"EndpointError: Credentials-sourced account ID parameter is invalid" on DynamoDB command

[atresca-growie]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

When sending Get/Post commands to Dynamo we are getting "EndpointError: Credentials-sourced account ID parameter is invalid".

Dynamo client is initialized without credentials since we are using IAM roles.

this.db = new DynamoDBClient({
        apiVersion: '2012-08-10',
        region: 'us-east-1',
      });

We do not know the exact version in which fails since this Lambdas don't have the sdk on the bundle, we are using "Lambda Provided JS SDK v3" due to a Lambda size limit problem we were facing on that repository.

HOW DO WE SOLVE IT: We were able to add only the "client-dynamodb" lib and the "lib-dynamodb" (just in case...) on our bundle with a prior version (v3.489) and it worked again. We check that there was a related/similar issue and tried v3.662 and v3.775 versions which should be stable but wasn't the case.

Error started occurring on Friday 03/21 on "Lambda Provided JS SDK v3"

Regression Issue

• Select this option if this issue appears to be a regression.

SDK version number

@aws-sdk/client-dynamodb

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

v20.18.2

Reproduction Steps

import { DynamoDBClient, GetItemCommand } from "@aws-sdk/client-dynamodb";

const client = new DynamoDBClient({ apiVersion: '2012-08-10', region: "us-east-1" }); // Change region if needed

const getItem = async () => {
    const params = {
        TableName: "YourTableName", // Replace with your actual table name
        Key: {
            userId: { S: "12345" }, // Replace with the actual partition key value
        },
    };

    try {
        const command = new GetItemCommand(params);
        const response = await client.send(command);
        console.log("Item:", response.Item);
    } catch (error) {
        console.error("Error:", error);
    }
};

getItem();

Observed Behavior

Error started happening on a repository using aws-sdk directly from the Lambda runtime, it wasn't happening on repos with bundled sdk (tough we are using package-lock, so we have old versions of the sdk and wouldn't have detected the issue).

We did a test with a working repo in which we changed the bundled version in our package-lock from v3.489 to v3.705 and it broke.

Expected Behavior

We expect for the get command to execute without failure

Possible Solution

Reverting to a prior version (v3.489 worked for us)

Additional Information/Context

No response

[kuhe]

if you check the credentials of your client for one of the non-working versions, what is the value of accountId?

Don't post your actual accountId. Acceptable values should be undefined or a 12-digit numeric string.
If it is a function or some other string, that would help us diagnose the issue.

const client = new DynamoDBClient({
  region: 'us-east-1',
});

console.log(
  (await client.config.credentials()).accountId
);

[atresca-growie]

Lambda debug code:

console.log("1")
console.log("this.db", this.db)
console.log("accountId", (await this.db.config.credentials()).accountId);
console.log("this.dbClient", this.dbClient)
console.log("2")
const getCommand = new lib_dynamodb_1.GetCommand(getParams);
console.log("3")
const res = await this.dbClient.send(getCommand);
console.log("4")

Cloudwatch:

It seems like is not compiling the value from our template.yaml.

Globals:
  Api:
    OpenApiVersion: 3.0.1
  Function:
    Timeout: 100
    MemorySize: 512
    Runtime: nodejs20.x
    CodeUri: dist/
    Tracing: Active
    Tags:
      app: !Ref Application
      environment: !Ref Environment
      origin: "sam"
      repo: "core-serverlessbackend-investmentmgmt"
      bc: "balancesandcontracts"
      aggregate: "investment"
    Environment:
      Variables:
        ENVIRONMENT: !Ref Environment
        APPLICATION: !Ref Application
        AWSREGION: !Sub '${AWS::Region}'
        ...
        AWS_ACCOUNT_ID: /common/AWS_ACCOUNT_ID

[atresca-growie]

Added this log to see which version is on the Lambda runtime and apparently is v3.726.1

const pkg = require('@aws-sdk/lib-dynamodb/package.json');
console.log(pkg.version);

[kuhe]

An invalid format for the accountId portion of the credentials is the cause, then.

DynamoDB released a feature between the previous and current AWS Lambda bundled AWS SDK versions that uses the account id from your credentials to route the request. See #6520.

To fix this, either ensure the accountId provided along with credentials is in the AWS 12-digit numeric string format, or turn off accountIdEndpointMode.

new DynamoDBClient({
  accountIdEndpointMode: 'disabled'
});