[SumiRann1]

Issue number: closes #8593

Summary

Changes

get_parameters_by_name built its cache key by hand as (name, transform) in _get_parameters_by_name_from_cache and _transform_and_cache_get_parameters_response, while BaseProvider._build_cache_key (used by get()) builds (name, transform, is_nested). The two never matched, so the same parameter was fetched twice and stored twice.

This PR uses self._build_cache_key(...) in both places in ssm.py, so get() and get_parameters_by_name share cache entries. Parameters that go through the decrypt path (which calls get()) are now also found in the cache by the batch path.

I added two regression tests (get() then get_parameters_by_name, and the other way around) and updated test_get_parameters_by_name_cache, which hardcoded the old key shape (name, None).

User experience

Before: a parameter fetched with get("/a") was fetched again by a following get_parameters_by_name({"/a": {}}) even though it was still fresh in cache (extra API call, duplicate cache entry), and vice versa.

After: the fresh cached value is reused in both directions.

Checklist

• Type of change: bug fix (code change + tests added)
• Regression tests fail before the fix and pass after it
• Existing parameters tests pass locally (uv run pytest tests/functional/parameters)
• ruff format and ruff check pass
• No documentation change needed

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[leandrodamascena]

Thanks @SumiRann1, the two places you changed are the right ones. Problem is #8619 landed while this was open and changed the key shape again, so this needs an update.

SSMProvider.get() always passes decrypt in sdk_options, so its key on develop today is (name, transform, False, '{"decrypt": false}'). Your batch key is (name, transform, False). Still different, and your two new tests fail after a rebase. Pass sdk_options={"decrypt": options["decrypt"]} to _build_cache_key in both spots and fix the expected key in test_get_parameters_by_name_cache. I tried it locally against real Parameter Store and both directions share the cache after that.

This also fixes something worse I noticed while testing: the batch path caches a SecureString under the same key with or without decrypt, so a second batch call without decrypt gets the decrypted value from cache. Please add a test for that: two batch calls, one with decrypt=True, one without, both must hit the API.

Rebase on develop too, the conflict is only in the test file, keep both blocks. Ping me when it's ready. This is in 3.39.0.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[leandrodamascena]

Thanks @SumiRann1, I went ahead and finished this one since 3.39.0 is closing. I merged develop into your branch and pushed one commit on top: both batch sites now pass sdk_options={"decrypt": options["decrypt"]} to _build_cache_key, so the key matches what get() writes. I also fixed the expected keys in the three tests that still had the old tuple and added two tests for the decrypt case.

Tested against real Parameter Store in both directions, and the decrypt isolation too: on develop a batch call without decrypt was getting the decrypted SecureString from cache after a batch call with decrypt=True, with this change it calls the API again and gets the ciphertext. Your commit stays as the first one in the PR so the credit is yours. Approving, this goes out in 3.39.0.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.99%. Comparing base (523504d) to head (0a41db8).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #8614   +/-   ##
========================================
  Coverage    96.99%   96.99%           
========================================
  Files          321      321           
  Lines        16332    16332           
  Branches      1473     1473           
========================================
  Hits         15841    15841           
  Misses         350      350           
  Partials       141      141           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.