Bug: get_parameters_by_name returns {} instead of raising when GetParameters fails with raise_on_error=True #8586

Expected Behaviour

get_parameters_by_name(..., raise_on_error=True) (the default) raises GetParameterError when the GetParameters call fails. The docstring says: "Default to fail-fast. Raises GetParameterError upon any error".

Current Behaviour

When GetParameters fails with InvalidKeyId or InternalServerError, the except block in _get_parameters_by_name (ssm.py:633) turns the names into errors, but errors are only surfaced when raise_on_error=False. In fail-fast mode the function returns {} and the Lambda keeps running without its parameters. Same for an all-decrypt batch.

Code snippet

from botocore.config import Config
from botocore.stub import Stubber
from aws_lambda_powertools.utilities.parameters import SSMProvider

provider = SSMProvider(boto_config=Config(region_name="us-east-1"))
stub = Stubber(provider.client)
stub.add_client_error("get_parameters", "InvalidKeyId")
stub.activate()

print(provider.get_parameters_by_name({"/a": {}, "/b": {}}, raise_on_error=True))
# {}   expected: GetParameterError

Possible Solution

In the except of _get_parameters_by_name_from_batch (and the decrypt variant), if raise_on_error: raise GetParameterError(...) from exc before falling back to the error list. Add a test for both batches. Note for reviewers: code that treated the empty dict as "not found" will now see the exception, which is what the docstring always promised.

Steps to Reproduce

Run the snippet above (it uses botocore.stub.Stubber, no AWS access needed).

Powertools for AWS Lambda (Python) version

latest

AWS Lambda function runtime

3.13

Packaging format used

PyPi

Debugging logs