AWS Lambda中AWS Encryption SDK Python加密文件超时（疑似无限循环）

Hey there, let's break down why your Lambda function is timing out mid-encryption even with a small file. The "infinite loop" suspicion makes sense, but more often than not, this is tied to permissions, SDK setup, or subtle file handling issues rather than a true infinite loop. Here's how to diagnose and fix it:

Common Causes & Fixes #

1. Missing KMS Permissions on Lambda Execution Role #

If your Lambda's execution role doesn't have the right permissions to interact with your KMS key, the AWS Encryption SDK might hang or retry indefinitely (which looks like a timeout). Double-check that your role has these permissions for your target KMS key:

• kms:GenerateDataKey (required for envelope encryption, which the SDK uses by default)
• kms:Encrypt (some scenarios may need this too)

You can add a policy like this to your role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kms:GenerateDataKey",
                "kms:Encrypt"
            ],
            "Resource": "arn:aws:kms:your-region:your-account-id:key/your-key-id"
        }
    ]
}

2. Misconfigured KMS Key Provider #

Make sure your kms_key_provider is initialized correctly. If you're using a key ARN, verify the region matches your Lambda's region—cross-region KMS calls add latency and can cause unexpected delays. For example:

kms_key_provider = aws_encryption_sdk.KMSMasterKeyProvider(key_ids=["arn:aws:kms:us-east-1:123456789012:key/abc123"])

Double-check the ARN is accurate and the key is enabled in the AWS console.

3. Unclosed File from Preceding Code #

If your pre-code that generates /tmp/DAILY.csv doesn't properly close the file, the encryption code might be waiting on a locked file. Always use with statements for file handling to ensure automatic closure:

# Example of safe file generation
with open('/tmp/DAILY.csv', 'w') as f:
    f.write(your_csv_data)

This prevents file locks that can stall the encryption read operation.

4. Manual Chunk Loop Issues #

Your current loop over encryptor chunks is functional, but using shutil.copyfileobj is more robust and avoids potential edge cases with chunk iteration. Replace your loop with this:

import shutil

with open('/tmp/DAILY.csv', 'rb') as pt_file, open('/tmp/DAILY.enc', 'wb') as ct_file:
    with aws_encryption_sdk.stream(mode='e', source=pt_file, key_provider=kms_key_provider) as encryptor:
        shutil.copyfileobj(encryptor, ct_file)

This handles stream copying efficiently and reduces the chance of accidental infinite loops.

5. Outdated AWS Encryption SDK Version #

Older versions of the SDK might have bugs in stream handling. Upgrade to the latest stable version in your Lambda deployment package (or use Lambda layers for easier management). For pip:

pip install aws-encryption-sdk --upgrade

6. Insufficient Lambda Timeout #

Even small files need time for KMS API calls and encryption. The default Lambda timeout is 3 seconds—bump it to 10-15 seconds to give the process enough breathing room. You can adjust this in the Lambda console under Configuration > General configuration.

7. Add Debug Logs to Diagnose #

To confirm if it's a loop or a hang, add logging to track chunk processing. This will show up in CloudWatch Logs:

import logging

logger = logging.getLogger()
logger.setLevel(logging.INFO)

with open('/tmp/DAILY.csv', 'rb') as pt_file, open('/tmp/DAILY.enc', 'wb') as ct_file:
    with aws_encryption_sdk.stream(mode='e', source=pt_file, key_provider=kms_key_provider) as encryptor:
        for chunk_idx, chunk in enumerate(encryptor):
            logger.info(f"Processed chunk {chunk_idx}, size: {len(chunk)} bytes")
            ct_file.write(chunk)

If you see repeated chunk logs, it's a loop; if logs stop after the first entry, it's hanging on a KMS call or file read.

内容的提问来源于stack exchange，提问作者Donislav Belev