"Unable to import module 'datadog_lambda.handler': cannot import name 'DEFAULT_CIPHERS'"

[pmaurais]

Expected Behavior

The lambda runs and logs to DD

Actual Behavior

"Unable to import module 'datadog_lambda.handler': cannot import name 'DEFAULT_CIPHERS' from 'urllib3.util.ssl_' (/var/task/urllib3/util/ssl_.py)",

Likely related to urllib3/urllib3#2168

Steps to Reproduce the Problem

1. Create a SAM template that uses the latest version of the DD Python Extension
2. Create a Lambda that uses python 3.9
3. sam build -u, sam deploy
4. Attempt to execute the lambda

Specifications

• Datadog Lambda Layer version: 43
• Python version: 74

Stacktrace

[ERROR] Runtime.ImportModuleError: Unable to import module 'datadog_lambda.handler': cannot import name 'DEFAULT_CIPHERS' from 'urllib3.util.ssl_' (/var/task/urllib3/util/ssl_.py)
Traceback (most recent call last):

[pmaurais]

@kid-92

[pmaurais]

Does the extension use < python 3.9?

[filipponova]

Same error here.

Python 3.10

Runtime.ImportModuleError: Unable to import module 'datadog_lambda.handler': cannot import name 'DEFAULT_CIPHERS' from 'urllib3.util.ssl_' (/var/task/urllib3/util/ssl_.py)

It was working until last week. :/

[filipponova]

In Python 3.8 a different error with link to this issue: urllib3/urllib3#2168

Runtime.ImportModuleError: Unable to import module 'datadog_lambda.handler': urllib3 v2.0 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with OpenSSL 1.0.2k-fips  26 Jan 2017. See: https://github.com/urllib3/urllib3/issues/2168

[astuyve]

Hey folks, thanks for reaching out! We're investigating this and will get back to you

[astuyve]

Hi @filipponova and @pmaurais - I see you mentioned this was working until last week. Did you upload from an earlier version of this library (Datadog Lambda Python)? The most recent layer version is 72, was that working until recently?
The Datadog Lambda Extension is written in Go, and that seems unrelated here.

Can you share a larger stack trace if possible?

Thanks!

[astuyve]

This seems to be caused by psf/requests#6432

[pmaurais]

Hey @astuyve

Thanks for following up. I have this same issue using versions 70-74.

Unfortunately, I can not give you more of a stack trace.

On a better note, I have found a temporary solution. It seems like the Datadog layer picks up whatever version of urllib I have configured as a dependency for my lambda.

If I pin urllib 3 < 2.0 in my requirments.txt: urllib3<2, everything runs and traces are sent. This is definitely something that should be addressed as you have

datadog-lambda-python/pyproject.toml

Line 31 in a894938

boto3 = { version = "^1.10.33", optional = true }

and

datadog-lambda-python/pyproject.toml

Line 33 in a894938

requests = { version ="^2.22.0", optional = true }

I misspoke earlier, I meant to ask if the layer uses < 3.9. After looking through the code base, I see it can be built using python3.7-3.10.

It seems like some of your other services have a similar issue DataDog/datadog-agent-buildimages@caed8c9

[filipponova]

Hello, The problem might be in the requests module's version. It started using urllib3 2.0 with OpenSSL 1.1.1. After I changed the version of my requests module to <2.29, the problem was solved. This appears to be related to PEP 644. It's working for me now.

Thanks @astuyve !

[astuyve]

Thanks to both of you! We can definitely pin to requests < 2.29, although because this library is provided as a lambda layer, I believe that whatever version the user provides in their own lambda package will override our own.

I'm not entirely clear right now on which version of requests or urllib3 is included with botocore in the runtime, although I suspect it's pinned to urllib3>=1.25.4,<1.27, as per the open issue in their repository.

As I believe this means users may override the version of urllib3 and breaking the provided version by either us or botocore - I'm not sure how much we can do in this library.

I've tested this with a vanilla python lambda function (eg - just datadog and the native python botocore), and that seems to work fine:

Can you both confirm that you were providing your own versions of urllib3 when this error occurred?

Thank you so much!

[jamie-chapman]

Had a similar issue recently which was fixed by pinning the botocore version to botocore==1.20.112 and the boto3 version to boto3==1.17.105

`[ERROR] Runtime.ImportModuleError: Unable to import module 'datadog_lambda.handler': cannot import name 'DEPRECATED_SERVICE_NAMES' from 'botocore.docs' (/var/task/botocore/docs/__init__.py)
Traceback (most recent call last):`

But from what I understand with this issue is that it might actually be unrelated to the DataDog layer itself? As even if the layer uses these packages, the version is overridden by whatever you define in your lambda code, it's just that the error message mentions the DataDog layer because the layer propagates this error up?