Dispatch Failure for Rust lambda deployments

[DoIevenLift]

Describe the bug

When trying to run cargo lambda deploy <function_name> --profile <profile_name> via the cli it will return this error:

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

The command should create a lambda function if it doesn't already exist else update the function.

Current Behavior

It appears that the lambda console is not validating a certificate which causes the failure.

Reproduction Steps

• install cargo lambda from scoop using cargo lambda commands - https://www.cargo-lambda.info/guide/getting-started.html
• install aws cli tool using installer - https://docs.aws.amazon.com/cli/latest/userguide/getting-started-version.html
• cargo lambda build --release
• cargo lambda deploy <function_name> --profile <profile_name>

Possible Solution

No response

Additional Information/Context

This may not be the specific place to create this issue and my apologies if it is not. Happy to recreate elsewhere if pointed in the right direction. This issue only started to appear for me in the last few days and previously ran without issue.

I've tried the command on 2 machines and both are encountering this issue. Both machines are windows.

I've also done a complete wipe and fresh windows install one of the machines and continue to get the certification issue. On the fresh install the only things installed were Cargo Lambda, Zig, Rust, Visual Studio (reqs for Rust) and VSC.

According to - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/index.html the Lambda console requires any of the certs. I've confirmed that on both machines one or more of the certificates exist.

I've also ran commands with the AWS CLI such as list-functions, get-function, delete-function etc and these are all working which from my understanding that if this was a cert issue, these should fail also.

Have created a discussion in Cargo Lambda - cargo-lambda/cargo-lambda#701 & there is an old issue here - #468 (comment) which kind of looks to be running into the same issue however the above issue is related to code specifically within the iotdataplane rather than within the system.

I've also reset the aws sso configuration both manually via removing the variables and via the aws cli command. I also did some of the things here - https://repost.aws/questions/QU-GGT0F5DQlCxSPsPIxUHHA/dispatch-failure

Version

I am unsure if this is correct but the aws-sdk is inherited from Cargo Lambda not directly used - apologies if this is not the case. 

cargo tree | grep aws- did not work for me

Environment details (OS name and version, etc.)

Windows 11 Home version: 10.0.22631 Build 22631

Logs

using -v on the Cargo Lambda command gives:

[ysaito1001]

Hi thank you for reporting this. I have two clarifying questions.

• Is the observed failure still reproducible even without using lambda at all? If so, it's more likely that the issue is specific to the Rust SDK, rather than the lambda runtime.
• Do you use aws-lambda-rust-runtime? The issue might be better assisted if you file it there.

[DoIevenLift]

Hi @ysaito1001,

Ah to be honest I haven't used anything other than lambda at the moment. Not getting any of the cert issues doing standard AWS cli commands so not sure this is replicating without using lambda.

RE the lambda runtimes - yep these are used. I'll create an issue there as well.

[DoIevenLift]

I have found the solution to this. Feel free to close the comment whenever is suitable.

For whatever reason in this case, if the AWS CLI command is used the certificate will validate. When using the Cargo Lambda commands, the certificate used would not validate and return the error.

Downloading any of the Amazon CA certs from - https://www.amazontrust.com/repository/ and importing this via the Windows wizard into the Trusted Root CA then generates the CA twice - its like it unhides / marks as trusted the original CA that existed. This solves the issue and allows the Lambda console and approves the request.

While this is a workaround it doesn't 'explain' how / why the Cargo Lambda commands are not validating the existing certificate like the AWS CLI commands are.

This may also be unrelated to Cargo Lambda and could be some magic that Windows did with an update which either untrusted an Amazon CA or something but there 'aren't' any other issues / discussions seen in these channels so far and debugging further here is way above my skill set.

Appreciate the help!

Thanks

[ysaito1001]

Glad that you have found the solution, and thank you for sharing what you found!

[github-actions]

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.