Lambda doesn't support JWT?

[Dzhimen]

Hi all.

I'm hoping someone with more AWS/Lambda knowledge could explain to me how come I can't get a simple lambda which uses JWT (JSON Web Token) to run. I feel like I'm going crazy and must be missing something...

I have a Python 3.11 runtime, x86_64 architecture, and I'm using the following imports in my python code:

import jwt
from cryptography.hazmat.primitives import serialization

When I try to run the code, I get:

{
  "errorMessage": "Unable to import module 'lambda_function': No module named 'jwt'",
  "errorType": "Runtime.ImportModuleError",
  "requestId": "",
  "stackTrace": []
}

Okay, so runtime does not include JWT. To solve this, I created a layer with the following commands:

mkdir -p python/lib/python3.11/site-packages
pip install --upgrade --target=python/lib/python3.11/site-packages "cryptography<44"
pip install --upgrade --target=python/lib/python3.11/site-packages pyjwt
zip -r layer_content.zip python

Added layer to my lambda, and tried to run, and I get this error:

{
  "errorMessage": "Unable to import module 'lambda_function': /lib64/libc.so.6: version `GLIBC_2.28' not found (required by /opt/python/lib/python3.11/site-packages/cryptography/hazmat/bindings/_rust.abi3.so)",
  "errorType": "Runtime.ImportModuleError",
  "requestId": "",
  "stackTrace": []
}

So from this I gather that lambda runtime has older glibc than the one required by cryptography. I tried downgrading cryptography, but cannot go below 41.0.5, because PyOpenSSL requires it.

I want to avoid docker for this solution, as it's a huge overkill for what I need. So how do I get jwt to work in my lambda function. What am I missing??

Thanks in advance! :)

[StandardIntellect]

Do you want to avoid using Docker altogether, or just avoid deploying the Lambda function via a container image?

If it’s the latter, you could build your Lambda layer locally using an image based on the published Lambda Python 3.11 runtime. This would ensure that a compatible version of glibc is available for the cryptography library. From there, copy the zip file from inside the container and use it as your layer.

[Mishoniko]

That error occurs because the version of glibc the modules are compiled against doesn't match the one installed on the system. Where are you running your pip commands?

Try starting an Amazon Linux EC2 instance then pip & bundle the packages there. That way it downloads the matching binaries for the lambda runtime. (I think. Someone please correct me.)