diff --git a/lambda/.gitignore b/lambda/.gitignore
new file mode 100644
index 0000000..d48748f
--- /dev/null
+++ b/lambda/.gitignore
@@ -0,0 +1,3 @@
+*.zip
+lambda
+terraform/.terraform
\ No newline at end of file
diff --git a/lambda/Makefile b/lambda/Makefile
new file mode 100644
index 0000000..b2dc940
--- /dev/null
+++ b/lambda/Makefile
@@ -0,0 +1,26 @@
+TERRAFORM_DIR := ./terraform
+
+lambda: lambda.go
+	GOARCH=amd64 GOOS=linux go build
+
+lambda.zip: lambda
+	zip $@ lambda
+
+.PHONY: build
+build: lambda lambda.zip
+
+.PHONY: init
+init: clean lambda.zip
+	terraform -chdir=$(TERRAFORM_DIR) init
+
+.PHONY: plan
+plan: init
+	terraform -chdir=$(TERRAFORM_DIR) plan
+
+.PHONY: apply
+apply: init
+	terraform -chdir=$(TERRAFORM_DIR) apply
+
+.PHONY: clean
+clean:
+	rm -f lambda.zip lambda
diff --git a/lambda/go.mod b/lambda/go.mod
new file mode 100644
index 0000000..460f2b6
--- /dev/null
+++ b/lambda/go.mod
@@ -0,0 +1,16 @@
+module github.com/newrelic/infrastructure-publish-action/lambda
+
+go 1.18
+
+require (
+	github.com/aws/aws-lambda-go v1.37.0
+	github.com/aws/aws-sdk-go v1.44.196
+	github.com/stretchr/testify v1.7.2
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
diff --git a/lambda/go.sum b/lambda/go.sum
new file mode 100644
index 0000000..cb6d859
--- /dev/null
+++ b/lambda/go.sum
@@ -0,0 +1,52 @@
+github.com/aws/aws-lambda-go v1.37.0 h1:WXkQ/xhIcXZZ2P5ZBEw+bbAKeCEcb5NtiYpSwVVzIXg=
+github.com/aws/aws-lambda-go v1.37.0/go.mod h1:jwFe2KmMsHmffA1X2R09hH6lFzJQxzI8qK17ewzbQMM=
+github.com/aws/aws-sdk-go v1.44.196 h1:e3h9M7fpnRHwHOohYmYjgVbcCBvkxKwZiT7fGrxRn28=
+github.com/aws/aws-sdk-go v1.44.196/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.7.2 h1:4jaiDzPyXQvSd7D0EjG45355tLlV3VOECpq10pLC+8s=
+github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.1.0 h1:hZ/3BUoy5aId7sCpA/Tc5lt8DkFgdVS2onTpJsZ/fl0=
+golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0 h1:BrVqGRd7+k1DiOgtnFvAkoQEWQvBc25ouMJM6429SFg=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/lambda/lambda.go b/lambda/lambda.go
new file mode 100644
index 0000000..ae34661
--- /dev/null
+++ b/lambda/lambda.go
@@ -0,0 +1,60 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"github.com/aws/aws-lambda-go/events"
+	"github.com/aws/aws-lambda-go/lambda"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/s3"
+)
+
+const (
+	surrogateKey    = "infrastructure_metadata"
+	fastlySurrogate = "x-amz-meta-surrogate-key"
+)
+
+func handler(ctx context.Context, s3Event events.S3Event) error {
+	// debugging
+	//data, err := json.Marshal(s3Event)
+	//if err != nil {
+	//	return err
+	//}
+	//fmt.Printf("%s\f", data)
+
+	sess, err := session.NewSession(&aws.Config{
+		Region: aws.String("us-east-1")},
+	)
+	if err != nil {
+		return fmt.Errorf("error getting s3 session: %w", err)
+	}
+
+	s3 := s3.New(sess)
+	for _, record := range s3Event.Records {
+		s3Record := record.S3
+		_, err := s3.CopyObject(modifyMetadata(s3Record))
+		if err != nil {
+			return fmt.Errorf("error while coping metadata to s3 object: %w", err)
+		}
+		fmt.Printf("Modified object file %s\n", s3Record.Object.Key)
+	}
+
+	fmt.Println("SUCCEED: All S3 Objects metadata updated")
+	return nil
+}
+
+func modifyMetadata(record events.S3Entity) *s3.CopyObjectInput {
+	return &s3.CopyObjectInput{
+		Bucket:            aws.String(record.Bucket.Name),
+		Key:               aws.String(record.Object.Key),
+		CopySource:        aws.String(record.Bucket.Name + "/" + record.Object.Key),
+		Metadata:          map[string]*string{fastlySurrogate: aws.String(surrogateKey)},
+		MetadataDirective: aws.String("REPLACE"),
+	}
+}
+
+func main() {
+	fmt.Printf("starting aws s3 metadata rewrite tool\n")
+	lambda.Start(handler)
+}
diff --git a/lambda/lambda_test.go b/lambda/lambda_test.go
new file mode 100644
index 0000000..790b2c0
--- /dev/null
+++ b/lambda/lambda_test.go
@@ -0,0 +1,65 @@
+package main
+
+import (
+	"encoding/json"
+	"github.com/aws/aws-lambda-go/events"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/stretchr/testify/assert"
+	"testing"
+)
+
+func TestLambdaHandler(t *testing.T) {
+	testData := `
+{
+  "Records": [
+    {
+      "eventVersion": "2.0",
+      "eventSource": "aws:s3",
+      "awsRegion": "us-east-1",
+      "eventTime": "1970-01-01T00:00:00.123Z",
+      "eventName": "ObjectCreated:Put",
+      "userIdentity": {
+        "principalId": "EXAMPLE"
+      },
+      "requestParameters": {
+        "sourceIPAddress": "127.0.0.1"
+      },
+      "responseElements": {
+        "x-amz-request-id": "C3D13FC810",
+        "x-amz-id-2": "FMyUY8/IgAtTv8V5Wp6S7S/JRWeUWerMOjpD"
+      },
+      "s3": {
+        "s3SchemaVersion": "1.0",
+        "configurationId": "testCigRule",
+        "bucket": {
+          "name": "sourcebucket",
+          "ownerIdentity": {
+            "principalId": "EXAMPLE"
+          },
+          "arn": "arn:aws:s3:::mybucket"
+        },
+        "object": {
+          "key": "Happy%20Face.jpg",
+          "size": 1024,
+          "versionId": "version",
+          "eTag": "d41d8cd98f00be",
+          "sequencer": "Happy Sequencer"
+        }
+      }
+    }
+  ]
+}
+`
+	eventData := events.S3Event{}
+	err := json.Unmarshal([]byte(testData), &eventData)
+	assert.NoError(t, err)
+	expectedObject := s3.CopyObjectInput{
+		Bucket:            aws.String("sourcebucket"),
+		Key:               aws.String("Happy%20Face.jpg"),
+		CopySource:        aws.String("sourcebucket/Happy%20Face.jpg"),
+		Metadata:          map[string]*string{"x-amz-meta-surrogate-key": aws.String("test_1")},
+		MetadataDirective: aws.String("REPLACE"),
+	}
+	assert.Equal(t, expectedObject, *modifyMetadata(eventData.Records[0].S3))
+}
diff --git a/lambda/terraform/main.tf b/lambda/terraform/main.tf
new file mode 100644
index 0000000..628d22c
--- /dev/null
+++ b/lambda/terraform/main.tf
@@ -0,0 +1,230 @@
+variable "function_name" {
+  default = "infrastructure-s3-matadata-updater"
+}
+variable "handler_name" {
+  default = "lambda"
+}
+
+variable "runtime" {
+  default = "go1.x"
+}
+
+variable "timeout" {
+  default = "10"
+}
+
+variable "aws_s3_bucket_id" {
+  default = "caos-fastly-lambda-test"
+}
+
+variable "aws_s3_bucket_arn" {
+  default = "arn:aws:s3:::caos-fastly-lambda-test"
+}
+
+
+variable "s3_notifications" {
+  default = {
+    bucket = {
+      name    = "caos-fastly-lambda-test"
+      filters = [
+        {
+          name          = "apt metadata"
+          filter_prefix = "infrastructure_agent/linux/apt/dists/"
+          filter_suffix = ""
+        },
+        {
+          name          = "yum rpm data xml"
+          filter_prefix = "infrastructure_agent/linux/yum/"
+          filter_suffix = "xml"
+        },
+        {
+          name          = "yum rpm data xml.asc"
+          filter_prefix = "infrastructure_agent/linux/yum/"
+          filter_suffix = "asc"
+        },
+        {
+          name          = "yum rpm data bz2"
+          filter_prefix = "infrastructure_agent/linux/yum/"
+          filter_suffix = "bz2"
+        },
+        {
+          name          = "yum rpm data bz2"
+          filter_prefix = "infrastructure_agent/linux/yum/"
+          filter_suffix = "gz"
+        },
+        {
+          name          = "zypp rpm data xml"
+          filter_prefix = "infrastructure_agent/linux/zypp/"
+          filter_suffix = "xml"
+        },
+        {
+          name          = "zypp rpm data xml.asc"
+          filter_prefix = "infrastructure_agent/linux/zypp/"
+          filter_suffix = "asc"
+        },
+        {
+          name          = "zypp rpm data bz2"
+          filter_prefix = "infrastructure_agent/linux/zypp/"
+          filter_suffix = "bz2"
+        },
+        {
+          name          = "zypp rpm data bz2"
+          filter_prefix = "infrastructure_agent/linux/zypp/"
+          filter_suffix = "gz"
+        },
+      ]
+    }
+  }
+}
+
+
+#########################################
+# Set AWS Provider region
+#########################################
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+
+resource "aws_cloudwatch_log_group" "lambda_log_group" {
+  name              = "/aws/lambda/${var.function_name}"
+  retention_in_days = 14
+}
+
+resource "aws_iam_role_policy_attachment" "function_logging_policy_attachment" {
+  role       = aws_iam_role.lambda_iam.id
+  policy_arn = aws_iam_policy.lambda_function_policy.arn
+}
+
+
+#########################################
+# Creating Lambda IAM resource
+#########################################
+
+resource "aws_iam_role" "lambda_iam" {
+  name = "${var.function_name}-role"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "lambda.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_policy" "lambda_function_policy" {
+  name = "${var.function_name}-policy"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "s3:PutObject",
+        "s3:GetObject",
+        "s3:ListBucketVersions",
+        "s3:ListBucket"
+      ],
+      "Effect": "Allow",
+      "Resource": "${var.aws_s3_bucket_arn}/infrastructure_agent/linux/*"
+    },
+    {
+      "Sid": "VisualEditor1",
+      "Effect": "Allow",
+      "Action": [
+        "logs:CreateLogStream",
+        "logs:PutLogEvents"
+      ],
+      "Resource": "${aws_cloudwatch_log_group.lambda_log_group.arn}:*"
+    }
+  ]
+}
+EOF
+}
+
+#########################################
+# State Backend
+#########################################
+terraform {
+  backend "s3" {
+    bucket = "automation-pipeline-terraform-state"
+    key    = "infrastructure-publish-action/lambda"
+    region = "us-east-2"
+  }
+}
+
+##########################################
+# Creating Lambda resource
+##########################################
+
+resource "aws_lambda_function" "test_lambda" {
+  function_name    = var.function_name
+  role             = aws_iam_role.lambda_iam.arn
+  handler          = var.handler_name
+  runtime          = var.runtime
+  timeout          = var.timeout
+  filename         = "../lambda.zip"
+  source_code_hash = filebase64sha256("../lambda.zip")
+  depends_on       = [aws_cloudwatch_log_group.lambda_log_group]
+  tags             = {
+    owning_team = "CAOS"
+  }
+}
+
+resource "aws_lambda_permission" "allow_bucket" {
+  statement_id  = "AllowExecutionFromS3Bucket"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.test_lambda.arn
+  principal     = "s3.amazonaws.com"
+  source_arn    = var.aws_s3_bucket_arn
+}
+
+# Adding S3 bucket as trigger
+resource "aws_s3_bucket_notification" "aws-lambda-trigger-post" {
+  for_each = {for item in var.s3_notifications :  item.name => item}
+  bucket   = each.value.name
+
+  dynamic "lambda_function" {
+    for_each = [
+    for item in each.value.filters : {
+      suffix = item.filter_suffix
+      prefix = item.filter_prefix
+    }
+    ]
+
+    content {
+      lambda_function_arn = aws_lambda_function.test_lambda.arn
+      events              = ["s3:ObjectCreated:Put"]
+      filter_prefix       = lambda_function.value.prefix
+      filter_suffix       = lambda_function.value.suffix
+    }
+  }
+
+  dynamic "lambda_function" {
+    for_each = [
+    for item in each.value.filters : {
+      suffix = item.filter_suffix
+      prefix = item.filter_prefix
+    }
+    ]
+
+    content {
+      lambda_function_arn = aws_lambda_function.test_lambda.arn
+      events              = ["s3:ObjectCreated:Post"]
+      filter_prefix       = lambda_function.value.prefix
+      filter_suffix       = lambda_function.value.suffix
+    }
+  }
+
+  depends_on = [aws_lambda_permission.allow_bucket]
+}