Repository navigation
Bug: SecretsProvider.get_multiple appends to the caller's Filters list on every call #8596
Description
Expected Behaviour
Passing Filters=[...] through sdk_options leaves the caller's list untouched and sends only that filter plus the current name filter.
Current Behaviour
_get_multiple (secrets.py:157-160) does filters.append(name_filter) on the list object the caller passed. A module-level Filters constant, as in the docs example, grows one stale name filter per call, and the second request sends both.
Code snippet
from botocore.config import Config
from botocore.stub import Stubber
from aws_lambda_powertools.utilities.parameters import SecretsProvider
provider = SecretsProvider(boto_config=Config(region_name="us-east-1"))
stub = Stubber(provider.client)
my_filters = [{"Key": "primary-region", "Values": ["us-east-1"]}]
stub.add_response("batch_get_secret_value", {"SecretValues": [{"Name": "a", "SecretString": "1"}]}, None)
stub.add_response("batch_get_secret_value", {"SecretValues": [{"Name": "b", "SecretString": "2"}]}, None)
stub.activate()
provider.get_multiple(["a"], Filters=my_filters)
provider.get_multiple(["b"], Filters=my_filters)
print(my_filters)
# [{'Key': 'primary-region', ...}, {'Key': 'name', 'Values': ['a']}, {'Key': 'name', 'Values': ['b']}]Possible Solution
filters = [*sdk_options.get("Filters", []), name_filter] instead of appending in place.
Steps to Reproduce
Run the snippet above (it uses botocore.stub.Stubber, no AWS access needed).
Powertools for AWS Lambda (Python) version
latest
AWS Lambda function runtime
3.13
Packaging format used
PyPi
Debugging logs
Warning
This issue is ready to be picked up, by humans or by agents. If you want it, comment here first so we can assign it to you, and please take only one or two issues at a time so others can join in too. The reproduction above runs locally without AWS access. Thanks!
Activity
leandrodamascena commentedon Oct 19, 2026
Hey @wanjinhao1 thanks, #8604 is yours. Will review.
macoladik commentedon Oct 22, 2026
Picked this up — reproduced the accumulation with the snippet from the report. The fix builds a new filters list instead of appending to the caller's, and adds a regression test for the reuse case.
PR: #8650
powertools-for-aws-oss-automation commentedon Oct 29, 2026
Warning
This issue is now closed. Please be mindful that future comments are hard for our team to see.
If you need more assistance, please either reopen the issue, or open a new issue referencing this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.
fix(parameters): do not mutate the caller's Filters list in SecretsPr…