lazy load ssm (#1522)

* lazy load ssm

* lazy load ssm

* fix test

* fix test

Author: Kamil Sobol

.changeset/afraid-cameras-walk.md

@@ -0,0 +1,5 @@
+---
+'@aws-amplify/backend-function': patch
+---
+
+fix: lazy load ssm client in backend function banner

packages/backend-function/src/lambda-shims/resolve_ssm_params.ts

@@ -2,16 +2,14 @@
  * This code loads environment values from SSM and places them in their corresponding environment variables.
  * If there are no SSM environment values for this function, this is a noop.
  */
-import { SSM } from '@aws-sdk/client-ssm';
+import type { SSM } from '@aws-sdk/client-ssm';
 import type { SsmEnvVars } from '../function_env_translator.js';
 
 /**
  * Reads SSM environment context from a known Amplify environment variable,
  * fetches values from SSM and places those values in the corresponding environment variables
  */
-export const internalAmplifyFunctionResolveSsmParams = async (
-  client = new SSM()
-) => {
+export const internalAmplifyFunctionResolveSsmParams = async (client?: SSM) => {
   const envPathObject: SsmEnvVars = JSON.parse(
     process.env.AMPLIFY_SSM_ENV_CONFIG ?? '{}'
   );
@@ -21,8 +19,16 @@ export const internalAmplifyFunctionResolveSsmParams = async (
     return;
   }
 
+  let actualSsmClient: SSM;
+  if (client) {
+    actualSsmClient = client;
+  } else {
+    const ssmSdk = await import('@aws-sdk/client-ssm');
+    actualSsmClient = new ssmSdk.SSM();
+  }
+
   const resolveSecrets = async (paths: string[]) => {
-    const response = await client.getParameters({
+    const response = await actualSsmClient.getParameters({
       Names: paths,
       WithDecryption: true,
     });

packages/integration-tests/src/test-in-memory/data_storage_auth_with_triggers.test.ts

@@ -52,6 +52,7 @@ void it('data storage auth with triggers', () => {
   assertExpectedLogicalIds(templates.defaultNodeFunc, 'AWS::Lambda::Function', [
     'defaultNodeFunctionlambda5C194062',
     'echoFunclambdaE17DCA46',
+    'funcWithSsmlambda6A8824A1',
     'handler2lambda1B9C7EFF',
     'node16Functionlambda97ECC775',
     'onUploadlambdaA252C959',

packages/integration-tests/src/test-project-setup/data_storage_auth_with_triggers.ts

@@ -194,8 +194,15 @@ class DataStorageAuthWithTriggerTestProject extends TestProjectBase {
       (name) => name.includes('node16Function')
     );
 
+    const funcWithSsm = await this.resourceFinder.findByBackendIdentifier(
+      backendId,
+      'AWS::Lambda::Function',
+      (name) => name.includes('funcWithSsm')
+    );
+
     assert.equal(defaultNodeLambda.length, 1);
     assert.equal(node16Lambda.length, 1);
+    assert.equal(funcWithSsm.length, 1);
 
     const expectedResponse = {
       s3TestContent: 'this is some test content',
@@ -206,6 +213,7 @@ class DataStorageAuthWithTriggerTestProject extends TestProjectBase {
 
     await this.checkLambdaResponse(defaultNodeLambda[0], expectedResponse);
     await this.checkLambdaResponse(node16Lambda[0], expectedResponse);
+    await this.checkLambdaResponse(funcWithSsm[0], 'It is working');
 
     const bucketName = await this.resourceFinder.findByBackendIdentifier(
       backendId,

packages/integration-tests/src/test-projects/data-storage-auth-with-triggers-ts/amplify/func-src/handler_with_ssm.ts

@@ -0,0 +1,10 @@
+import { SSM } from '@aws-sdk/client-ssm';
+
+/**
+ * This function asserts that customer can import and use SSM client.
+ * I.e. asserts that the banner we inject doesn't prevent that use case.
+ */
+export const handler = async () => {
+  new SSM();
+  return 'It is working';
+};

packages/integration-tests/src/test-projects/data-storage-auth-with-triggers-ts/amplify/function.ts

@@ -34,3 +34,8 @@ export const onUpload = defineFunction({
   name: 'onUpload',
   entry: './func-src/handler.ts',
 });
+
+export const funcWithSsm = defineFunction({
+  name: 'funcWithSsm',
+  entry: './func-src/handler_with_ssm.ts',
+});

packages/integration-tests/src/test-projects/data-storage-auth-with-triggers-ts/amplify/test_factories.ts

@@ -1,5 +1,5 @@
 import { data } from './data/resource.js';
-import { defaultNodeFunc, node16Func } from './function.js';
+import { defaultNodeFunc, funcWithSsm, node16Func } from './function.js';
 import { storage } from './storage/resource.js';
 import { auth } from './auth/resource.js';
 
@@ -9,4 +9,5 @@ export const dataStorageAuthWithTriggers = {
   defaultNodeFunc,
   data,
   node16Func,
+  funcWithSsm,
 };

packages/integration-tests/src/test-projects/data-storage-auth-with-triggers-ts/hotswap-update-files/function.ts

@@ -36,3 +36,8 @@ export const onUpload = defineFunction({
   name: 'onUpload',
   entry: './func-src/handler.ts',
 });
+
+export const funcWithSsm = defineFunction({
+  name: 'funcWithSsm',
+  entry: './func-src/handler_with_ssm.ts',
+});