You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Bug: get_parameters_by_name raises KeyError for names with a version or label selector #8587
get_parameters_by_name({"/a:prod": {}}) returns the value of the prod label, like get_parameter("/a:prod") already does. Selectors (name:version, name:label) are valid input for the GetParameters API.
Current Behaviour
SSM returns the parameter with Name="/a" and Selector=":prod" (the selector is only the suffix, ":prod" or ":1", not the full requested name). _transform_and_cache_get_parameters_response (ssm.py:650) looks the returned Name up in the user's dict, which only has /a:prod, so it crashes with KeyError: '/a'. Real response for Names=["/p:prod", "/p:1", "/p"]:
fromunittest.mockimportMagicMockfrombotocore.configimportConfigfromaws_lambda_powertools.utilities.parametersimportSSMProviderprovider=SSMProvider(boto_config=Config(region_name="us-east-1"))
# what SSM really returns for Names=["/a:prod"]: Name without the selector, Selector with itprovider.client.get_parameters=MagicMock(return_value={
"Parameters": [{"Name": "/a", "Value": "v", "Selector": ":prod", "Type": "String", "Version": 1}],
"InvalidParameters": [],
})
print(provider.get_parameters_by_name({"/a:prod": {}})) # KeyError: '/a' (provider.get("/a:prod") works)
Possible Solution
Rebuild the requested key as parameter["Name"] + parameter.get("Selector", "") and use it for the response and the cache.
Steps to Reproduce
Run the snippet above (a mocked client, no AWS access needed; botocore's Stubber rejects the empty InvalidParameters list that the real service returns).
Powertools for AWS Lambda (Python) version
latest
AWS Lambda function runtime
3.13
Packaging format used
PyPi
Debugging logs
Warning
This issue is ready to be picked up, by humans or by agents. If you want it, comment here first so we can assign it to you, and please take only one or two issues at a time so others can join in too. The reproduction above runs locally without AWS access. Thanks!
Hi! I'd like to pick this one up. I'll resolve the requested key from Selector when it's in the user's dict (falling back to Name) and use it for both the cache key and the response, in the plain and the decrypt batch paths. I'll add functional tests for name:label and name:version selectors based on the mocked-client reproduction.
Correction: I wrote this issue from a mocked reproduction and got the response shape wrong. Against the real service, Selector is only the suffix (":prod", ":1"), not the full name. Updated the Current Behaviour and the snippet above. Sorry for the confusion, @MTirnova.
Activity
MTirnova commentedon Oct 18, 2026
Hi! I'd like to pick this one up. I'll resolve the requested key from
Selectorwhen it's in the user's dict (falling back toName) and use it for both the cache key and the response, in the plain and the decrypt batch paths. I'll add functional tests forname:labelandname:versionselectors based on the mocked-client reproduction.leandrodamascena commentedon Oct 18, 2026
Hey @MTirnova pls go ahead.
leandrodamascena commentedon Oct 19, 2026
Correction: I wrote this issue from a mocked reproduction and got the response shape wrong. Against the real service,
Selectoris only the suffix (":prod",":1"), not the full name. Updated the Current Behaviour and the snippet above. Sorry for the confusion, @MTirnova.