Update from upstream - 2026-03-27

lambda-tooling+rie · lambda-tooling+rie · commit 17dc38a6fd43 · 2026-03-27T18:24:12.000Z
diff --git a/.github/workflows/validate-branch-into-main.yaml b/.github/workflows/validate-branch-into-main.yaml
@@ -1,8 +1,5 @@
 name: Validate PR Branch into Main 
 
-permissions:
-  contents: read
-
 on:
   pull_request:
     branches:
diff --git a/internal/lambda/rapi/rapi_fuzz_test.go b/internal/lambda/rapi/rapi_fuzz_test.go
@@ -21,6 +21,8 @@ import (
 	"unicode"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lmds"
+
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/appctx"
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/extensions"
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/fatalerror"
@@ -187,6 +189,7 @@ func FuzzRestoreErrorHandler(f *testing.F) {
 }
 
 func makeRapiServer(flowTest *testdata.FlowTest) *Server {
+	metadataService := lmds.NewService("test-token")
 	return NewServer(
 		"127.0.0.1",
 		0,
@@ -197,6 +200,7 @@ func makeRapiServer(flowTest *testdata.FlowTest) *Server {
 		&telemetry.NoOpSubscriptionAPI{},
 		flowTest.TelemetrySubscription,
 		flowTest.CredentialsService,
+		metadataService,
 	)
 }
 
diff --git a/internal/lambda/rapi/server.go b/internal/lambda/rapi/server.go
@@ -10,14 +10,14 @@ import (
 	"net/http"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/appctx"
+	log "github.com/sirupsen/logrus"
+	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lmds"
 
+	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/appctx"
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/core"
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/interop"
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/rapi/rendering"
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/telemetry"
-
-	log "github.com/sirupsen/logrus"
 )
 
 const version20180601 = "/2018-06-01"
@@ -56,6 +56,7 @@ func NewServer(
 	logsSubscriptionAPI telemetry.SubscriptionAPI,
 	telemetrySubscriptionAPI telemetry.SubscriptionAPI,
 	credentialsService core.CredentialsService,
+	metadataService *lmds.Service,
 ) *Server {
 
 	exitErrors := make(chan error, 1)
@@ -76,6 +77,8 @@ func NewServer(
 		router.Mount(version20210423, CredentialsAPIRouter(credentialsService))
 	}
 
+	router.Mount(lmds.URIPath, http.MaxBytesHandler(metadataService, 0))
+
 	return &Server{
 		host:     host,
 		port:     port,
diff --git a/internal/lambda/rapi/telemetry_logs_fuzz_test.go b/internal/lambda/rapi/telemetry_logs_fuzz_test.go
@@ -13,6 +13,8 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
+	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lmds"
+
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/extensions"
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/interop"
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/rapi/handler"
@@ -133,6 +135,7 @@ func makeRapiServerWithMockSubscriptionAPI(
 		logsSubscription,
 		telemetrySubscription,
 		flowTest.CredentialsService,
+		lmds.NewService("test-token"),
 	)
 }
 
diff --git a/internal/lambda/rapid/handlers_test.go b/internal/lambda/rapid/handlers_test.go
@@ -17,6 +17,10 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lmds"
+
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/appctx"
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/core"
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/fatalerror"
@@ -28,9 +32,6 @@ import (
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/supervisor/model"
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/telemetry"
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/testdata"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
 )
 
 func BenchmarkChannelsSelect10(b *testing.B) {
@@ -139,7 +140,8 @@ func TestListen(t *testing.T) {
 
 	ctx := context.Background()
 	telemetryAPIEnabled := true
-	server := rapi.NewServer("127.0.0.1", 0, flowTest.AppCtx, flowTest.RegistrationService, flowTest.RenderingService, telemetryAPIEnabled, flowTest.TelemetrySubscription, flowTest.TelemetrySubscription, flowTest.CredentialsService)
+	metadataService := lmds.NewService("test-token")
+	server := rapi.NewServer("127.0.0.1", 0, flowTest.AppCtx, flowTest.RegistrationService, flowTest.RenderingService, telemetryAPIEnabled, flowTest.TelemetrySubscription, flowTest.TelemetrySubscription, flowTest.CredentialsService, metadataService)
 	err := server.Listen()
 	assert.NoError(t, err)
 
diff --git a/internal/lambda/rapid/sandbox.go b/internal/lambda/rapid/sandbox.go
@@ -9,6 +9,10 @@ import (
 	"fmt"
 	"io"
 	"sync"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lmds"
 
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/appctx"
 	"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/core"
@@ -52,7 +56,7 @@ type Sandbox struct {
 //
 // - Contexts & Data:
 //   - ctx is used to gracefully terminate Runtime API HTTP Server on exit
-func Start(ctx context.Context, s *Sandbox) (interop.RapidContext, interop.InternalStateGetter, string) {
+func Start(ctx context.Context, s *Sandbox) (interop.RapidContext, interop.InternalStateGetter, string, string) {
 	// Initialize internal state objects required by Rapid handlers
 	appCtx := appctx.NewApplicationContext()
 	initFlow := core.NewInitFlowSynchronization()
@@ -63,7 +67,18 @@ func Start(ctx context.Context, s *Sandbox) (interop.RapidContext, interop.Inter
 
 	appctx.StoreInitType(appCtx, s.InitCachingEnabled)
 
-	server := rapi.NewServer(s.RuntimeAPIHost, s.RuntimeAPIPort, appCtx, registrationService, renderingService, s.EnableTelemetryAPI, s.LogsSubscriptionAPI, s.TelemetrySubscriptionAPI, credentialsService)
+	// Create metadata service with hardcoded AZ ID for RIE
+	metadataToken := uuid.NewString()
+	metadataService := lmds.NewService(metadataToken)
+
+	// Set hardcoded metadata for RIE (use1-az1 per design)
+	metadataConfig := lmds.MetadataConfig{
+		Data:   []byte(`{"AvailabilityZoneID":"use1-az1"}`),
+		MaxAge: 12 * time.Hour,
+	}
+	metadataService.UpdateMetadata(metadataConfig)
+
+	server := rapi.NewServer(s.RuntimeAPIHost, s.RuntimeAPIPort, appCtx, registrationService, renderingService, s.EnableTelemetryAPI, s.LogsSubscriptionAPI, s.TelemetrySubscriptionAPI, credentialsService, metadataService)
 	runtimeAPIAddr := fmt.Sprintf("%s:%d", server.Host(), server.Port())
 
 	// TODO: pass this directly down to HTTP servers and handlers, instead of using
@@ -105,7 +120,7 @@ func Start(ctx context.Context, s *Sandbox) (interop.RapidContext, interop.Inter
 
 	go startRuntimeAPI(ctx, execCtx)
 
-	return execCtx, registrationService.GetInternalStateDescriptor(appCtx), runtimeAPIAddr
+	return execCtx, registrationService.GetInternalStateDescriptor(appCtx), runtimeAPIAddr, metadataToken
 }
 
 func (r *rapidContext) HandleInit(init *interop.Init, initSuccessResponseChan chan<- interop.InitSuccess, initFailureResponseChan chan<- interop.InitFailure) {
diff --git a/internal/lambda/rapidcore/env/constants.go b/internal/lambda/rapidcore/env/constants.go
@@ -27,6 +27,8 @@ func predefinedPlatformEnvVarKeys() map[string]bool {
 		"AWS_LAMBDA_FUNCTION_MEMORY_SIZE": true,
 		"AWS_LAMBDA_FUNCTION_VERSION":     true,
 		"AWS_LAMBDA_RUNTIME_API":          true,
+		"AWS_LAMBDA_METADATA_API":         true,
+		"AWS_LAMBDA_METADATA_TOKEN":       true,
 		"TZ":                              true,
 	}
 }
diff --git a/internal/lambda/rapidcore/env/environment.go b/internal/lambda/rapidcore/env/environment.go
@@ -66,6 +66,12 @@ func (e *Environment) StoreRuntimeAPIEnvironmentVariable(runtimeAPIAddress strin
 	e.runtimeAPISet = true
 }
 
+// StoreMetadataAPIEnvironmentVariables stores values for AWS_LAMBDA_METADATA_API and AWS_LAMBDA_METADATA_TOKEN
+func (e *Environment) StoreMetadataAPIEnvironmentVariables(metadataAPIAddress, metadataToken string) {
+	e.platform["AWS_LAMBDA_METADATA_API"] = metadataAPIAddress
+	e.platform["AWS_LAMBDA_METADATA_TOKEN"] = metadataToken
+}
+
 // SetHandler sets _HANDLER env variable value for Runtime
 func (e *Environment) SetHandler(handler string) {
 	e.runtime[handlerEnvKey] = handler
diff --git a/internal/lambda/rapidcore/sandbox_api.go b/internal/lambda/rapidcore/sandbox_api.go
@@ -17,6 +17,7 @@ type SandboxContext struct {
 	rapidCtx          interop.RapidContext
 	handler           string
 	runtimeAPIAddress string
+	metadataToken     string
 }
 
 // initContext and its methods model the initialization lifecycle
@@ -55,6 +56,8 @@ func (s SandboxContext) Init(init *interop.Init, timeoutMs int64) interop.InitCo
 	}
 
 	init.EnvironmentVariables.StoreRuntimeAPIEnvironmentVariable(s.runtimeAPIAddress)
+	// Metadata API uses the same address as Runtime API
+	init.EnvironmentVariables.StoreMetadataAPIEnvironmentVariables(s.runtimeAPIAddress, s.metadataToken)
 	extensions.DisableViaMagicLayer()
 
 	// We start initialization handling in a separate goroutine so that control can be returned back to
diff --git a/internal/lambda/rapidcore/sandbox_builder.go b/internal/lambda/rapidcore/sandbox_builder.go
@@ -172,12 +172,13 @@ func (b *SandboxBuilder) Create() (interop.SandboxContext, interop.InternalState
 
 	// rapid.Start, among other things, starts the Runtime API server and
 	// terminates it gracefully if the cxt is canceled
-	rapidCtx, internalStateFn, runtimeAPIAddr := rapid.Start(ctx, b.sandbox)
+	rapidCtx, internalStateFn, runtimeAPIAddr, metadataToken := rapid.Start(ctx, b.sandbox)
 
 	b.sandboxContext = &SandboxContext{
 		rapidCtx:          rapidCtx,
 		handler:           b.handler,
 		runtimeAPIAddress: runtimeAPIAddr,
+		metadataToken:     metadataToken,
 	}
 
 	return b.sandboxContext, internalStateFn
diff --git a/internal/lambda/rapidcore/server_test.go b/internal/lambda/rapidcore/server_test.go
@@ -87,7 +87,7 @@ func TestReserveDoesNotDeadlockWhenCalledMultipleTimes(t *testing.T) {
 		initHandler,
 		func() (interop.InvokeSuccess, *interop.InvokeFailure) { return interop.InvokeSuccess{}, nil },
 		func() (interop.ResetSuccess, *interop.ResetFailure) { return interop.ResetSuccess{}, nil },
-	}, "handler", "runtimeAPIhost:999"})
+	}, "handler", "runtimeAPIhost:999", "test-token"})
 
 	srv.Init(&interop.Init{EnvironmentVariables: env.NewEnvironment()}, int64(1*time.Second*time.Millisecond))
 
@@ -124,7 +124,7 @@ func TestInitSuccess(t *testing.T) {
 		initHandler,
 		func() (interop.InvokeSuccess, *interop.InvokeFailure) { return interop.InvokeSuccess{}, nil },
 		func() (interop.ResetSuccess, *interop.ResetFailure) { return interop.ResetSuccess{}, nil },
-	}, "handler", "runtimeAPIhost:999"})
+	}, "handler", "runtimeAPIhost:999", "test-token"})
 
 	srv.Init(&interop.Init{EnvironmentVariables: env.NewEnvironment()}, int64(1*time.Second*time.Millisecond))
 	require.Equal(t, phaseInitializing, srv.getRapidPhase())
@@ -148,7 +148,7 @@ func TestInitErrorBeforeReserve(t *testing.T) {
 		initHandler,
 		func() (interop.InvokeSuccess, *interop.InvokeFailure) { return interop.InvokeSuccess{}, nil },
 		func() (interop.ResetSuccess, *interop.ResetFailure) { return interop.ResetSuccess{}, nil },
-	}, "handler", "runtimeAPIhost:999"})
+	}, "handler", "runtimeAPIhost:999", "test-token"})
 
 	srv.Init(&interop.Init{EnvironmentVariables: env.NewEnvironment()}, int64(1*time.Second*time.Millisecond))
 
@@ -180,7 +180,7 @@ func TestInitErrorDuringReserve(t *testing.T) {
 		initHandler,
 		func() (interop.InvokeSuccess, *interop.InvokeFailure) { return interop.InvokeSuccess{}, nil },
 		func() (interop.ResetSuccess, *interop.ResetFailure) { return interop.ResetSuccess{}, nil },
-	}, "handler", "runtimeAPIhost:999"})
+	}, "handler", "runtimeAPIhost:999", "test-token"})
 
 	srv.Init(&interop.Init{EnvironmentVariables: env.NewEnvironment()}, int64(1*time.Second*time.Millisecond))
 	resp, err := srv.Reserve("", "", "")
@@ -213,7 +213,7 @@ func TestInvokeSuccess(t *testing.T) {
 	}
 
 	resetHandler := func() (interop.ResetSuccess, *interop.ResetFailure) { return interop.ResetSuccess{}, nil }
-	srv.SetSandboxContext(&SandboxContext{&mockRapidCtx{initHandler, invokeHandler, resetHandler}, "handler", "runtimeAPIhost:999"})
+	srv.SetSandboxContext(&SandboxContext{&mockRapidCtx{initHandler, invokeHandler, resetHandler}, "handler", "runtimeAPIhost:999", "test-token"})
 
 	srv.Init(&interop.Init{EnvironmentVariables: env.NewEnvironment()}, int64(1*time.Second*time.Millisecond))
 	require.Equal(t, phaseInitializing, srv.getRapidPhase())
@@ -256,7 +256,7 @@ func TestInvokeError(t *testing.T) {
 		return interop.ResetSuccess{}, nil
 	}
 
-	srv.SetSandboxContext(&SandboxContext{&mockRapidCtx{initHandler, invokeHandler, resetHandler}, "handler", "runtimeAPIhost:999"})
+	srv.SetSandboxContext(&SandboxContext{&mockRapidCtx{initHandler, invokeHandler, resetHandler}, "handler", "runtimeAPIhost:999", "test-token"})
 
 	srv.Init(&interop.Init{EnvironmentVariables: env.NewEnvironment()}, int64(1*time.Second*time.Millisecond))
 	require.Equal(t, phaseInitializing, srv.getRapidPhase())
@@ -310,7 +310,7 @@ func TestInvokeWithSuppressedInitSuccess(t *testing.T) {
 		return interop.ResetSuccess{}, nil
 	}
 
-	srv.SetSandboxContext(&SandboxContext{&mockRapidCtx{initHandler, invokeHandler, resetHandler}, "handler", "runtimeAPIhost:999"})
+	srv.SetSandboxContext(&SandboxContext{&mockRapidCtx{initHandler, invokeHandler, resetHandler}, "handler", "runtimeAPIhost:999", "test-token"})
 
 	srv.Init(&interop.Init{EnvironmentVariables: env.NewEnvironment()}, int64(1*time.Second*time.Millisecond))
 	require.Equal(t, phaseInitializing, srv.getRapidPhase())
@@ -374,7 +374,7 @@ func TestInvokeWithSuppressedInitErrorDueToInitError(t *testing.T) {
 		return interop.ResetSuccess{}, nil
 	}
 
-	srv.SetSandboxContext(&SandboxContext{&mockRapidCtx{initHandler, invokeHandler, resetHandler}, "handler", "runtimeAPIhost:999"})
+	srv.SetSandboxContext(&SandboxContext{&mockRapidCtx{initHandler, invokeHandler, resetHandler}, "handler", "runtimeAPIhost:999", "test-token"})
 
 	srv.Init(&interop.Init{EnvironmentVariables: env.NewEnvironment()}, int64(1*time.Second*time.Millisecond))
 
@@ -426,7 +426,7 @@ func TestInvokeWithSuppressedInitErrorDueToInvokeError(t *testing.T) {
 		return interop.ResetSuccess{}, nil
 	}
 
-	srv.SetSandboxContext(&SandboxContext{&mockRapidCtx{initHandler, invokeHandler, resetHandler}, "handler", "runtimeAPIhost:999"})
+	srv.SetSandboxContext(&SandboxContext{&mockRapidCtx{initHandler, invokeHandler, resetHandler}, "handler", "runtimeAPIhost:999", "test-token"})
 
 	srv.Init(&interop.Init{EnvironmentVariables: env.NewEnvironment()}, int64(1*time.Second*time.Millisecond))
 	require.Equal(t, phaseInitializing, srv.getRapidPhase())
@@ -477,7 +477,7 @@ func TestMultipleInvokeSuccess(t *testing.T) {
 		return interop.ResetSuccess{}, nil
 	}
 
-	srv.SetSandboxContext(&SandboxContext{&mockRapidCtx{initHandler, invokeHandler, resetHandler}, "handler", "runtimeAPIhost:999"})
+	srv.SetSandboxContext(&SandboxContext{&mockRapidCtx{initHandler, invokeHandler, resetHandler}, "handler", "runtimeAPIhost:999", "test-token"})
 
 	srv.Init(&interop.Init{EnvironmentVariables: env.NewEnvironment()}, int64(1*time.Second*time.Millisecond))
 	require.Equal(t, phaseInitializing, srv.getRapidPhase())

Original file line number	Diff line number	Diff line change
`@@ -13,6 +13,8 @@ import (`
`13`	`13`
`14`	`14`	`"github.com/google/uuid"`
`15`	`15`	`"github.com/stretchr/testify/assert"`
	`16`	`+ "github.com/aws/aws-lambda-runtime-interface-emulator/internal/lmds"`
	`17`	`+`
`16`	`18`	`"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/extensions"`
`17`	`19`	`"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/interop"`
`18`	`20`	`"github.com/aws/aws-lambda-runtime-interface-emulator/internal/lambda/rapi/handler"`
`@@ -133,6 +135,7 @@ func makeRapiServerWithMockSubscriptionAPI(`
`133`	`135`	`logsSubscription,`
`134`	`136`	`telemetrySubscription,`
`135`	`137`	`flowTest.CredentialsService,`
	`138`	`+ lmds.NewService("test-token"),`
`136`	`139`	`)`
`137`	`140`	`}`
`138`	`141`
Original file line number	Diff line number	Diff line change
`@@ -27,6 +27,8 @@ func predefinedPlatformEnvVarKeys() map[string]bool {`
`27`	`27`	`"AWS_LAMBDA_FUNCTION_MEMORY_SIZE": true,`
`28`	`28`	`"AWS_LAMBDA_FUNCTION_VERSION": true,`
`29`	`29`	`"AWS_LAMBDA_RUNTIME_API": true,`
	`30`	`+ "AWS_LAMBDA_METADATA_API": true,`
	`31`	`+ "AWS_LAMBDA_METADATA_TOKEN": true,`
`30`	`32`	`"TZ": true,`
`31`	`33`	`}`
`32`	`34`	`}`
Original file line number	Diff line number	Diff line change
`@@ -17,6 +17,7 @@ type SandboxContext struct {`
`17`	`17`	`rapidCtx interop.RapidContext`
`18`	`18`	`handler string`
`19`	`19`	`runtimeAPIAddress string`
	`20`	`+ metadataToken string`
`20`	`21`	`}`
`21`	`22`
`22`	`23`	`// initContext and its methods model the initialization lifecycle`
`@@ -55,6 +56,8 @@ func (s SandboxContext) Init(init *interop.Init, timeoutMs int64) interop.InitCo`
`55`	`56`	`}`
`56`	`57`
`57`	`58`	`init.EnvironmentVariables.StoreRuntimeAPIEnvironmentVariable(s.runtimeAPIAddress)`
	`59`	`+ // Metadata API uses the same address as Runtime API`
	`60`	`+ init.EnvironmentVariables.StoreMetadataAPIEnvironmentVariables(s.runtimeAPIAddress, s.metadataToken)`
`58`	`61`	`extensions.DisableViaMagicLayer()`
`59`	`62`
`60`	`63`	`// We start initialization handling in a separate goroutine so that control can be returned back to`