KeyError: 'runtime' in FedRAMP inventory script

[nadove-ucsc]

GitLab job failed three times.

[nadove-ucsc]

Spike to investigate.

[nadove-ucsc]

The failure is caused by several Lambda functions belonging to @achave11-ucsc 's personal deployment that are lacking the expected runtime entry in their config attribute. When the script encounters these functions, it raises a KeyError and crashes:

azul/src/azul/compliance/fedramp_inventory_service.py

Line 160 in 787e5d0

baseline_config=resource.config['runtime'],

I suspect this was caused by Abraham's work on #7730

diff --git a/src/azul/compliance/fedramp_inventory_service.py b/src/azul/compliance/fedramp_inventory_service.py
index 7798b0834..d7a8bcfba 100644
--- a/src/azul/compliance/fedramp_inventory_service.py
+++ b/src/azul/compliance/fedramp_inventory_service.py
@@ -155,15 +155,19 @@ class LambdaMapper(Mapper):
         return {'AWS::Lambda::Function'}
 
     def map(self, resource: ResourceConfig) -> Iterator[InventoryRow]:
-        yield InventoryRow(
-            asset_type='AWS Lambda Function',
-            baseline_config=resource.config['runtime'],
-            is_public=YesNo.no,
-            is_virtual=YesNo.yes,
-            purpose=resource.config.get('description'),
-            software_product_name='AWS Lambda',
-            **self._common_fields(resource)
-        )
+        if 'runtime' not in resource.config:
+            json.dump(attr.asdict(resource), sys.stdout, indent=4)
+            sys.stdout.flush()
+        else:
+            yield InventoryRow(
+                asset_type='AWS Lambda Function',
+                baseline_config=resource.config['runtime'],
+                is_public=YesNo.no,
+                is_virtual=YesNo.yes,
+                purpose=resource.config.get('description'),
+                software_product_name='AWS Lambda',
+                **self._common_fields(resource)
+            )
 
 
 class ElasticSearchMapper(Mapper):

$ 2>&1 python scripts/compliance/fedramp_inventory.py fedramp_inventory.xlsx | grep '"id":'
    "id": "azul-indexer-achave11-mirror",
    "id": "azul-service-achave11-manifest",
    "id": "azul-service-achave11",
    "id": "azul-indexer-achave11-indexercachehealth",
    "id": "azul-indexer-achave11-aggregate",
    "id": "azul-indexer-achave11-aggregate_retry",
    "id": "azul-indexer-achave11",
    "id": "azul-service-achave11-servicecachehealth",
    "id": "azul-indexer-achave11-contribute_retry",
    "id": "azul-indexer-achave11-contribute",

[nadove-ucsc]

Spike to diagnose and propose solution.

[achave11-ucsc]

The baseline_config inventory row for Lambdas expects a runtime entry in its config, as Noa mentioned. The container-base images do not define a runtime, that is an exclusive config setting of the ZIP based lambdas.

All Lambda types define a package type (Image | Zip), when the runtime isn't available, the package type should be provided as the Lambda baseline config row for the inventory.

diff --git a/src/azul/compliance/fedramp_inventory_service.py b/src/azul/compliance/fedramp_inventory_service.py
index 7798b0834..6c46029cf 100644
--- a/src/azul/compliance/fedramp_inventory_service.py
+++ b/src/azul/compliance/fedramp_inventory_service.py
@@ -155,9 +155,12 @@ class LambdaMapper(Mapper):
         return {'AWS::Lambda::Function'}
 
     def map(self, resource: ResourceConfig) -> Iterator[InventoryRow]:
+        # A container-based Lambda uses an image as its base configuration, so
+        # we use that instead when the runtime isn't available.
+        package_type = resource.config.get('packageType')
         yield InventoryRow(
             asset_type='AWS Lambda Function',
-            baseline_config=resource.config['runtime'],
+            baseline_config=resource.config.get('runtime', package_type),
             is_public=YesNo.no,
             is_virtual=YesNo.yes,
             purpose=resource.config.get('description'),

[hannes-ucsc]

All Lambda types define a package type

Then why use .get to access it?

[achave11-ucsc]

Then why use .get to access it?

That was an oversight. It was thinking in the unlikely case that a package type might not be defined for a Lambda , in that case the FedRAMP inventory would still be generated.

[dsotirho-ucsc]

Assignee to file PR with proposed solution, but with square brackets instead of .get()