localstack-core 4.6.1.dev60__py3-none-any.whl → 4.10.1.dev12__py3-none-any.whl

localstack/services/kms/models.py

@@ -10,7 +10,6 @@ import struct
 import uuid
 from collections import namedtuple
 from dataclasses import dataclass
-from typing import Dict, Optional, Tuple
 
 from cryptography.exceptions import InvalidSignature, InvalidTag, UnsupportedAlgorithm
 from cryptography.hazmat.backends import default_backend
@@ -91,9 +90,7 @@ KEY_ID_LEN = 36
 # Moto uses IV_LEN of 12, as it is fine for GCM encryption mode, but we use CBC, so have to set it to 16.
 IV_LEN = 16
 TAG_LEN = 16
-CIPHERTEXT_HEADER_FORMAT = ">{key_id_len}s{iv_len}s{tag_len}s".format(
-    key_id_len=KEY_ID_LEN, iv_len=IV_LEN, tag_len=TAG_LEN
-)
+CIPHERTEXT_HEADER_FORMAT = f">{KEY_ID_LEN}s{IV_LEN}s{TAG_LEN}s"
 HEADER_LEN = KEY_ID_LEN + IV_LEN + TAG_LEN
 Ciphertext = namedtuple("Ciphertext", ("key_id", "iv", "ciphertext", "tag"))
 
@@ -138,7 +135,7 @@ def deserialize_ciphertext_blob(ciphertext_blob: bytes) -> Ciphertext:
     return Ciphertext(key_id=key_id.decode("utf-8"), iv=iv, ciphertext=ciphertext, tag=tag)
 
 
-def _serialize_encryption_context(encryption_context: Optional[EncryptionContextType]) -> bytes:
+def _serialize_encryption_context(encryption_context: EncryptionContextType | None) -> bytes:
     if encryption_context:
         aad = io.BytesIO()
         for key, value in sorted(encryption_context.items(), key=lambda x: x[0]):
@@ -173,8 +170,8 @@ class KmsCryptoKey:
     by AWS and is not used by AWS.
     """
 
-    public_key: Optional[bytes]
-    private_key: Optional[bytes]
+    public_key: bytes | None
+    private_key: bytes | None
     key_material: bytes
     key_spec: str
 
@@ -217,7 +214,7 @@ class KmsCryptoKey:
 
         raise UnsupportedOperationException(f"KeySpec {key_spec} is not supported")
 
-    def __init__(self, key_spec: str, key_material: Optional[bytes] = None):
+    def __init__(self, key_spec: str, key_material: bytes | None = None):
         self.private_key = None
         self.public_key = None
         # Technically, key_material, being a symmetric encryption key, is only relevant for
@@ -251,7 +248,13 @@ class KmsCryptoKey:
         self._serialize_key(key)
 
     def load_key_material(self, material: bytes):
-        if self.key_spec == "SYMMETRIC_DEFAULT":
+        if self.key_spec in [
+            KeySpec.SYMMETRIC_DEFAULT,
+            KeySpec.HMAC_224,
+            KeySpec.HMAC_256,
+            KeySpec.HMAC_384,
+            KeySpec.HMAC_512,
+        ]:
             self.key_material = material
         else:
             key = crypto_serialization.load_der_private_key(material, password=None)
@@ -280,7 +283,7 @@ class KmsCryptoKey:
 class KmsKey:
     metadata: KeyMetadata
     crypto_key: KmsCryptoKey
-    tags: Dict[str, str]
+    tags: dict[str, str]
     policy: str
     is_key_rotation_enabled: bool
     rotation_period_in_days: int
@@ -752,7 +755,7 @@ class KmsGrant:
     # keys. But, based on our understanding of AWS documentation for CreateGrant, ListGrants operations etc,
     # AWS has some set of fields for grants like it has for keys. So we are going to call them `metadata` here for
     # consistency.
-    metadata: Dict
+    metadata: dict
     # Tokens are not a part of metadata, as their use is more limited and specific than for the rest of the
     # metadata: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
     # Tokens are used to refer to a grant in a short period right after the grant gets created. Normally it might
@@ -797,7 +800,7 @@ class KmsGrant:
 class KmsAlias:
     # Like with grants (see comment for KmsGrant), there is no mention of some specific object modeling metadata
     # for KMS aliases. But there is data that is some metadata, so we model it in a way similar to KeyMetadata for keys.
-    metadata: Dict
+    metadata: dict
 
     def __init__(
         self,
@@ -827,25 +830,25 @@ class KeyImportState:
 
 class KmsStore(BaseStore):
     # maps key ids to keys
-    keys: Dict[str, KmsKey] = LocalAttribute(default=dict)
+    keys: dict[str, KmsKey] = LocalAttribute(default=dict)
 
     # According to AWS documentation on grants https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html
     # "Cross-account use: Yes. You can retire a grant on a KMS key in a different AWS account."
 
     # maps grant ids to grants
-    grants: Dict[str, KmsGrant] = LocalAttribute(default=dict)
+    grants: dict[str, KmsGrant] = LocalAttribute(default=dict)
 
     # maps from (grant names (used for idempotency), key id) to grant ids
-    grant_names: Dict[Tuple[str, str], str] = LocalAttribute(default=dict)
+    grant_names: dict[tuple[str, str], str] = LocalAttribute(default=dict)
 
     # maps grant tokens to grant ids
-    grant_tokens: Dict[str, str] = LocalAttribute(default=dict)
+    grant_tokens: dict[str, str] = LocalAttribute(default=dict)
 
     # maps key alias names to aliases
-    aliases: Dict[str, KmsAlias] = LocalAttribute(default=dict)
+    aliases: dict[str, KmsAlias] = LocalAttribute(default=dict)
 
     # maps import tokens to import data
-    imports: Dict[str, KeyImportState] = LocalAttribute(default=dict)
+    imports: dict[str, KeyImportState] = LocalAttribute(default=dict)
 
 
 kms_stores = AccountRegionBundle("kms", KmsStore)

localstack/services/kms/provider.py

@@ -3,10 +3,10 @@ import copy
 import datetime
 import logging
 import os
-from typing import Dict, Tuple
 
 from cryptography.exceptions import InvalidTag
-from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import hashes, keywrap
 from cryptography.hazmat.primitives.asymmetric import padding
 
 from localstack.aws.api import CommonServiceException, RequestContext, handler
@@ -85,6 +85,7 @@ from localstack.aws.api.kms import (
     MacAlgorithmSpec,
     MarkerType,
     MultiRegionKey,
+    MultiRegionKeyType,
     NotFoundException,
     NullableBooleanType,
     OriginType,
@@ -358,7 +359,7 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
         return store.aliases.get(alias_name)
 
     @staticmethod
-    def _parse_key_id(key_id_or_arn: str, context: RequestContext) -> Tuple[str, str, str]:
+    def _parse_key_id(key_id_or_arn: str, context: RequestContext) -> tuple[str, str, str]:
         """
         Return locator attributes (account ID, region_name, key ID) of a given KMS key.
 
@@ -490,24 +491,32 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
         self, context: RequestContext, request: ReplicateKeyRequest
     ) -> ReplicateKeyResponse:
         account_id = context.account_id
-        key = self._get_kms_key(account_id, context.region, request.get("KeyId"))
-        key_id = key.metadata.get("KeyId")
-        if not key.metadata.get("MultiRegion"):
+        primary_key = self._get_kms_key(account_id, context.region, request.get("KeyId"))
+        key_id = primary_key.metadata.get("KeyId")
+        key_arn = primary_key.metadata.get("Arn")
+        if not primary_key.metadata.get("MultiRegion"):
             raise UnsupportedOperationException(
                 f"Unable to replicate a non-MultiRegion key {key_id}"
             )
         replica_region = request.get("ReplicaRegion")
         replicate_to_store = kms_stores[account_id][replica_region]
+
+        if (
+            primary_key.metadata.get("MultiRegionConfiguration", {}).get("MultiRegionKeyType")
+            != MultiRegionKeyType.PRIMARY
+        ):
+            raise UnsupportedOperationException(f"{key_arn} is not a multi-region primary key.")
+
         if key_id in replicate_to_store.keys:
             raise AlreadyExistsException(
                 f"Unable to replicate key {key_id} to region {replica_region}, as the key "
                 f"already exist there"
             )
-        replica_key = copy.deepcopy(key)
+        replica_key = copy.deepcopy(primary_key)
         replica_key.replicate_metadata(request, account_id, replica_region)
         replicate_to_store.keys[key_id] = replica_key
 
-        self.update_primary_key_with_replica_keys(key, replica_key, replica_region)
+        self.update_primary_key_with_replica_keys(primary_key, replica_key, replica_region)
 
         return ReplicateKeyResponse(ReplicaKeyMetadata=replica_key.metadata)
 
@@ -1164,22 +1173,10 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
             disabled_key_allowed=True,
         )
 
-        if import_state.wrapping_algo == AlgorithmSpec.RSAES_PKCS1_V1_5:
-            decrypt_padding = padding.PKCS1v15()
-        elif import_state.wrapping_algo == AlgorithmSpec.RSAES_OAEP_SHA_1:
-            decrypt_padding = padding.OAEP(padding.MGF1(hashes.SHA1()), hashes.SHA1(), None)
-        elif import_state.wrapping_algo == AlgorithmSpec.RSAES_OAEP_SHA_256:
-            decrypt_padding = padding.OAEP(padding.MGF1(hashes.SHA256()), hashes.SHA256(), None)
-        else:
-            raise KMSInvalidStateException(
-                f"Unsupported padding, requested wrapping algorithm:'{import_state.wrapping_algo}'"
-            )
-
         # TODO check if there was already a key imported for this kms key
         # if so, it has to be identical. We cannot change keys by reimporting after deletion/expiry
-        key_material = import_state.key.crypto_key.key.decrypt(
-            encrypted_key_material, decrypt_padding
-        )
+        key_material = self._decrypt_wrapped_key_material(import_state, encrypted_key_material)
+
         if expiration_model:
             key_to_import_material_to.metadata["ExpirationModel"] = expiration_model
         else:
@@ -1419,9 +1416,7 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
         if key.metadata["KeySpec"] != KeySpec.SYMMETRIC_DEFAULT:
             raise UnsupportedOperationException()
         if key.metadata["Origin"] == OriginType.EXTERNAL:
-            raise UnsupportedOperationException(
-                f"{key.metadata['Arn']} origin is EXTERNAL which is not valid for this operation."
-            )
+            raise NotImplementedError("Rotation of imported keys is not supported yet.")
 
         key.rotate_key_on_demand()
 
@@ -1553,7 +1548,7 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
                 "Member must have length less than or equal to 4096"
             )
 
-    def _validate_grant_request(self, data: Dict):
+    def _validate_grant_request(self, data: dict):
         if "KeyId" not in data or "GranteePrincipal" not in data or "Operations" not in data:
             raise ValidationError("Grant ID, key ID and grantee principal must be specified")
 
@@ -1564,6 +1559,47 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
                     f" constraint: [Member must satisfy enum value set: {VALID_OPERATIONS}]"
                 )
 
+    def _decrypt_wrapped_key_material(
+        self,
+        import_state: KeyImportState,
+        encrypted_key_material: CiphertextType,
+    ) -> bytes:
+        algo = import_state.wrapping_algo
+        decrypt_key = import_state.key.crypto_key.key
+
+        match algo:
+            case AlgorithmSpec.RSAES_PKCS1_V1_5:
+                padding_scheme = padding.PKCS1v15()
+                return decrypt_key.decrypt(encrypted_key_material, padding_scheme)
+            case AlgorithmSpec.RSAES_OAEP_SHA_1:
+                padding_scheme = padding.OAEP(padding.MGF1(hashes.SHA1()), hashes.SHA1(), None)
+                return decrypt_key.decrypt(encrypted_key_material, padding_scheme)
+            case AlgorithmSpec.RSAES_OAEP_SHA_256:
+                padding_scheme = padding.OAEP(padding.MGF1(hashes.SHA256()), hashes.SHA256(), None)
+                return decrypt_key.decrypt(encrypted_key_material, padding_scheme)
+            case AlgorithmSpec.RSA_AES_KEY_WRAP_SHA_256:
+                rsa_key_size_bytes = decrypt_key.key_size // 8
+                wrapped_aes_key = encrypted_key_material[:rsa_key_size_bytes]
+                wrapped_key_material = encrypted_key_material[rsa_key_size_bytes:]
+
+                aes_key = decrypt_key.decrypt(
+                    wrapped_aes_key,
+                    padding.OAEP(
+                        mgf=padding.MGF1(algorithm=hashes.SHA256()),
+                        algorithm=hashes.SHA256(),
+                        label=None,
+                    ),
+                )
+
+                return keywrap.aes_key_unwrap_with_padding(
+                    aes_key, wrapped_key_material, default_backend()
+                )
+
+            case _:
+                raise KMSInvalidStateException(
+                    f"Unsupported padding, requested wrapping algorithm: '{algo}'"
+                )
+
     def _validate_plaintext_key_type_based(
         self,
         plaintext: PlaintextType,

localstack/services/kms/resource_providers/aws_kms_alias.py

@@ -2,7 +2,7 @@
 from __future__ import annotations
 
 from pathlib import Path
-from typing import Optional, TypedDict
+from typing import TypedDict
 
 import localstack.services.cloudformation.provider_utils as util
 from localstack.services.cloudformation.resource_provider import (
@@ -14,8 +14,8 @@ from localstack.services.cloudformation.resource_provider import (
 
 
 class KMSAliasProperties(TypedDict):
-    AliasName: Optional[str]
-    TargetKeyId: Optional[str]
+    AliasName: str | None
+    TargetKeyId: str | None
 
 
 REPEATED_INVOCATION = "repeated_invocation"

localstack/services/kms/resource_providers/aws_kms_alias_plugin.py

@@ -1,5 +1,3 @@
-from typing import Optional, Type
-
 from localstack.services.cloudformation.resource_provider import (
     CloudFormationResourceProviderPlugin,
     ResourceProvider,
@@ -10,7 +8,7 @@ class KMSAliasProviderPlugin(CloudFormationResourceProviderPlugin):
     name = "AWS::KMS::Alias"
 
     def __init__(self):
-        self.factory: Optional[Type[ResourceProvider]] = None
+        self.factory: type[ResourceProvider] | None = None
 
     def load(self):
         from localstack.services.kms.resource_providers.aws_kms_alias import KMSAliasProvider

localstack/services/kms/resource_providers/aws_kms_key.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 
 import json
 from pathlib import Path
-from typing import Optional, TypedDict
+from typing import TypedDict
 
 import localstack.services.cloudformation.provider_utils as util
 from localstack.services.cloudformation.resource_provider import (
@@ -15,22 +15,22 @@ from localstack.services.cloudformation.resource_provider import (
 
 
 class KMSKeyProperties(TypedDict):
-    KeyPolicy: Optional[dict | str]
-    Arn: Optional[str]
-    Description: Optional[str]
-    EnableKeyRotation: Optional[bool]
-    Enabled: Optional[bool]
-    KeyId: Optional[str]
-    KeySpec: Optional[str]
-    KeyUsage: Optional[str]
-    MultiRegion: Optional[bool]
-    PendingWindowInDays: Optional[int]
-    Tags: Optional[list[Tag]]
+    KeyPolicy: dict | str | None
+    Arn: str | None
+    Description: str | None
+    EnableKeyRotation: bool | None
+    Enabled: bool | None
+    KeyId: str | None
+    KeySpec: str | None
+    KeyUsage: str | None
+    MultiRegion: bool | None
+    PendingWindowInDays: int | None
+    Tags: list[Tag] | None
 
 
 class Tag(TypedDict):
-    Key: Optional[str]
-    Value: Optional[str]
+    Key: str | None
+    Value: str | None
 
 
 REPEATED_INVOCATION = "repeated_invocation"

localstack/services/kms/resource_providers/aws_kms_key_plugin.py

@@ -1,5 +1,3 @@
-from typing import Optional, Type
-
 from localstack.services.cloudformation.resource_provider import (
     CloudFormationResourceProviderPlugin,
     ResourceProvider,
@@ -10,7 +8,7 @@ class KMSKeyProviderPlugin(CloudFormationResourceProviderPlugin):
     name = "AWS::KMS::Key"
 
     def __init__(self):
-        self.factory: Optional[Type[ResourceProvider]] = None
+        self.factory: type[ResourceProvider] | None = None
 
     def load(self):
         from localstack.services.kms.resource_providers.aws_kms_key import KMSKeyProvider

localstack/services/kms/utils.py

@@ -1,5 +1,6 @@
 import re
-from typing import Callable, Tuple, TypeVar
+from collections.abc import Callable
+from typing import TypeVar
 
 from localstack.aws.api.kms import DryRunOperationException, Tag, TagException
 from localstack.services.kms.exceptions import ValidationException
@@ -8,7 +9,7 @@ from localstack.utils.aws.arns import ARN_PARTITION_REGEX
 T = TypeVar("T")
 
 KMS_KEY_ARN_PATTERN = re.compile(
-    rf"{ARN_PARTITION_REGEX}:kms:(?P<region_name>[^:]+):(?P<account_id>\d{{12}}):key\/(?P<key_id>[^:]+)$"
+    rf"{ARN_PARTITION_REGEX}:kms:(?P<region_name>[^:]+):(?P<account_id>\d{{12}}):((?=key/)key/|(?=alias/))(?P<key_id>[^:]+)$"
 )
 
 
@@ -20,7 +21,7 @@ def get_hash_algorithm(signing_algorithm: str) -> str:
     return "_".join(signing_algorithm.rsplit(sep="_", maxsplit=-2)[-2:])
 
 
-def parse_key_arn(key_arn: str) -> Tuple[str, str, str]:
+def parse_key_arn(key_arn: str) -> tuple[str, str, str]:
     """
     Parse a valid KMS key arn into its constituents.
 

localstack/services/lambda_/api_utils.py

@@ -6,8 +6,9 @@ import datetime
 import random
 import re
 import string
-from typing import TYPE_CHECKING, Any, Optional, Tuple
+from typing import TYPE_CHECKING, Any
 
+from localstack import config
 from localstack.aws.api import CommonServiceException, RequestContext
 from localstack.aws.api import lambda_ as api_spec
 from localstack.aws.api.lambda_ import (
@@ -192,7 +193,7 @@ def map_csc(model: "CodeSigningConfig") -> api_spec.CodeSigningConfig:
     )
 
 
-def get_config_for_url(store: "LambdaStore", url_id: str) -> "Optional[FunctionUrlConfig]":
+def get_config_for_url(store: "LambdaStore", url_id: str) -> "FunctionUrlConfig | None":
     """
     Get a config object when resolving a URL
 
@@ -269,7 +270,7 @@ def function_locators_from_arn(arn: str) -> tuple[str | None, str | None, str |
     return None, None, None, None
 
 
-def get_account_and_region(function_arn_or_name: str, context: RequestContext) -> Tuple[str, str]:
+def get_account_and_region(function_arn_or_name: str, context: RequestContext) -> tuple[str, str]:
     """
     Takes a full ARN, partial ARN or a name. Returns account ID and region from ARN if available, else
     falls back to context account ID and region.
@@ -345,11 +346,11 @@ def build_statement(
     statement_id: str,
     action: str,
     principal: str,
-    source_arn: Optional[str] = None,
-    source_account: Optional[str] = None,
-    principal_org_id: Optional[str] = None,
-    event_source_token: Optional[str] = None,
-    auth_type: Optional[FunctionUrlAuthType] = None,
+    source_arn: str | None = None,
+    source_account: str | None = None,
+    principal_org_id: str | None = None,
+    event_source_token: str | None = None,
+    auth_type: FunctionUrlAuthType | None = None,
 ) -> dict[str, Any]:
     statement = {
         "Sid": statement_id,
@@ -377,7 +378,7 @@ def build_statement(
             Type="User",
         )
 
-    condition = dict()
+    condition = {}
     if auth_type:
         update = {"StringEquals": {"lambda:FunctionUrlAuthType": auth_type}}
         condition = merge_recursive(condition, update)
@@ -425,7 +426,7 @@ def unqualified_lambda_arn(function_name: str, account: str, region: str):
 
 
 def qualified_lambda_arn(
-    function_name: str, qualifier: Optional[str], account: str, region: str
+    function_name: str, qualifier: str | None, account: str, region: str
 ) -> str:
     """
     Generate a qualified lambda arn
@@ -440,7 +441,7 @@ def qualified_lambda_arn(
     return f"{unqualified_lambda_arn(function_name=function_name, account=account, region=region)}:{qualifier}"
 
 
-def lambda_arn(function_name: str, qualifier: Optional[str], account: str, region: str) -> str:
+def lambda_arn(function_name: str, qualifier: str | None, account: str, region: str) -> str:
     """
     Return the lambda arn for the given parameters, with a qualifier if supplied, without otherwise
 
@@ -637,7 +638,7 @@ def map_alias_out(alias: "VersionAlias", function: "Function") -> AliasConfigura
     )
 
 
-def validate_and_set_batch_size(service: str, batch_size: Optional[int] = None) -> int:
+def validate_and_set_batch_size(service: str, batch_size: int | None = None) -> int:
     min_batch_size = 1
 
     BATCH_SIZE_RANGES = {
@@ -665,7 +666,9 @@ def validate_and_set_batch_size(service: str, batch_size: Optional[int] = None)
 def map_layer_out(layer_version: "LayerVersion") -> PublishLayerVersionResponse:
     return PublishLayerVersionResponse(
         Content=LayerVersionContentOutput(
-            Location=layer_version.code.generate_presigned_url(),
+            Location=layer_version.code.generate_presigned_url(
+                endpoint_url=config.external_service_url()
+            ),
             CodeSha256=layer_version.code.code_sha256,
             CodeSize=layer_version.code.code_size,
             # SigningProfileVersionArn="", # same as in function configuration
@@ -690,7 +693,7 @@ def layer_version_arn(layer_name: str, account: str, region: str, version: str):
     return f"arn:{get_partition(region)}:lambda:{region}:{account}:layer:{layer_name}:{version}"
 
 
-def parse_layer_arn(layer_version_arn: str) -> Tuple[str, str, str, str]:
+def parse_layer_arn(layer_version_arn: str) -> tuple[str, str, str, str]:
     return LAYER_VERSION_ARN_PATTERN.match(layer_version_arn).group(
         "region_name", "account_id", "layer_name", "layer_version"
     )
@@ -715,12 +718,12 @@ def validate_layer_runtimes_and_architectures(
 
     if compatible_runtimes and set(compatible_runtimes).difference(ALL_RUNTIMES):
         constraint = f"Member must satisfy enum value set: {VALID_RUNTIMES}"
-        validation_msg = f"Value '[{', '.join([s for s in compatible_runtimes])}]' at 'compatibleRuntimes' failed to satisfy constraint: {constraint}"
+        validation_msg = f"Value '[{', '.join(list(compatible_runtimes))}]' at 'compatibleRuntimes' failed to satisfy constraint: {constraint}"
         validations.append(validation_msg)
 
     if compatible_architectures and set(compatible_architectures).difference(ARCHITECTURES):
         constraint = "[Member must satisfy enum value set: [x86_64, arm64]]"
-        validation_msg = f"Value '[{', '.join([s for s in compatible_architectures])}]' at 'compatibleArchitectures' failed to satisfy constraint: Member must satisfy constraint: {constraint}"
+        validation_msg = f"Value '[{', '.join(list(compatible_architectures))}]' at 'compatibleArchitectures' failed to satisfy constraint: Member must satisfy constraint: {constraint}"
         validations.append(validation_msg)
 
     return validations

localstack/services/lambda_/custom_endpoints.py

@@ -1,5 +1,5 @@
 import urllib.parse
-from typing import List, TypedDict
+from typing import TypedDict
 
 from rolo import Request, route
 
@@ -14,7 +14,7 @@ from localstack.services.lambda_.runtimes import (
 
 
 class LambdaRuntimesResponse(TypedDict, total=False):
-    Runtimes: List[Runtime]
+    Runtimes: list[Runtime]
 
 
 class LambdaCustomEndpoints:

localstack/services/lambda_/event_source_mapping/esm_worker_factory.py

@@ -1,4 +1,4 @@
-from typing import Callable
+from collections.abc import Callable
 
 import botocore.config
 
@@ -18,6 +18,7 @@ from localstack.aws.api.pipes import (
     PipeTargetParameters,
 )
 from localstack.services.lambda_ import hooks as lambda_hooks
+from localstack.services.lambda_ import ldm
 from localstack.services.lambda_.event_source_mapping.esm_event_processor import (
     EsmEventProcessor,
 )
@@ -37,10 +38,6 @@ from localstack.services.lambda_.event_source_mapping.pollers.sqs_poller import
     SqsPoller,
 )
 from localstack.services.lambda_.event_source_mapping.senders.lambda_sender import LambdaSender
-from localstack.services.lambda_.lambda_debug_mode.ldm import (
-    DEFAULT_LAMBDA_DEBUG_MODE_TIMEOUT_SECONDS,
-    LDM,
-)
 from localstack.utils.aws.arns import parse_arn
 from localstack.utils.aws.client_types import ServicePrincipal
 
@@ -65,8 +62,8 @@ class EsmWorkerFactory:
         # Sender (always Lambda)
         function_arn = self.esm_config["FunctionArn"]
 
-        if LDM.is_enabled():
-            timeout_seconds = DEFAULT_LAMBDA_DEBUG_MODE_TIMEOUT_SECONDS
+        if ldm.IS_LDM_ENABLED:
+            timeout_seconds = ldm.DEFAULT_LDM_TIMEOUT_SECONDS
         else:
             # 900s is the maximum amount of time a Lambda can run for.
             lambda_max_timeout_seconds = 900

localstack/services/lambda_/event_source_mapping/pipe_utils.py

@@ -1,5 +1,5 @@
 import json
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
 import botocore
 from botocore.client import BaseClient
@@ -57,7 +57,7 @@ def get_standardized_service_name(service_name: str) -> str:
 
 
 def get_current_time() -> datetime:
-    return datetime.now(tz=timezone.utc)
+    return datetime.now(tz=UTC)
 
 
 def get_datetime_from_timestamp(timestamp: float) -> datetime:

localstack/services/lambda_/event_source_mapping/pollers/stream_poller.py

@@ -4,8 +4,8 @@ import threading
 from abc import abstractmethod
 from bisect import bisect_left
 from collections import defaultdict
+from collections.abc import Iterator
 from datetime import datetime
-from typing import Iterator
 
 from botocore.client import BaseClient
 from botocore.exceptions import ClientError

localstack/services/lambda_/event_source_mapping/senders/sender_utils.py

@@ -1,6 +1,7 @@
 import sys
+from collections.abc import Iterable, Iterator
 from itertools import islice
-from typing import Any, Iterable, Iterator
+from typing import Any
 
 
 def batched(iterable, n):

localstack/services/lambda_/hooks.py

@@ -2,19 +2,24 @@
 
 from localstack.runtime.hooks import hook_spec
 
+HOOKS_LAMBDA_CREATE_FUNCTION_VERSION = "localstack.hooks.lambda_create_function_version"
+HOOKS_LAMBDA_DELETE_FUNCTION_VERSION = "localstack.hooks.lambda_delete_function_version"
 HOOKS_LAMBDA_START_DOCKER_EXECUTOR = "localstack.hooks.lambda_start_docker_executor"
 HOOKS_LAMBDA_PREPARE_DOCKER_EXECUTOR = "localstack.hooks.lambda_prepare_docker_executors"
 HOOKS_LAMBDA_INJECT_LAYER_FETCHER = "localstack.hooks.lambda_inject_layer_fetcher"
+HOOKS_LAMBDA_INJECT_LDM_PROVISIONER = "localstack.hooks.lambda_inject_ldm_provisioner"
 HOOKS_LAMBDA_PREBUILD_ENVIRONMENT_IMAGE = "localstack.hooks.lambda_prebuild_environment_image"
 HOOKS_LAMBDA_CREATE_EVENT_SOURCE_POLLER = "localstack.hooks.lambda_create_event_source_poller"
 HOOKS_LAMBDA_SET_EVENT_SOURCE_CONFIG_DEFAULTS = (
     "localstack.hooks.lambda_set_event_source_config_defaults"
 )
 
-
+create_function_version = hook_spec(HOOKS_LAMBDA_CREATE_FUNCTION_VERSION)
+delete_function_version = hook_spec(HOOKS_LAMBDA_DELETE_FUNCTION_VERSION)
 start_docker_executor = hook_spec(HOOKS_LAMBDA_START_DOCKER_EXECUTOR)
 prepare_docker_executor = hook_spec(HOOKS_LAMBDA_PREPARE_DOCKER_EXECUTOR)
 inject_layer_fetcher = hook_spec(HOOKS_LAMBDA_INJECT_LAYER_FETCHER)
+inject_ldm_provisioner = hook_spec(HOOKS_LAMBDA_INJECT_LDM_PROVISIONER)
 prebuild_environment_image = hook_spec(HOOKS_LAMBDA_PREBUILD_ENVIRONMENT_IMAGE)
 create_event_source_poller = hook_spec(HOOKS_LAMBDA_CREATE_EVENT_SOURCE_POLLER)
 set_event_source_config_defaults = hook_spec(HOOKS_LAMBDA_SET_EVENT_SOURCE_CONFIG_DEFAULTS)

localstack/services/lambda_/invocation/assignment.py

@@ -2,7 +2,6 @@ import contextlib
 import logging
 from collections import defaultdict
 from concurrent.futures import Future, ThreadPoolExecutor
-from typing import ContextManager
 
 from localstack.services.lambda_.invocation.execution_environment import (
     EnvironmentStartupTimeoutException,
@@ -44,7 +43,7 @@ class AssignmentService(OtherServiceEndpoint):
         version_manager_id: str,
         function_version: FunctionVersion,
         provisioning_type: InitializationType,
-    ) -> ContextManager[ExecutionEnvironment]:
+    ) -> contextlib.AbstractContextManager[ExecutionEnvironment]:
         applicable_envs = (
             env
             for env in self.environments[version_manager_id].values()