@aspan-corporation/ac-shared 1.2.35 → 1.2.36

package/lib/lambda/index.js

@@ -14,7 +14,11 @@ export { MetricUnit } from "@aws-lambda-powertools/metrics";
 export const tracer = new Tracer();
 export const metrics = new Metrics({ namespace: "aspan-corporation" });
 export const withMiddlewares = (handler) => middy(handler)
-    .use(injectLambdaContext(logger, { logEvent: true }))
+    // logEvent is deliberately false: several handlers are fronted by API
+    // Gateway, whose proxy event carries the caller's `Authorization` header
+    // (a live Cognito token). Logging the full event would persist those
+    // tokens to CloudWatch. Handlers log the specific fields they need.
+    .use(injectLambdaContext(logger, { logEvent: false }))
     .use(captureLambdaHandler(tracer))
     .use(logMetrics(metrics, { captureColdStartMetric: true }))
     .use({

package/lib/services/sts.d.ts

@@ -1,5 +1,10 @@
 import { Logger } from "@aws-lambda-powertools/logger";
-import { AssumeRoleCommandInput, STSClient } from "@aws-sdk/client-sts";
+import { AssumeRoleCommandInput, AssumeRoleCommandOutput, STSClient } from "@aws-sdk/client-sts";
+/**
+ * Clear the module-scoped assume-role credential cache. Intended for tests
+ * only, so each case starts from a known state.
+ */
+export declare const clearAssumeRoleCache: () => void;
 export declare class STSService {
     logger: Logger;
     client: STSClient;
@@ -9,6 +14,6 @@ export declare class STSService {
         client?: STSClient;
     });
     getCallerIdentity(): Promise<import("@aws-sdk/client-sts").GetCallerIdentityCommandOutput>;
-    assumeRole(assumeRoleCommandInput: AssumeRoleCommandInput): Promise<import("@aws-sdk/client-sts").AssumeRoleCommandOutput>;
+    assumeRole(assumeRoleCommandInput: AssumeRoleCommandInput): Promise<AssumeRoleCommandOutput>;
 }
 export type { AssumeRoleCommandInput, AssumeRoleCommandOutput } from "@aws-sdk/client-sts";

package/lib/services/sts.js

@@ -1,6 +1,34 @@
 import { Logger } from "@aws-lambda-powertools/logger";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import assert from "node:assert/strict";
+// Module-scoped cache of assumed-role credentials, shared across every
+// STSService instance in the same execution environment. Lambda handlers
+// construct a fresh STSService per invocation (usually in a middy `before`
+// hook), so an instance-level cache would never hit. Keying at module scope
+// means a warm container assumes the role once and reuses the credentials
+// until they are close to expiry, removing an STS round-trip (~50-150ms) from
+// every invocation.
+const REFRESH_BUFFER_MS = 5 * 60 * 1000;
+const credentialCache = new Map();
+const cacheKey = (input) => [
+    input.RoleArn,
+    input.RoleSessionName,
+    input.ExternalId ?? "",
+    input.DurationSeconds ?? "",
+    input.SerialNumber ?? ""
+].join("|");
+const isFresh = (output) => {
+    const expiration = output.Credentials?.Expiration;
+    return (expiration instanceof Date &&
+        expiration.getTime() - REFRESH_BUFFER_MS > Date.now());
+};
+/**
+ * Clear the module-scoped assume-role credential cache. Intended for tests
+ * only, so each case starts from a known state.
+ */
+export const clearAssumeRoleCache = () => {
+    credentialCache.clear();
+};
 export class STSService {
     logger;
     client;
@@ -27,7 +55,20 @@ export class STSService {
         return await this.client.send(new GetCallerIdentityCommand({}));
     }
     async assumeRole(assumeRoleCommandInput) {
+        const key = cacheKey(assumeRoleCommandInput);
+        const cached = credentialCache.get(key);
+        if (cached && isFresh(cached)) {
+            this.logger.debug("assumeRole cache hit", {
+                roleArn: assumeRoleCommandInput.RoleArn
+            });
+            return cached;
+        }
         this.logger.debug("assumeRole", { assumeRoleCommandInput });
-        return await this.client.send(new AssumeRoleCommand(assumeRoleCommandInput));
+        const output = await this.client.send(new AssumeRoleCommand(assumeRoleCommandInput));
+        // Only cache credentials that carry an expiry we can reason about.
+        if (output.Credentials?.Expiration) {
+            credentialCache.set(key, output);
+        }
+        return output;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aspan-corporation/ac-shared",
-  "version": "1.2.35",
+  "version": "1.2.36",
   "description": "",
   "keywords": [],
   "exports": {
@@ -36,12 +36,15 @@
     "clean": "rm -rf lib",
     "build": "npm run clean && npm run build:code && npm run build:types",
     "build:code": "tsc --declaration false --emitDeclarationOnly false",
-    "build:types": "tsc --emitDeclarationOnly --declaration"
+    "build:types": "tsc --emitDeclarationOnly --declaration",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "devDependencies": {
     "@types/aws-lambda": "^8.10.137",
     "@types/node": "^20.12.5",
-    "typescript": "^5.4.4"
+    "typescript": "^5.4.4",
+    "vitest": "^4.1.9"
   },
   "dependencies": {
     "@aws-lambda-powertools/batch": "^2.30.2",