Skip to content

feat(runtime-interface-client): Add Lambda-Runtime-Invocation-Id support for cross-wiring protection#624

Open
vip-amzn wants to merge 1 commit into
mainfrom
feat/invocation-id-cross-wiring
Open

feat(runtime-interface-client): Add Lambda-Runtime-Invocation-Id support for cross-wiring protection#624
vip-amzn wants to merge 1 commit into
mainfrom
feat/invocation-id-cross-wiring

Conversation

@vip-amzn

Copy link
Copy Markdown

Summary

Add Lambda-Runtime-Invocation-Id header support for cross-wiring protection.

The RIC now echoes the invocation ID received from RAPID on /next back on /response and /error, enabling RAPID to detect and reject stale responses from timed-out invocations.

Problem

On Lambda Managed Instances (LMI) and On-Demand (OD), when an invoke times out, the runtime process continues running in the background. If a new invoke arrives with the same requestId, RAPID accepts it. The still-running old invocation eventually posts its response, and RAPID matches it to the new invoke — delivering the wrong response (cross-wiring).

Solution

RAPID sends a unique per-invoke identifier via Lambda-Runtime-Invocation-Id header on /next. The runtime echoes it back on /response and /error. RAPID validates the match before accepting the response.

Changes

  • aws-lambda-cpp-0.2.7/runtime.h: Added invocation_id field to invocation_request, added param to post_success/post_failure/do_post
  • aws-lambda-cpp-0.2.7/runtime.cpp: Parse header in get_next(), add to curl request in do_post() when non-empty
  • NativeClient.cpp/.h: JNI reads invocation_id from C++ response, passes to Java; postInvocationResponse accepts nullable invocationId
  • InvocationRequest.java: New invocationId field
  • NativeClient.java: Updated native method signature
  • LambdaRuntimeApiClient.java/Impl: reportInvocationSuccess/reportInvocationError accept invocationId
  • AWSLambda.java: Thread invocationId through runtime loop
  • Unit tests: Updated assertions for new parameter
  • Version bump: 2.11.0 → 2.12.0

Backward Compatibility

Fully backward compatible in both directions:

  • If RAPID doesn't send the header → RIC doesn't see it → doesn't echo → no behavior change
  • If RIC doesn't echo it (old version) → RAPID skips validation → no behavior change

…ort for cross-wiring protection

Echo the invocation ID received from RAPID on /next back on /response
and /error, enabling RAPID to detect and reject stale responses from
timed-out invocations. Fully backward compatible.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant