feat(parameters): add feature for creating and updating Parameters and Secrets

[stephenbawks]

Issue number: #2826

Summary

This PR boosts parameter and secret management by allowing updates and creations. With enhanced functionality, it allow users to efficiently manage existing parameters and secrets, while also facilitating the creation of new ones as needed.

User experience

Setting parameter

from aws_lambda_powertools.utilities import parameters
from aws_lambda_powertools.utilities.typing import LambdaContext


def lambda_handler(event: dict, context: LambdaContext) -> dict:
    try:
        # Set a single parameter, returns the version ID of the parameter
        parameter_version = parameters.set_parameter(name="/mySuper/Parameter", value="PowerToolsIsAwesome")

        return {"mySuperParameterVersion": parameter_version, "statusCode": 200}
    except parameters.exceptions.SetParameterError as error:
        return {"comments": None, "message": str(error), "statusCode": 400}

Setting secret

from typing import Any

from aws_lambda_powertools import Logger
from aws_lambda_powertools.utilities import parameters
from aws_lambda_powertools.utilities.typing import LambdaContext

logger = Logger(serialize_stacktrace=True)


def access_token(client_id: str, client_secret: str, audience: str) -> str:
    # example function that returns a JWT Access Token
    # add your own logic here
    return f"{client_id}.{client_secret}.{audience}"


def lambda_handler(event: dict, context: LambdaContext):
    try:
        client_id: Any = parameters.get_parameter("/aws-powertools/client_id")
        client_secret: Any = parameters.get_parameter("/aws-powertools/client_secret")
        audience: Any = parameters.get_parameter("/aws-powertools/audience")

        jwt_token = access_token(client_id=client_id, client_secret=client_secret, audience=audience)

        # set-secret will create a new secret if it doesn't exist and return the version id
        update_secret_version_id = parameters.set_secret(name="/aws-powertools/jwt_token", value=jwt_token)

        return {"access_token": "updated", "statusCode": 200, "update_secret_version_id": update_secret_version_id}
    except parameters.exceptions.SetSecretError as error:
        logger.exception(error)
        return {"access_token": "updated", "statusCode": 400}

Checklist

If your change doesn't seem to apply, please leave them unchecked.

• Meet tenets criteria
• I have performed a self-review of this change
• Changes have been tested
• Changes are documented
• PR title follows conventional commit semantics

Is this a breaking change?

RFC issue number:

Checklist:

• Migration process documented
• Implement warnings (if it can live side by side)

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.

[sonarqubecloud]

SonarCloud Quality Gate failed.   

2 Bugs
0 Vulnerabilities
6 Security Hotspots
23 Code Smells

No Coverage information
0.2% Duplication

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

[stephenbawks]

@heitorlessa @aradyaron @leandrodamascena
Wondering if I can get a temperature check on this PR so far?

[heitorlessa]

@sthulb would you be able to do a quick pass on UX?

I can look into it tomorrow afternoon (Boston time this week).

Hey @stephenbawks Leandro, Ruben and I are on events this week (delays) so we appreciate the nudge

[leandrodamascena]

This PR is now ready for the final reviews before merging! Huge thanks to @stephenbawks and @heitorlessa for all their hard work and contributions!

Following some additional information about itens I've addressed:

Think whether we can have a better name for client_request_token (it'll be important if we support any provider)

We are working exclusively with AWS on this provider, if we have to extend to another provider from BaseProvider, we can think of another name for this provider, but I think client_request_token makes a lot of sense to be 100% following the SDK.

Think about creating a better return contract

Yes, it makes sense to return the dict that comes from the SDK so that the customer can choose what information he wants to use. For this, I created SetSecretResponse to help with the IDE's typing hit

Please let me know if you have any questions.

[rubenfonseca]

Starting reviewing now

[rubenfonseca]

Great job, first pass. Will look into the documentation on the next pass.

[rubenfonseca]

Just left two small things, otherwise approved!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
1.5% Duplication on New Code

See analysis details on SonarCloud