Sync by stevehu · Pull Request #163 · networknt/light-aws-lambda

stevehu · 2026-04-11T12:50:18Z

No description provided.

Merge in EADPGHS/light-aws-lambda from feature/stsWebToken to sync * commit '4538d52d3ad7c3b127b1afc6c6aa122db5864d0b': adding cache for IDToken support for AssumeRoleWithWebIdentity

Copilot

Pull request overview

This PR updates the lambda-invoker STS configuration from a boolean flag (stsEnabled) to a typed selector (stsType) and adds support for STS AssumeRole with Web Identity, along with related config/schema/test updates.

Changes:

Replace stsEnabled with stsType across config model, config files, and generated schema.
Add StsWebIdentity support in LambdaFunctionHandler (Authorization token-based STS exchange) and add a StsFuncUser test config.
Add metrics-config dependency to the parent and lambda-invoker module POMs.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
pom.xml	Adds `metrics-config` to dependency management so modules can consume it consistently.
lambda-invoker/pom.xml	Adds `metrics-config` dependency for the lambda-invoker module.
lambda-invoker/src/main/java/com/networknt/aws/lambda/LambdaInvokerConfig.java	Replaces `stsEnabled` with `stsType` and updates validation/error text accordingly.
lambda-invoker/src/main/java/com/networknt/aws/lambda/LambdaFunctionHandler.java	Implements STS client/provider selection based on `stsType` and adds Web Identity token handling.
lambda-invoker/src/main/resources/config/lambda-invoker.yml	Updates config documentation and key name from `stsEnabled` to `stsType`.
lambda-invoker/src/main/resources/config/lambda-invoker.yaml	Same as above, for the `.yaml` variant.
lambda-invoker/src/main/resources/config/lambda-invoker-schema.json	Updates schema properties/required list to replace `stsEnabled` with `stsType`.
lambda-invoker/src/test/java/com/networknt/aws/lambda/LambdaInvokerConfigTest.java	Updates tests to reflect `stsType` and adds a new sts type scenario.
lambda-invoker/src/test/resources/config/lambda-invoker-sts-with-role.yml	Updates test config to use `stsType: StsWebIdentity`.
lambda-invoker/src/test/resources/config/lambda-invoker-sts-no-role.yml	Updates test config to use `stsType: StsWebIdentity` with missing roleArn.
lambda-invoker/src/test/resources/config/lambda-invoker-sts-func.yml	Adds new test config for `stsType: StsFuncUser`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…alidation Agent-Logs-Url: https://github.com/networknt/light-aws-lambda/sessions/7d681ae3-7571-4446-82f3-109707801103 Co-authored-by: stevehu <2042337+stevehu@users.noreply.github.com>

Copilot · 2026-04-11T13:17:16Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

central.sonatype.com
- Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.14/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.14/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.14 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.14/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/light-aws-lambda/light-aws-lambda org.codehaus.plexus.classworlds.launcher.Launcher -pl lambda-invoker -am clean test -q (dns block)
- Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.14/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.14/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.14 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.14/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/light-aws-lambda/light-aws-lambda org.codehaus.plexus.classworlds.launcher.Launcher -f pom.xml -B -V -e -Dfindbugs.skip -Dcheckstyle.skip -Dpmd.skip=true -Dspotbugs.skip -Denforcer.skip -Dmaven.javadoc.skip (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

…est coverage Agent-Logs-Url: https://github.com/networknt/light-aws-lambda/sessions/e1696a54-4c13-45ea-831c-e02b5160ef43 Co-authored-by: stevehu <2042337+stevehu@users.noreply.github.com>

Copilot · 2026-04-11T13:42:44Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

central.sonatype.com
- Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.14/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.14/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.14 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.14/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/light-aws-lambda/light-aws-lambda org.codehaus.plexus.classworlds.launcher.Launcher -f pom.xml -B -V -e -Dfindbugs.skip -Dcheckstyle.skip -Dpmd.skip=true -Dspotbugs.skip -Denforcer.skip -Dmaven.javadoc.skip (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Copilot

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

lambda-invoker/src/main/java/com/networknt/aws/lambda/LambdaFunctionHandler.java:191

When config is reloaded, tokenCache is not cleared. If the handler previously cached a token and then reloads/recreates stsWebIdentityCredentialsProvider (which is initially built without a webIdentityToken), the first request after reload with the same token will hit the cache fast-path and skip rebuilding the provider with the token, leaving the provider with a token-less refresh request. Clearing tokenCache during the reload/close block would prevent this.

                    if(stsWebIdentityCredentialsProvider != null) {
                        try {
                            stsWebIdentityCredentialsProvider.close();
                        } catch (Exception e) {
                            logger.error("Failed to close the StsAssumeRoleWithWebIdentityCredentialsProvider", e);
                        }
                        stsWebIdentityCredentialsProvider = null;
                    }
                    if(stsClient != null) {
                        try {
                            stsClient.close();
                        } catch (Exception e) {
                            logger.error("Failed to close the StsClient", e);
                        }
                        stsClient = null;
                    }
                    client = initClient(config);

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…nctionHandler.java Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…vokerConfigTest.java Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…date() Agent-Logs-Url: https://github.com/networknt/light-aws-lambda/sessions/2cd98e34-9726-4923-b74b-1cb85395a819 Co-authored-by: stevehu <2042337+stevehu@users.noreply.github.com>

Copilot · 2026-04-11T13:53:33Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

central.sonatype.com
- Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.14/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.14/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.14 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.14/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/light-aws-lambda/light-aws-lambda org.codehaus.plexus.classworlds.launcher.Launcher -pl lambda-invoker test -q (dns block)
- Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.14/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.14/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.14 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.14/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/light-aws-lambda/light-aws-lambda org.codehaus.plexus.classworlds.launcher.Launcher -f pom.xml -B -V -e -Dfindbugs.skip -Dcheckstyle.skip -Dpmd.skip=true -Dspotbugs.skip -Denforcer.skip -Dmaven.javadoc.skip (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

stevehu · 2026-04-11T14:57:00Z

For StsWebIdentity, the handler no longer mutates shared client or credentials-provider state on request threads. It now validates the bearer token, returns 401 immediately when the header is missing or invalid, and builds a request-scoped
STS web-identity provider and Lambda client for that invocation only. That removes the concurrency hazard Copilot called out. I also added focused tests that verify bearer-token handling and that the web-identity path creates distinct
request-scoped clients.

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

stevehu · 2026-04-11T15:17:21Z

I removed the request-scoped client recreation. StsWebIdentity now uses one shared LambdaAsyncClient again, backed by a stable mutable credentials provider that swaps its underlying StsAssumeRoleWithWebIdentityCredentialsProvider under
synchronization when the bearer token changes. That keeps the client and connection pool reusable, avoids raw-token caching, and keeps the token refresh path thread-safe. I also lowered missing/invalid bearer-token logging from WARN to DEBUG,
kept the fail-fast 401, and replaced the old raw token cache with a SHA-256 fingerprint used only for change detection.

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…nctionHandler.java Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

stevehu · 2026-04-11T15:35:52Z

@DiogoFKT @KalevGonvick , I have made some changes along with some Copilot updates. Please review and approve. Thanks.

DiogoFKT · 2026-04-13T13:49:57Z

Thanks Steve, changes makes sense with new static class MutableStsWebIdentityCredentialsProvider to handle token mutation synchronously. I expect some performance tradeoff when multiple distinct incoming tokens hitting same instance of light-aws-lambda, but required to avoid racing conditions. Also I want to test if nextDelegate will apply without rebuilding the client

DiogoFKT added 3 commits April 8, 2026 20:13

support for AssumeRoleWithWebIdentity

917516d

adding cache for IDToken

4538d52

Pull request #1: support for AssumeRoleWithWebIdentity

40e26b4

Merge in EADPGHS/light-aws-lambda from feature/stsWebToken to sync * commit '4538d52d3ad7c3b127b1afc6c6aa122db5864d0b': adding cache for IDToken support for AssumeRoleWithWebIdentity

stevehu requested a review from Copilot April 11, 2026 12:50

Copilot started reviewing on behalf of stevehu April 11, 2026 12:50 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

Copilot started work on behalf of stevehu April 11, 2026 13:11 View session

Apply review feedback: fix StsWebIdentity handler issues and config v…

8bd52c8

…alidation Agent-Logs-Url: https://github.com/networknt/light-aws-lambda/sessions/7d681ae3-7571-4446-82f3-109707801103 Co-authored-by: stevehu <2042337+stevehu@users.noreply.github.com>

Copilot finished work on behalf of stevehu April 11, 2026 13:17

Copilot started work on behalf of stevehu April 11, 2026 13:36 View session

Add StsWebIdentity unit tests: extract bearer token parsing and add t…

abefd9f

…est coverage Agent-Logs-Url: https://github.com/networknt/light-aws-lambda/sessions/e1696a54-4c13-45ea-831c-e02b5160ef43 Co-authored-by: stevehu <2042337+stevehu@users.noreply.github.com>

Copilot finished work on behalf of stevehu April 11, 2026 13:42

stevehu requested a review from Copilot April 11, 2026 13:43

Copilot started reviewing on behalf of stevehu April 11, 2026 13:44 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

Copilot started work on behalf of stevehu April 11, 2026 13:48 View session

stevehu and others added 3 commits April 11, 2026 09:48

Update lambda-invoker/src/main/java/com/networknt/aws/lambda/LambdaFu…

bacb010

…nctionHandler.java Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update lambda-invoker/src/test/java/com/networknt/aws/lambda/LambdaIn…

ccc9b08

…vokerConfigTest.java Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Fix stsType normalization: assign trimmed value back to field in vali…

8bfb40e

…date() Agent-Logs-Url: https://github.com/networknt/light-aws-lambda/sessions/2cd98e34-9726-4923-b74b-1cb85395a819 Co-authored-by: stevehu <2042337+stevehu@users.noreply.github.com>

Copilot finished work on behalf of stevehu April 11, 2026 13:53

address the compiler issue introduced by Copilot

5c7a93c

stevehu requested a review from Copilot April 11, 2026 14:39

Copilot started reviewing on behalf of stevehu April 11, 2026 14:40 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

Comment thread lambda-invoker/src/main/java/com/networknt/aws/lambda/LambdaFunctionHandler.java Outdated

Comment thread lambda-invoker/src/main/java/com/networknt/aws/lambda/LambdaFunctionHandler.java Outdated

address Copilot comments

17414d2

stevehu requested a review from Copilot April 11, 2026 14:57

Copilot started reviewing on behalf of stevehu April 11, 2026 14:58 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

change to reuse client

24d8a61

stevehu requested a review from Copilot April 11, 2026 15:18

Copilot started reviewing on behalf of stevehu April 11, 2026 15:18 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

Comment thread lambda-invoker/src/main/java/com/networknt/aws/lambda/LambdaFunctionHandler.java Outdated

Update lambda-invoker/src/main/java/com/networknt/aws/lambda/LambdaFu…

347bf8b

…nctionHandler.java Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

stevehu requested review from DiogoFKT and KalevGonvick April 11, 2026 15:34

stevehu merged commit 74b3370 into master Apr 13, 2026
1 check passed

stevehu deleted the sync branch April 13, 2026 15:24

Conversation

stevehu commented Apr 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Apr 11, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI commented Apr 11, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Apr 11, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

stevehu commented Apr 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stevehu commented Apr 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

stevehu commented Apr 11, 2026

Uh oh!

DiogoFKT commented Apr 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants