fix(parameters): invalidate cache after set_parameter and set_secret

aws_lambda_powertools/utilities/parameters/base.py

@@ -206,6 +206,30 @@
     def clear_cache(self):
         self.store.clear()
 
+    def _invalidate_cache(self, name: str) -> None:
+        """Remove cached values for a single parameter or secret name, across all transforms
+
+        Only entries holding a single value are removed. Grouped entries, created by
+        ``get_multiple``, hold the values of multiple names under a single key, so they
+        are kept intact to avoid evicting unrelated values. Use ``force_fetch=True``
+        on the next read to refresh grouped results.
+
+        Parameters
+        ----------
+        name: str
+            Parameter or secret name whose cached values should be removed
+        """
+        for key in list(self.store):
+            if key[0] != name:
+                continue
+
+            # Grouped entries hold multiple values under one key; their third element is is_nested=True.
+            # Keys can also carry a fourth sdk_options element and can be two-element batch keys.
+            if len(key) >= 3 and key[2]:
+                continue
+
+            del self.store[key]
+
     def fetch_from_cache(self, key: tuple):
         return self.store[key].value if key in self.store else {}
 

aws_lambda_powertools/utilities/parameters/secrets.py

@@ -411,13 +411,18 @@ def set(
 
         try:
             logger.debug(f"Attempting to update secret {name}")
-            return self._update_secret(name=name, **sdk_options)
+            response = self._update_secret(name=name, **sdk_options)
         except self.client.exceptions.ResourceNotFoundException:
             logger.debug(f"Secret {name} doesn't exist, creating a new one")
-            return self._create_secret(name=name, **sdk_options)
+            response = self._create_secret(name=name, **sdk_options)
         except Exception as exc:
             raise SetSecretError(f"Error setting secret - {str(exc)}") from exc
 
+        # Remove any cached value for this secret so the next read returns what we just wrote
+        self._invalidate_cache(name)
+
+        return response
+
 
 @overload
 def get_secret(

aws_lambda_powertools/utilities/parameters/ssm.py

@@ -364,10 +364,15 @@ def set(
             opts["KeyId"] = kms_key_id
 
         try:
-            return self.client.put_parameter(**opts)
+            response = self.client.put_parameter(**opts)
         except Exception as exc:
             raise SetParameterError(f"Error setting parameter - {str(exc)}") from exc
 
+        # Remove any cached value for this parameter so the next read returns what we just wrote
+        self._invalidate_cache(name)
+
+        return response
+
     def _get(self, name: str, decrypt: bool = False, **sdk_options) -> str:
         """
         Retrieve a parameter value from AWS Systems Manager Parameter Store