Repository navigation
Bug: AppConfigProvider never recovers after get_latest_configuration rejects the poll token #8589
Description
Expected Behaviour
When get_latest_configuration fails with BadRequestException (expired or invalid ConfigurationToken), the provider starts a new configuration session and retries. The warm container recovers on the next call.
Current Behaviour
_next_token[name] is kept after a failure (appconfig.py:127-139). Tokens are single-use and expire after 24 hours, so once one is rejected every following get reuses it and fails with GetParameterError until a cold start. The same happens if reading the body fails after the token was consumed, or after a SnapStart restore.
Code snippet
import io
from botocore.config import Config
from botocore.response import StreamingBody
from botocore.stub import Stubber
from aws_lambda_powertools.utilities.parameters import AppConfigProvider
body = StreamingBody(io.BytesIO(b'{"a":1}'), 7)
p = AppConfigProvider(environment="dev", application="app", config=Config(region_name="us-east-1"))
stub = Stubber(p.client)
stub.add_response("start_configuration_session", {"InitialConfigurationToken": "t0"}, None)
stub.add_response("get_latest_configuration",
{"NextPollConfigurationToken": "t1", "Configuration": body, "ContentType": "application/json"},
{"ConfigurationToken": "t0"})
stub.add_client_error("get_latest_configuration", "BadRequestException", "Token expired", expected_params={"ConfigurationToken": "t1"})
stub.add_client_error("get_latest_configuration", "BadRequestException", "Token expired", expected_params={"ConfigurationToken": "t1"})
stub.activate()
for attempt in range(3):
try:
print(attempt, p.get("cfg", max_age=0))
except Exception as exc:
print(attempt, type(exc).__name__, exc)
# 0 b'{"a":1}'
# 1 GetParameterError ... Token expired
# 2 GetParameterError ... Token expired same token reused, no new session is startedPossible Solution
Catch BadRequestException around get_latest_configuration, drop self._next_token[name], start a new session and retry once.
Steps to Reproduce
Run the snippet above (it uses botocore.stub.Stubber, no AWS access needed).
Powertools for AWS Lambda (Python) version
latest
AWS Lambda function runtime
3.13
Packaging format used
PyPi
Debugging logs
Warning
This issue is ready to be picked up, by humans or by agents. If you want it, comment here first so we can assign it to you, and please take only one or two issues at a time so others can join in too. The reproduction above runs locally without AWS access. Thanks!
Activity
proton0210 commentedon Oct 18, 2026
I would like to take this issue. I plan to reproduce the rejected-token behavior with botocore Stubber, add bounded session/token recovery without masking unrelated service errors, and cover repeated calls and recovery failures with offline regression tests. Could you please assign it to me? I will keep the change focused on AppConfig token recovery and validate it before opening a PR.
leandrodamascena commentedon Oct 18, 2026
hey @proton0210 pls go ahead.
proton0210 commentedon Oct 18, 2026
Implemented in #8615 against develop. Rejected poll tokens now trigger one session restart/retry; a rejected replacement is discarded so a later call can recover. A failed body read also discards the consumed token. Unrelated service errors, caching/transforms, and other configuration profiles keep their existing behavior. Added 11 functional regressions; the initial three failed before the fix. Three audit passes completed. Validation: make pr passes (3,784 tests plus 10 performance tests, 96.95% overall coverage); Parameters suite 149 passed with 100% AppConfig provider coverage; SDK-only Nox session 559 passed; the new suite also passes on Python 3.10. Type checks and wheel/source builds pass. All AppConfig calls were stubbed; no live AWS resources or configuration calls were used.
powertools-for-aws-oss-automation commentedon Oct 22, 2026
Warning
This issue is now closed. Please be mindful that future comments are hard for our team to see.
If you need more assistance, please either reopen the issue, or open a new issue referencing this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.