[MTirnova]

Issue number: closes #8587

Summary

Changes

When a parameter name includes a version or label selector (/a:prod, /a:3), SSM GetParameters returns the bare name in Name and the requested name in Selector. _transform_and_cache_get_parameters_response looked up Name in the requested parameters, so get_parameters_by_name raised KeyError: '/a'.

• Use Selector as the key when it matches a requested name, otherwise fall back to Name. The same key is used for the response, the cache key and the transform error key.
• This covers both batch paths (plain and all-decrypt), since they share this method. The mixed-decrypt path already worked because it uses get() per parameter.
• Added functional tests for label and version selectors (parametrized over decrypt=False/True) and for the cache: a second call for the same selector is served from the cache under the requested name.

The new tests fail on develop with the KeyError from the issue and pass with this change. tests/functional/parameters passes (141 tests), and ruff and mypy are clean for the changed files.

User experience

Before:

provider.get_parameters_by_name({"/a:prod": {}})
# KeyError: '/a'

After:

provider.get_parameters_by_name({"/a:prod": {}})
# {"/a:prod": "<value of the prod label>"}

This matches provider.get("/a:prod"), which already worked.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.

[boring-cyborg]

Thanks a lot for your first contribution! Please check out our contributing guidelines and don't hesitate to ask whatever you need.
In the meantime, check out the #python channel on our Powertools for AWS Lambda Discord: Invite link

[leandrodamascena]

Thanks @MTirnova, and apologies first: the issue I wrote had the wrong response shape, that's on me. I just ran this against real SSM with a labeled parameter and Selector comes back as only the suffix, ":prod" or ":1", not "/a:prod". So selector in parameters never matches and we fall back to Name. With {"/p:prod": {}, "/p:1": {}, "/p": {}} the result is {"/p": "v1"}: the selector keys disappear and the bare name gets the label's value instead of the latest version.

The fix is simpler than what you have: name = parameter["Name"] + parameter.get("Selector", "") rebuilds exactly the requested key. Could you switch to that and update the stub to the real shape ("Selector": ":prod")? Everything else, the cache under the requested name and the decrypt path, stays as you wrote it. I corrected the issue text too.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.93%. Comparing base (04c55fe) to head (e1b292b).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #8620   +/-   ##
========================================
  Coverage    96.93%   96.93%           
========================================
  Files          318      318           
  Lines        16072    16072           
  Branches      1435     1435           
========================================
  Hits         15580    15580           
  Misses         349      349           
  Partials       143      143           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[MTirnova]

Thanks for checking against real SSM! Switched to Name + Selector and updated the stubs to the real shape: no Selector for names requested without one, and only the suffix (":prod") otherwise. I also added a test for your example, with the same parameter requested by label, by version and without a selector in one batch. It fails on the previous version and passes now.

[leandrodamascena]

Thanks @MTirnova, that was quick! I re-ran it against real SSM with a labeled version, a plain version and a SecureString, mixing label, version and bare name in the same batch, plus the all-decrypt and the mixed decrypt paths, and every value lands under the key that was requested, from the API and from the cache. Thanks for the extra test with the three selectors together.

Approving now. This goes out in 3.38.0, so it will sit here a bit before I merge. No need to rebase or touch anything, I'll take care of it and you'll get the credit in the release notes. Thank you!

[leandrodamascena]

Rebased this on develop myself to resolve a conflict in the test file with #8607 and #8616 that landed first, both of your commits are intact. Suite still green locally. Re-approving.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud