Fix AWS Parameter and Secrets Lambda extension example in turbo example

[bestickley]

See: #106 (comment)

[rootical]

Hi folks, trying out your hard work, and ran into the same issue:

global-functions.Dockerfile:10
--------------------
   8 |     COPY --from=public.ecr.aws/awsguru/aws-lambda-adapter:0.9.1 /lambda-adapter /opt/extensions/lambda-adapter
   9 |     # Add SSM Parameter Store and Secrets Manager extensions
  10 | >>> COPY --from=public.ecr.aws/aws-lambda-extensions/aws-lambda-parameters-and-secrets-extension:latest /opt/extensions/ /opt/extensions/
  11 |     WORKDIR /app
  12 |
--------------------
ERROR: failed to solve: public.ecr.aws/aws-lambda-extensions/aws-lambda-parameters-and-secrets-extension:latest: failed to resolve source metadata for public.ecr.aws/aws-lambda-extensions/aws-lambda-parameters-and-secrets-extension:latest: public.ecr.aws/aws-lambda-extensions/aws-lambda-parameters-and-secrets-extension:latest: not found

Looks complicated for me, not have much knowledge of secrets and parameters extension, and I am stuck with deployment :) Would appreciate any help.

Thanks in advance!

[bestickley]

Hey @rootical! Yes, unfortunately the image public.ecr.aws/aws-lambda-extensions/aws-lambda-parameters-and-secrets-extension does not exist. It was a Amazon Q hallucination and I forgot to verify. I haven't had time to get to this yet but it should be simple. You should be able to get the layer like:

curl $(aws lambda get-layer-version-by-arn --arn $LAYER_ARN --query 'Content.Location' --output text) --output layer.zip
unzip layer.zip -d ./aws-lambda-parameters-and-secrets-extension

Then copy and paste it into the examples/turbo directory, then update examples/turbo/global-functions.Dockerfile line 10 to something like COPY ./aws-lambda-parameters-and-secrets-extension /opt. If you get something working please share on this issue. Thanks!

Also, here is working gist from @LaurenceGA.

[rootical]

Thanks a lot @bestickley, @LaurenceGA - i made it work somehow with the help of the gist. The only thing for me i didn't have SessionToken, because of having static credentials, so i just removed this argument :)

[LaurenceGA]

Just wanted to share a related issue I ran into where Lambda extensions (specifically SSM Parameter Store) were failing on x86_64 but working fine on ARM64.

• Deploying locally (M1 Mac/ARM64): Works fine
• Deploying via GitHub Actions (x86_64): gets Extension.LaunchError during INIT

The cause was that the SSM extensions have different linking for different architectures:

• ARM64: Statically linked → works on Alpine
• x86_64: Dynamically linked against glibc → fails on Alpine (which uses musl)

I verified this by checking the extension binaries - the x86_64 version needs /lib64/ld-linux-x86-64.so.2 which Alpine doesn't have.

Luckily I just needed add libc6-compat to Alpine images:

RUN apk add --no-cache libc6-compat

I found from the existing cdk-nextjs Docker files:

builder.Dockerfile Already has libc6-compat
global-functions.Dockerfile Missing it

Since extensions run in the global-functions runtime, it needs the compatibility layer too, so it might need an update?

[bestickley]

@LaurenceGA, great find. I will add this to tall Dockerfiles in my current branch. Thank you.

[bestickley]

Whenever I run pnpm run deploy in the examples/turbo directory I get this error:

turbo % pnpm run deploy

> cdk-nextjs-example-turbo@ deploy /Users/stickb/Code/cdk-nextjs/examples/turbo
> dotenv -- cdk deploy --require-approval never --outputs-file outputs.json

turbo 2.5.6

Generating pruned monorepo for app-playground in /Users/stickb/Code/cdk-nextjs/examples/pruned/app-playground
 - Added app-playground
Building image with command: docker build  --file builder.Dockerfile --tag cdk-nextjs/builder:5d1d1a2ced56  --build-arg BUILD_COMMAND="npm run build" --build-arg RELATIVE_PATH_TO_PACKAGE="./app-playground" . in directory: /Users/stickb/Code/cdk-nextjs/examples/pruned/app-playground
[+] Building 32.6s (13/13) FINISHED                                                                                                                                           docker:rancher-desktop
 => [internal] load build definition from builder.Dockerfile                                                                                                                                    0.0s
 => => transferring dockerfile: 1.36kB                                                                                                                                                          0.0s
 => [internal] load metadata for public.ecr.aws/docker/library/node:22-alpine                                                                                                                   0.0s
 => [internal] load .dockerignore                                                                                                                                                               0.0s
 => => transferring context: 2B                                                                                                                                                                 0.0s
 => [1/8] FROM public.ecr.aws/docker/library/node:22-alpine                                                                                                                                     0.0s
 => [internal] load build context                                                                                                                                                               0.0s
 => => transferring context: 232.81kB                                                                                                                                                           0.0s
 => CACHED [2/8] RUN apk add --no-cache libc6-compat                                                                                                                                            0.0s
 => CACHED [3/8] WORKDIR /app                                                                                                                                                                   0.0s
 => CACHED [4/8] COPY ./json/ ./cdk-nextjs-cache-handler.cjs ./                                                                                                                                 0.0s
 => CACHED [5/8] RUN npm install -g corepack@latest && corepack enable pnpm && pnpm install --frozen-lockfile                                                                                   0.0s
 => CACHED [6/8] COPY ./full/ ./                                                                                                                                                                0.0s
 => [7/8] RUN cd ./app-playground &&  NODE_OPTIONS="--max-old-space-size=8192" npm run build                                                                                                   30.3s
 => [8/8] RUN rm -rf node_modules &&   command -v pnpm >/dev/null 2>&1 && rm -rf $(pnpm store path) || echo "pnpm not installed, skipping cache cleanup" &&   rm -rf ./app-playground/.next/ca  1.7s 
 => exporting to image                                                                                                                                                                          0.5s 
 => => exporting layers                                                                                                                                                                         0.5s 
 => => writing image sha256:9cff7c9527ae330f450e3e96f556a16eb945af495d7b677eb800f474afd6ba09                                                                                                    0.0s 
 => => naming to docker.io/cdk-nextjs/builder:5d1d1a2ced56                                                                                                                                      0.0s 
                                                                                                                                                                                                     
<--- Last few GCs --->

[22378:0x158008000]   212640 ms: Mark-Compact 4034.7 (4137.4) -> 4026.8 (4137.7) MB, pooled: 0 MB, 336.17 / 0.00 ms  (average mu = 0.087, current mu = 0.024) allocation failure; scavenge might not succeed
[22378:0x158008000]   212996 ms: Mark-Compact 4034.8 (4137.7) -> 4027.0 (4137.9) MB, pooled: 0 MB, 349.62 / 0.00 ms  (average mu = 0.053, current mu = 0.018) allocation failure; scavenge might not succeed


<--- JS stacktrace --->

FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

 1: 0x10047625c node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/Users/stickb/.nvm/versions/node/v22.18.0/bin/node]
 2: 0x10064c4fc v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/Users/stickb/.nvm/versions/node/v22.18.0/bin/node]
 3: 0x10085bc24 v8::internal::Heap::stack() [/Users/stickb/.nvm/versions/node/v22.18.0/bin/node]
 4: 0x10087209c v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags)::$_1::operator()() const [/Users/stickb/.nvm/versions/node/v22.18.0/bin/node]
 5: 0x100871930 void heap::base::Stack::SetMarkerAndCallbackImpl<v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags)::$_1>(heap::base::Stack*, void*, void const*) [/Users/stickb/.nvm/versions/node/v22.18.0/bin/node]
 6: 0x10102badc PushAllRegistersAndIterateStack [/Users/stickb/.nvm/versions/node/v22.18.0/bin/node]
 7: 0x100859de4 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [/Users/stickb/.nvm/versions/node/v22.18.0/bin/node]
 8: 0x10084e5ac v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/Users/stickb/.nvm/versions/node/v22.18.0/bin/node]
 9: 0x10084ede4 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/Users/stickb/.nvm/versions/node/v22.18.0/bin/node]
10: 0x100832104 v8::internal::Factory::NewFillerObject(int, v8::internal::AllocationAlignment, v8::internal::AllocationType, v8::internal::AllocationOrigin) [/Users/stickb/.nvm/versions/node/v22.18.0/bin/node]
11: 0x100c4dbb4 v8::internal::Runtime_AllocateInYoungGeneration(int, unsigned long*, v8::internal::Isolate*) [/Users/stickb/.nvm/versions/node/v22.18.0/bin/node]
12: 0x101111e9c Builtins_WasmCEntry [/Users/stickb/.nvm/versions/node/v22.18.0/bin/node]
13: 0x1011122e4 Builtins_StringAdd_CheckNone [/Users/stickb/.nvm/versions/node/v22.18.0/bin/node]
14: 0x107015200 
15: 0x1070af674 
16: 0x1070c9cf8 
17: 0x1070ca938 
18: 0x1070ca938 
19: 0x1070ca938 
20: 0x1070ca938 
21: 0x1070cacd0 
22: 0x1070ca938 
23: 0x1070ca938 
24: 0x1070ca938 
25: 0x1070ca938 
26: 0x1070cacd0 
27: 0x1070ca938 
28: 0x1070ca938 
29: 0x1070ca938 
30: 0x1070ca938 
31: 0x1070cacd0 
32: 0x1070ca938 
33: 0x1070ca938 
34: 0x1070ca938 
35: 0x1070ca938 
36: 0x1070cacd0 
37: 0x1070ca938 
38: 0x1070ca938 
39: 0x1070ca938 
40: 0x1070ca938 
41: 0x1070cacd0 
42: 0x1070ca938 
43: 0x1070ca938 
44: 0x1070ca938 
45: 0x1070ca938 
46: 0x1070cacd0 
47: 0x1070ca938 
48: 0x1070ca938 
49: 0x1070ca938 
50: 0x1070ca938 
51: 0x1070cacd0 
52: 0x1070ca938 
53: 0x1070ca938 
54: 0x1070ca938 
55: 0x1070ca938 
56: 0x1070cacd0 
57: 0x1070ca938 
58: 0x1070ca938 
59: 0x1070ca938 
60: 0x1070ca938 
61: 0x1070cacd0 
62: 0x1070ca938 
63: 0x1070ca938 
64: 0x1070ca938 
65: 0x1070ca938 
66: 0x1070cacd0 
67: 0x1070ca938 
68: 0x1070ca938 
69: 0x1070ca938 
70: 0x1070ca938 
71: 0x1070cacd0 
72: 0x1070ca938 
73: 0x1070ca938 
74: 0x1070ca938 
75: 0x1070ca938 
76: 0x1070cacd0 
77: 0x1070ca938 
78: 0x1070ca938 
79: 0x1070ca938 
80: 0x1070ca938 
81: 0x1070cacd0 
82: 0x1070ca938 
83: 0x1070ca938 
84: 0x1070ca938 
85: 0x1070ca938 
86: 0x1070cacd0 
87: 0x1070ca938 
88: 0x1070ca938 
89: 0x1070ca938 
90: 0x1070ca938 
91: 0x1070cacd0 
92: 0x1070ca938 
93: 0x1070ca938 
94: 0x1070ca938 
95: 0x1070ca938 
96: 0x1070cacd0 
97: 0x1070ca938 
98: 0x1070ca938 
99: 0x1070ca938 
100: 0x1070ca938
...
NOTICES         (What's this? https://github.com/aws/aws-cdk/wiki/CLI-Notices)

34892   CDK CLI will collect telemetry data on command usage starting at version 2.1100.0 (unless opted out)

        Overview: We do not collect customer content and we anonymize the
                  telemetry we do collect. See the attached issue for more
                  information on what data is collected, why, and how to
                  opt-out. Telemetry will NOT be collected for any CDK CLI
                  version prior to version 2.1100.0 - regardless of
                  opt-in/out. You can also preview the telemetry we will start
                  collecting by logging it to a local file, by adding
                  `--unstable=telemetry --telemetry-file=my/local/file` to any
                  `cdk` command.

        Affected versions: cli: ^2.0.0

        More information at: https://github.com/aws/aws-cdk/issues/34892


If you don’t want to see a notice anymore, use "cdk acknowledge <id>". For example, "cdk acknowledge 34892".
pnpm tsx app.ts: Subprocess exited with error 134
 ELIFECYCLE  Command failed with exit code 1.

I'm not able to resolve. Have either of you gotten this error?

[LaurenceGA]

Ooh hmm no, have not seen that before. Haven't run this specific example either though. I see you're adjusting max-old-space-size within the docker container, which people do seem to suggest, but maybe that needs to be applied to the out CDK script itself that is being run? Not just inside the container? Not sure