github aws-powertools/powertools-lambda-python v3.36.0
on GitHub

2 hours ago

Summary

This release ships a new Auth utility in alpha, with two pieces: a JWT verifier to protect your APIs and an OAuth2 client to call APIs protected by someone else. It also fixes a handful of bugs across Data Classes, Streaming, Idempotency, Event Handler, Metrics and Feature Flags.

A special thank you to @bfreiberg for the outstanding work on both Auth utilities. They helped and implemented them, wrote the docs and tested it.

Welcome also to our other new contributors @Om-singhaI, @Shubham-Padkonde, @chancesong10 and @chiruu12. Thank you for the reports, the fixes and the patience during reviews.

JWT verification (alpha)

Docs

You can now verify access tokens with JWTVerifier. It fetches and caches the issuer's JWKS, selects the signing key, and checks signature, issuer, audience, expiration and any claim you require. Only asymmetric algorithms are accepted, and errors never include token material. 

from aws_lambda_powertools.event_handler import APIGatewayHttpResolver
from aws_lambda_powertools.utilities.auth_alpha import JWTVerifier

app = APIGatewayHttpResolver()
verifier = JWTVerifier(
    issuer="https://idp.example.com",
    audience="https://orders.example.com",
    algorithms=["RS256"],
    required_claims=["sub"],
)


@app.get("/orders", middlewares=[verifier.require(scopes=["orders:read"])])
def list_orders():
    return {"subject": app.context["claims"]["sub"]}

The middleware returns 401 for missing or invalid tokens and 403 for missing scopes. You can also call verifier.verify(token) directly, use verifier.authorize(event) inside an API Gateway Lambda authorizer, or start from JWTVerifier.cognito() for Amazon Cognito access tokens.

Install it with pip install "aws-lambda-powertools[jwt]". Thank you @bfreiberg for building this with us.

OAuth2 client credentials (alpha)

Docs

You can now call downstream APIs protected by OAuth2 with OAuth2Client. It exchanges your client credentials for a bearer token, caches it, and refreshes it before it expires. Pass the client secret as a callable and it is loaded on every exchange, so it can come straight from Secrets Manager. 

from aws_lambda_powertools.utilities.auth_alpha import OAuth2Client

inventory_api = OAuth2Client(
    token_url="https://idp.example.com/token",
    client_id="orders-service",
    client_secret=load_secret,
    scopes=["inventory:read"],
)

response = inventory_api.request("GET", "https://inventory.example.com/stock/sku-123")

Use auth_headers() instead if you want only the Authorization header for your own HTTP client.

Install it with pip install "aws-lambda-powertools[oauth2]".

Both utilities live under auth_alpha while we collect feedback, so the API may change before GA. Pin your Powertools version if you use them in production. They are included in the Lambda layer.

Changes

  • fix(data-classes): handle keyword arguments in CaseInsensitiveDict.update (#8518) by @chiruu12
  • fix(data-classes): keep the value of large DynamoDB numbers (#8513) by @chiruu12
  • fix(streaming): return empty bytes when reading at the end of an S3 object (#8511) by @chancesong10
  • test(kafka): cover custom serializer output variants (#8499) by @leandrodamascena
  • fix(metrics): preserve string default dimensions across instances (#8404) by @ericbn
  • fix(idempotency): apply jmespath_options to payload_validation_jmespath (#8474) by @Om-singhaI
  • fix(event_handler): skip compression when the response has no body (#8485) by @Om-singhaI

📜 Documentation updates

🔧 Maintenance

This release was made possible by the following contributors:

@bfreiberg, @chancesong10, @chiruu12, @ericbn, @leandrodamascena, @Om-singhaI, @Shubham-Padkonde, @dependabot[bot] and @claude

Check out latest releases or
releases around aws-powertools/powertools-lambda-python v3.36.0

Don't miss a new powertools-lambda-python release

NewReleases is sending notifications on new releases.

Get notifications