Repository navigation
Bug: VPC Lattice v2 x509 identity fields are always None #8627
Description
Expected Behaviour
VPCLatticeEventV2.request_context.identity and VpcLatticeV2Model.request_context.identity should expose the Roles Anywhere certificate fields that VPC Lattice sends in requestContext.identity: x509IssuerOu, x509SanDns, x509SanNameCn, x509SanUri and x509SubjectCn (see the V2 event example in the VPC Lattice docs).
Current Behaviour
Only x509_san_dns works. The other four are looked up with a capital X (X509SubjectCn, X509IssuerOu, X509SanUri, X509SanNameCn), both in the data class (aws_lambda_powertools/utilities/data_classes/vpc_lattice.py) and in the aliases of VpcLatticeV2RequestContextIdentity in the parser model, so they are always None for real events:
@property
def x509_subject_cn(self) -> str | None:
return self.get("X509SubjectCn")
@property
def x509_san_dns(self) -> str | None:
return self.get("x509SanDns")Code snippet
from aws_lambda_powertools.utilities.data_classes import VPCLatticeEventV2
from aws_lambda_powertools.utilities.parser.models import VpcLatticeV2Model
event = {
"version": "2.0",
"path": "/",
"method": "GET",
"headers": {},
"body": "",
"isBase64Encoded": False,
"requestContext": {
"serviceNetworkArn": "arn:aws:vpc-lattice:us-east-1:123456789012:servicenetwork/sn-0bf3f2882e9cc805a",
"serviceArn": "arn:aws:vpc-lattice:us-east-1:123456789012:service/svc-0a40eebed65f8d69c",
"targetGroupArn": "arn:aws:vpc-lattice:us-east-1:123456789012:targetgroup/tg-6d0ecf831eec9f09",
"identity": {
"x509IssuerOu": "IT Department",
"x509SanDns": "example.com",
"x509SanNameCn": "example-name",
"x509SanUri": "https://example.com",
"x509SubjectCn": "example-subject",
},
"region": "us-east-1",
"timeEpoch": "1690497599177430",
},
}
identity = VPCLatticeEventV2(event).request_context.identity
print(identity.x509_san_dns) # example.com
print(identity.x509_subject_cn) # None
model = VpcLatticeV2Model(**event)
print(model.request_context.identity.x509_subject_cn) # NonePossible Solution
Use the camelCase keys (x509SubjectCn, x509IssuerOu, x509SanUri, x509SanNameCn) in both the data class and the parser model, like x509SanDns already does. Test events written by hand with the capitalized keys would stop populating these fields, but VPC Lattice doesn't send those keys. Happy to send a PR with tests.
Steps to Reproduce
Run the snippet above, or invoke a function behind a VPC Lattice V2 target group with a client authenticated through IAM Roles Anywhere and read the x509 fields from the identity.
Powertools for AWS Lambda (Python) version
latest
AWS Lambda function runtime
3.12
Packaging format used
PyPi
Debugging logs
No response
Activity
powertools-for-aws-oss-automation commentedon Oct 23, 2026
Warning
This issue is now closed. Please be mindful that future comments are hard for our team to see.
If you need more assistance, please either reopen the issue, or open a new issue referencing this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.
github-actions commentedon Oct 28, 2026
This is now released under 3.38.0 version!