

  # for running Lambda in VPC subnet (hitting Jenkins endpoint requires private network connection). Ref: https://github.com/terraform-aws-modules/terraform-aws-lambda/blob/master/examples/with-vpc/main.tf#L26-L28
  vpc_subnet_ids         = var.vpc_subnet_ids
  vpc_security_group_ids = var.vpc_security_group_ids
  attach_network_policy  = true

  # SNS notifications Ref: https://github.com/terraform-aws-modules/terraform-aws-lambda/blob/master/examples/async/main.tf#L25-L32
  create_async_event_config = true
  attach_async_event_policy = true
  destination_on_failure = module.sns_topic.this_sns_topic_arn # Ref: https://aws.amazon.com/blogs/compute/introducing-aws-lambda-destinations/
}

module "ecr" {
  source = "../../resource_module/container/ecr"

  ## ECR repo ##
  name                 = local.ecr_lambda_acceptance_tests_name
  image_tag_mutability = var.ecr_image_tag_mutability
  tags                 = local.ecr_lambda_acceptance_tests_tags

  ## ECR repo policy ##
  ecr_repo_policy = var.ecr_repo_policy

  ## ECR lifecycle policy ##
  ecr_lifecycle_policy = var.ecr_lifecycle_policy
}

###############################################
# SNS notifications
###############################################
module "sns_topic" {
  source = "../../resource_module/messaging/sns"

  name = "lambda-acceptance-tests-failures"

  tags = local.sns_topic_tags
}