binxio/cfn-secret-provider

When using latest code and Python 3.8 the cloudformation failed with "No module named '_cffi_backend'"

Closed this issue · 11 comments

arkrud commented

I was using version 1.0.0 for a while with no issues.
We need to upgrade runtime to Python 3.8 due to AWS retiring support for 3.6
When using 1.4.0 and Python 3.8 we getting error in cloud formation while creating PrivateKey:
"Received response status [FAILED] from custom resource. Message returned: No module named '_cffi_backend'"

mvanholsteijn commented

Sorry about that. This is fixed in 1.4.3.

arkrud commented

Thank You for fast response but I still see the same error while creating KeyPair with v1.4.3 and Python 3.8
Received response status [FAILED] from custom resource. Message returned: No module named '_cffi_backend'

In provider Lambda logs I can see a couple of the messages below:

/var/task/jmespath/visitor.py:32: SyntaxWarning: "is" with a literal. Did you mean "=="?
And ERROR:

[ERROR] 2021-07-01T23:31:54.702Z 90bbcb98-f586-4d32-a216-98ad50b65590 exception occurred processing the request
Traceback (most recent call last):
File "/var/task/cfn_resource_provider/resource_provider.py", line 331, in handle
self.execute()
File "/var/task/cfn_resource_provider/resource_provider.py", line 312, in execute
self.create()
File "/var/task/cfn_rsakey_provider.py", line 146, in create
self.create_or_update_secret(overwrite=False, new_secret=True)
File "/var/task/cfn_rsakey_provider.py", line 117, in create_or_update_secret
private_key, public_key = self.create_key()
File "/var/task/cfn_rsakey_provider.py", line 88, in create_key
backend=crypto_default_backend(),
File "/var/task/cryptography/hazmat/backends/init.py", line 15, in default_backend
from cryptography.hazmat.backends.openssl.backend import backend
File "/var/task/cryptography/hazmat/backends/openssl/init.py", line 7, in
from cryptography.hazmat.backends.openssl.backend import backend
File "/var/task/cryptography/hazmat/backends/openssl/backend.py", line 18, in
from cryptography import utils, x509
File "/var/task/cryptography/x509/init.py", line 8, in
from cryptography.x509.base import (
File "/var/task/cryptography/x509/base.py", line 16, in
from cryptography.x509.extensions import Extension, ExtensionType
File "/var/task/cryptography/x509/extensions.py", line 18, in
from cryptography.hazmat.primitives import constant_time, serialization
File "/var/task/cryptography/hazmat/primitives/constant_time.py", line 11, in
from cryptography.hazmat.bindings._constant_time import lib
ModuleNotFoundError: No module named '_cffi_backend'

mvanholsteijn commented

Hi @arkrud,

I tested the deployment of the 1.4.3 provider and demo and they worked as expected. Another user who had the same error as you, successfully used version 1.4.3 too (see #51).

Did you update the runtime too? What region are you deploying in?

Cheers,

Mark

arkrud commented
mvanholsteijn commented

@arkrud, the attachments do not make it into this thread. Can you attach them here?

arkrud commented
arkrud commented
mvanholsteijn commented

@arkrud, I have tested the 1.4.3 provider with the python3.8 lambda runtime and it works. If you want me to take a look at your template, please add it as an attachment on the github website. email attachments do not make here.

mvanholsteijn commented

Your problem is caused by the fact that only the default value is changed, which is not effectuated on a stack update.

Change:

      Code:
        S3Bucket: !Sub '${S3BucketPrefix}-${AWS::Region}'
        S3Key: !Ref 'CFNCustomProviderZipFileName'

to:

      Code:
        S3Bucket: !Sub '${S3BucketPrefix}-${AWS::Region}'
        S3Key: 'lambdas/cfn-secret-provider-1.4.3.zip'

and you will probably be fine.

arkrud commented

Thank You very much. This worked.
Was picking up old code.
We had same issues with our lambdas CF build also and solved it by placing each new build code into versioned sub-folder in the bucket.