Getting cryptography' package is required while rotating secrets manager rds password about aws-secrets-manager-rotation-lambdas HOT 5 CLOSED

Hi jani4865@ - what version of MySQL are you on? I believe this might be related to something in 8.0.34+ where they've deprecated the mysql_native_password authentication plugin: https://dev.mysql.com/doc/refman/8.0/en/native-pluggable-authentication.html

One solution is to include PyMySQL[rsa], but I will mark this as a high priority issue for us to address.

from aws-secrets-manager-rotation-lambdas.

Hi @jbct
We are using 8.0.mysql_aurora.3.05.2

from aws-secrets-manager-rotation-lambdas.

My lambda deployment alredy has cryptograpy module installed

from aws-secrets-manager-rotation-lambdas.

Issue got resolved after installing the cryptography module as below
pip install \
--platform manylinux2014_x86_64
--target=my-lambda-function
--implementation cp
--python-version 3.9
--only-binary=:all: --upgrade
cryptography

from aws-secrets-manager-rotation-lambdas.

@jani4865 Thank you for your information! cryptography package contains complied code, so you need be very careful when using pip to install it. By default, pip will only download and compile the packages for the architecture of the local machine. If the architecture of your local machine is different from AWS Lambda, you might run into dependency errors. To ensure your dependencies work with AWS Lambda, check out our instructions here.

For your specific issue, to use "sha256_password" or "caching_sha2_password" for authentication, you will need to either install cryptography separately, or you can install PyMySQL and cryptography in one command as follow

pip install \    
    --platform manylinux2014_x86_64 \
    --target=my-lambda-function \
    --implementation cp \
    --python-version 3.9 \
    --only-binary=:all: --upgrade \
    'PyMySQL[rsa]'

from aws-secrets-manager-rotation-lambdas.