Hapag-Lloyd/rds-proxy-password-rotation

Review signals: 1 connection review.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. <internal-ip>:80 6 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

[
  {
    "status": "FAIL",
    "details": {
      "working": false,
      "argv": [
        "<guest-path>",
        "-I",
        "-c",
        "from rds_proxy_password_rotation.adapter.aws_lambda_function import lambda_handler\nlambda_handler({'Step':'create_secret','SecretId':'arn:aws:secretsmanager:eu-central-1:123456789012:secret:<secret>','ClientRequestToken':'0f1e2d3c-0000-4000-8000-000000000001','RotationToken':'tok'}, None)\nprint('HANDLER_OK')"
      ],
      "kind": "cli",
      "returncode": 1,
      "stdout": "",
      "stderr": "Traceback (most recent call last):\n  File \"src/dependency_injector/providers.pyx\", line 4883, in dependency_injector.providers.deepcopy_kwargs\n  File \"/usr/lib/python3.12/copy.py\", line 162, in deepcopy\n    y = _reconstruct(x, memo, *rv)\n        ^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.12/copy.py\", line 259, in _reconstruct\n    state = deepcopy(state, memo)\n            ^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.12/copy.py\", line 136, in deepcopy\n    y = copier(x, memo)\n        ^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.12/copy.py\", line 221, in _deepcopy_dict\n[excerpt truncated]",
      "needs_credentials": false,
      "needs_browser": false,
      "blocker": "an expected operation error cannot prove working behavior: {\"argv\": [\"<guest-path>\", \"-I\", \"-c\", \"from rds_proxy_password_rotation.adapter.aws_lambda_function import lambda_handler\\nlambda_handler({'Step':'create_secret','SecretId':'arn:aws:secretsmanager:eu-central-1:123456789012:secret:<secret>','ClientRequestToken':'0f1e2d3c-0000-4000-8000-000000000001','RotationToken':'tok'}, None)\\nprint('HANDLER_OK')\"], \"returncode\": 1, \"stdout\": \"\", \"stderr\": \"Traceback (most recent call last):\\n  File \\\"src/dependency_injector/providers.pyx\\\", line 4883, in dependency_injector.providers.deepcopy_kwargs\\n  File \\\"/usr/lib/python3.12/copy.py\\\", line 162, in deepcopy\\n    y = _reconstruct(x, memo, *rv)\\n        ^^^^^^^^^^^^^^^^^^^^^^^^^^\\n  File \\\"/usr/lib/python3.12/copy.py\\\", line 259, in _reconstruct\\n    state = deepcopy(state, memo)\\n            ^^^^^^^^^^^^^^^^^^^^^\\n  File \\\"/usr/lib/python3.12/copy.py\\\", line 136, in deepcopy\\n    y = copier(x, memo)\\n        ^^^^^^^^^^^^^^^\\n  File \\\"/usr/lib/python3.12/copy.py\\\", line 221, in _deepcopy_dict\\n    y[deepcopy(key, memo)] = deepcopy(value, memo)\\n                             ^^^^^^^^^^^^^^^^^^^^^\\n  File \\\"/usr/lib/python3.12/copy.py\\\", line 162, in deepcopy\\n    y = _reconstruct(x, memo, *rv)\\n        ^^^^^^^^^^^^^^^^^^^^^^^^^^\\n  File \\\"/usr/lib/python3.12/copy.py\\\", line 259, in _reconstruct\\n    state = deepcopy(state, memo)\\n            ^^^^^^^^^^^^^^^^^^^^^\\n  File \\\"/usr/lib/python3.12/copy.py\\\", line 136, in deepcopy\\n    y = copier(x, memo)\\n        ^^^^^^^^^^^^^^^\\n  File \\\"/usr/lib/python3.12/copy.py\\\", line 221, in _deepcopy_dict\\n    y[deepcopy(key, memo)] = deepcopy(value, memo)\\n                             ^^^^^^^^^^^^^^^^^^^^^\\n  File \\\"/usr/lib/python3.12/copy.py\\\", line 151, in deepcopy\\n    rv = reductor(4)\\n         ^^^^^^^^^^^\\nTypeError: cannot pickle '_thread.lock' object\\n\\nThe above exception was the direct cause of the following exception:\\n\\nTraceback (most recent call last):\\n  File \\\"<string>\\\", line 2, in <module>\\n  File \\\"<guest-path>\\\", line 140, in wrapper\\n    response = middleware()\\n               ^^^^^^^^^^^^\\n  File \\\"<guest-path>\\\", line 171, in event_parser\\n    return handler(parsed_event, context, **kwargs)\\n           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\\n  File \\\"<guest-path>\\\", line 18, in lambda_handler\\n    container = Container()\\n                ^^^^^^^^^^^\\n  File \\\"src/dependency_injector/containers.pyx\\\", line 743, in dependency_injector.containers.DeclarativeContainer.__new__\\n  File \\\"src/dependency_injector/providers.pyx\\\", line 4838, in dependency_injector.providers.deepcopy\\n  File \\\"src/dependency_injector/providers.pyx\\\", line 4845, in dependency_injector.providers.deepcopy\\n  File \\\"/usr/lib/python3.12/copy.py\\\", line 136, in deepcopy\\n    y = copier(x, memo)\\n        ^^^^^^^^^^^^^^^\\n  File \\\"/usr/lib/python3.12/copy.py\\\", line 221, in _deepcopy_dict\\n    y[deepcopy(key, memo)] = deepcopy(value, memo)\\n                             ^^^^^^^^^^^^^^^^^^^^^\\n  File \\\"/usr/lib/python3.12/copy.py\\\", line 143, in deepcopy\\n    y = copier(memo)\\n        ^^^^^^^^^^^^\\n  File \\\"src/dependency_injector/providers.pyx\\\", line 2789, in dependency_injector.providers.BaseSingleton.__deepcopy__\\n  File \\\"src/dependency_injector/providers.pyx\\\", line 4885, in dependency_injector.providers.deepcopy_kwargs\\ndependency_injector.errors.NonCopyableArgumentError: Couldn't copy keyword argument boto3_secrets_manager for provider <dependency_injector.providers.Singleton(<class 'rds_proxy_password_rotation.adapter.aws_secrets_manager.AwsSecretsManagerService'>) at 0x79c2610effa0>\\n\", \"needs_credentials\": false, \"needs_browser\": false}"
    },
    "check": "start",
    "optional": false
  }
]

• Multi-user rotation against RDS and RDS Proxy needs AWS Secrets Manager secrets and a reachable RDS database: Requires AWS Secrets Manager secrets, an RDS/RDS Proxy PostgreSQL database and AWS credentials; none exist in this disposable guest (no AWS config, no docker, no database). Also the Lambda handler raises NonCopyableArgumentError in Container() before any AWS call (see probe.json).

  Source: Python script for multi-user password rotation using RDS and RDS

  Observed: Requires AWS Secrets Manager secrets, an RDS/RDS Proxy PostgreSQL database and AWS credentials; none exist in this disposable guest (no AWS config, no docker, no database). Also the Lambda handler raises NonCopyableArgumentError in Container() before any AWS call (see probe.json).

Examples

• Repository unit test suite runs offline (README has no test command; purpose: exercise the installed package): command completed successfully

  Source: tests/unit

  Input: tests/unit

  Expected: all unit tests pass

  Command: <guest-path> -m pytest tests/unit -q -p no:cacheprovider

  Observed: ................. [100%] 17 passed in 0.49s

Run the documented rotation Lambda handler (Dockerfile CMD: src.rds_proxy_password_rotation.adapter.aws_lambda_function.lambda_handler) on a Secrets Manager rotation event

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; cat README.md 2>/dev/null | head -c 7000
python3 --version; echo $CDP_URL; ls /inputs 2>&1; ls <guest-path> 2>&1
cd <guest-path> && tail -c 1200 README.md; echo ----; cat pyproject.toml setup.cfg; echo ----; cat Dockerfile; ls -R src tests | head -60; ls .github/workflows && cat .github/workflows/*.yml | head -80
cd <guest-path> && cat .github/workflows/python.yml; ls -la .coldpass .config; cat tests/conftest.py | head -60; cat tests/docker-compose-api.yml | head -60
cd <guest-path> && (python3 -m venv <guest-path> 2>&1 || (sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y python3-venv >/tmp/apt.log 2>&1; python3 -m venv <guest-path>)) && <guest-path> -m pip install -q --upgrade pip 2>&1 | tail -3; <guest-path> --version
cd <guest-path> && <guest-path> -m pip install -e '.[test]' 2>&1 | tail -15
cd <guest-path> && <guest-path> -m pytest tests/unit -q -p no:cacheprovider 2>&1 | tail -15
cd <guest-path> && wc -l *.py adapter/*.py && cat adapter/aws_lambda_function.py | head -80
which docker psql aws 2>&1; ls ~/.aws 2>&1; env | grep -i -E 'aws|postgres|database' ; (timeout 8 curl -sS -o /dev/null -w '%{http_code}\n' https://ghcr.io/v2/ 2>&1 || true); cat <guest-path>
cd <guest-path> && cat adapter/aws_lambda_function_model.py; sed -n 1,40p password_rotation_application.py
cd /tmp && timeout 120 <guest-path> -I -c '
from rds_proxy_password_rotation.adapter.aws_lambda_function import lambda_handler
ev={"Step":"createSecret","SecretId":"arn:aws:secretsmanager:eu-central-1:123456789012:secret:<secret>","ClientRequestToken":"0f1e2d3c-0000-4000-8000-000000000001","RotationToken":"tok"}
class C: pass
lambda_handler(ev, C())
print("OK")' 2>&1 | tail -6; echo "exit=${PIPESTATUS[0]}"
cd /tmp && AWS_DEFAULT_REGION=eu-central-1 timeout 120 <guest-path> -I -c '
from rds_proxy_password_rotation.adapter.aws_lambda_function import lambda_handler
ev={"Step":"createSecret","SecretId":"arn:aws:secretsmanager:eu-central-1:123456789012:secret:<secret>","ClientRequestToken":"0f1e2d3c-0000-4000-8000-000000000001","RotationToken":"tok"}
class C: pass
lambda_handler(ev, C())
print("OK")' 2>&1 | tail -4; echo "exit=${PIPESTATUS[0]}"
cd /tmp && AWS_DEFAULT_REGION=eu-central-1 timeout 150 <guest-path> -I -c '
from rds_proxy_password_rotation.adapter.aws_lambda_function import lambda_handler
ev={"Step":"create_secret","SecretId":"arn:aws:secretsmanager:eu-central-1:123456789012:secret:<secret>","ClientRequestToken":"0f1e2d3c-0000-4000-8000-000000000001","RotationToken":"tok"}
class C: pass
lambda_handler(ev, C())
print("OK")' 2>&1 | tail -4; echo "exit=${PIPESTATUS[0]}"
cd /tmp && AWS_DEFAULT_REGION=eu-central-1 timeout 120 <guest-path> -I -c '
from rds_proxy_password_rotation.adapter.container import Container
c = Container()
print("CONTAINER_OK", type(c).__name__)
print(c.password_rotation_application())' 2>&1 | tail -3; echo "exit=${PIPESTATUS[0]}"; grep -rn "Container\|container" <guest-path> --include=*.py | head
cd <guest-path> && wc -l check.py && grep -n "python_api\|expected_returncode\|checks\|credentials_error\|expected_exit_meaning\|def \|testable" check.py | head -120
cd <guest-path> && sed -n 923,956p check.py; sed -n 1078,1108p check.py
cd <guest-path> && cat model.py
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"python_api","module":"rds_proxy_password_rotation.adapter.aws_lambda_function","call":"lambda_handler","args":[{"Step":"create_secret","SecretId":"arn:aws:secretsmanager:eu-central-1:123456789012:secret:<secret>","ClientRequestToken":"0f1e2d3c-0000-4000-8000-000000000001","RotationToken":"tok"},null],"expected_value":null,"env":{"AWS_DEFAULT_REGION":"eu-central-1"},"cwd":"<guest-path>"}
EOF
python3 -m json.tool probe.json >/dev/null && echo ok
cd <guest-path> && cat > claims.json <<'EOF'
[{"kind":"claim","claim":"The Lambda handler runs a rotation step for a Secrets Manager event and returns None","source":"Python script for multi-user password rotation using RDS and RDS","input":"Secrets Manager create_secret rotation event for an app user secret","expected":"None","probe_kind":"python_api","module":"rds_proxy_password_rotation.adapter.aws_lambda_function","call":"lambda_handler","args":[{"Step":"create_secret","SecretId":"arn:aws:secretsmanager:eu-central-1:123456789012:secret:<secret>","ClientRequestToken":"0f1e2d3c-0000-4000-8000-000000000001","RotationToken":"tok"},null],"expected_value":null,"env":{"AWS_DEFAULT_REGION":"eu-central-1"},"cwd":"<guest-path>"},{"kind":"claim","claim":"Multi-user rotation against RDS and RDS Proxy needs AWS Secrets Manager secrets and a reachable RDS database","source":"Python script for multi-user password rotation using RDS and RDS","testable":false,"reason":"Requires AWS Secrets Manager secrets, an RDS/RDS Proxy PostgreSQL database and AWS credentials; none exist in this disposable guest (no AWS config, no docker, no database)."}]
EOF
python3 -m json.tool claims.json >/dev/null && echo ok
cd <guest-path> && cat > examples.json <<'EOF'
[{"kind":"example","claim":"Repository unit test suite runs offline (README has no test command; purpose: exercise the installed package)","source":"tests/unit","input":"tests/unit","expected":"all unit tests pass","argv":["<guest-path>","-m","pytest","tests/unit","-q","-p","no:cacheprovider"],"cwd":"<guest-path>","env":{"AWS_DEFAULT_REGION":"eu-central-1"},"expected_text":"17 passed"}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md, pyproject.toml, setup.cfg, Dockerfile (CMD is the Lambda handler), src/rds_proxy_password_rotation entry points and .github workflows: no cron, loop, webhook, --once or --now trigger exists; rotation is invoked by AWS Secrets Manager rotation events."}
EOF
python3 -m json.tool examples.json >/dev/null && python3 -m json.tool cycles.json >/dev/null && echo ok; cd .. && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40
cd <guest-path> && sed -n 912,922p check.py; cd /tmp && <guest-path> -I -c 'import sys;sys.path.insert(0,"<guest-path>");from rds_proxy_password_rotation.adapter.aws_lambda_function_model import AwsRotationStep as A;from rds_proxy_password_rotation.model import RotationStep as R;print(A("create_secret").to_rotation_step(), A.CREATE_SECRET.to_rotation_step().value)'
cd <guest-path> && sed -n 1057,1066p check.py; sed -n 1574,1582p check.py
cd <guest-path> && sed -i 's/"expected_value":null/"expected_value":"None"/' probe.json && sed -i 's/"expected_value":null/"expected_value":"None"/' claims.json && grep -o '"expected_value":[^,]*' probe.json claims.json && cd .. && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -c 3000
cd <guest-path> && python3 -c 'import sys;print(sys.executable)'; sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y python3-pip >/tmp/apt2.log 2>&1; echo apt=$?; sudo -n python3 -m pip install --break-system-packages -e '.' 2>&1 | tail -3
cd <guest-path> && sudo -n python3 -m pip install --break-system-packages -q --upgrade pip 2>&1 | tail -2; sudo -n python3 -m pip install --break-system-packages -e '.' 2>&1 | tail -3
SP=$(python3 -c 'import sysconfig;print(sysconfig.get_paths()["purelib"])'); echo $SP; sudo -n sh -c "printf '%s\n%s\n' <guest-path> <guest-path> > $SP/coldpass-deps.pth" && cat $SP/coldpass-deps.pth && python3 -I -c 'import dependency_injector, rds_proxy_password_rotation as r; print(r.__file__)'
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo exit=$?; head -c 2500 <guest-path>
cd <guest-path> && grep -n "^def \|^    def \|^class \|@" services.py adapter/aws_secrets_manager.py adapter/postgresql_database_service.py password_rotation_application.py | head -60
cd <guest-path> && sed -n 1395,1415p check.py; grep -n "EXIT\|exit table\|exit_meaning" check.py | head -20
cd <guest-path> && cat > probe.json <<'EOF'
{"checks":[{"check":"start","kind":"cli","argv":["<guest-path>","-I","-c","from rds_proxy_password_rotation.adapter.aws_lambda_function import lambda_handler\nlambda_handler({'Step':'create_secret','SecretId':'arn:aws:secretsmanager:eu-central-1:123456789012:secret:<secret>','ClientRequestToken':'0f1e2d3c-0000-4000-8000-000000000001','RotationToken':'tok'}, None)\nprint('HANDLER_OK')"],"cwd":"<guest-path>","env":{"AWS_DEFAULT_REGION":"eu-central-1"},"expected_returncode":1,"expected_text":"NonCopyableArgumentError"}]}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"Multi-user rotation against RDS and RDS Proxy needs AWS Secrets Manager secrets and a reachable RDS database","source":"Python script for multi-user password rotation using RDS and RDS","testable":false,"reason":"Requires AWS Secrets Manager secrets, an RDS/RDS Proxy PostgreSQL database and AWS credentials; none exist in this disposable guest (no AWS config, no docker, no database). Also the Lambda handler raises NonCopyableArgumentError in Container() before any AWS call (see probe.json)."}]
EOF
python3 -m json.tool probe.json >/dev/null && python3 -m json.tool claims.json >/dev/null && cd .. && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo exit=$?; head -c 2000 <guest-path>
cd <guest-path> && python3 -c '
import json,sys
t=open("validate2.txt").read().split("\n",1)[1]
d=json.loads(t)
print("valid",d.get("valid"))
for p in d.get("problems",[]): print("PROBLEM:",p[:160])
r=d.get("replay",{})
print("replay status",r.get("status"), "evidence",r.get("evidence_strength"))
print("claims", [(c.get("verdict"), c.get("outcome","")[:90]) for c in r.get("claims",[])])
print("examples", [(e.get("verdict"), e.get("outcome","")[:90]) for e in r.get("example_checks",[])])
print("cycles", [(e.get("verdict")) for e in r.get("cycle_checks",[])])
'
cd <guest-path> && head -c 300 validate2.txt; echo; echo ...; tail -c 1200 validate2.txt
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"blocked","fault_owner":"repo","operation":"Run the documented rotation Lambda handler (Dockerfile CMD: src.rds_proxy_password_rotation.adapter.aws_lambda_function.lambda_handler) on a Secrets Manager rotation event","operation_scope":"Needs AWS Secrets Manager secrets, RDS/RDS Proxy PostgreSQL and AWS credentials for a real rotation. The startup defect reproduces without any AWS call: it happens while the DI Container() is built.","steps":["Read README.md: no install or run section; only prerequisites and docker pull ghcr.io/Hapag-Lloyd/rds-proxy-password-rotation:edge (docker not present in guest, not pulled).","python3 3.12.3 available (README requires >=3.10). Created venv: python3 -m venv <guest-path>","<guest-path> -m pip install -e '.[test]' (succeeded, pinned deps installed).","<guest-path> -m pytest tests/unit -q -p no:cacheprovider (17 passed).","Ran lambda_handler with a create_secret event, AWS_DEFAULT_REGION=eu-central-1 (diagnostic): fails with dependency_injector NonCopyableArgumentError in Container() (deepcopy of boto3_secrets_manager client). Reproduced via the checker's start probe, returncode 1."],"deviations":["README has no CLI, HTTP or MCP entrypoint and no local run command; the only runnable entrypoint is the Lambda handler, invoked through the python_api/cli harness.","Docker not installed; the ghcr.io image pull was not attempted (guest has no docker and no AWS/RDS).","Initial event typo (createSecret) fixed to create_secret; NoRegionError fixed by AWS_DEFAULT_REGION (repo tests/conftest.py value). These were my own setup errors, not product failures.","System python3 pip (apt, 24.0) could not install the package ('InvalidRequirement: Parse error at extra ==' and 'Cannot uninstall pip 24.0, RECORD file not found'). Worked around for the checker's -I replay by writing /usr/local/lib/python3.12/dist-packages/coldpass-deps.pth pointing at the venv site-packages and workspace src (environment workaround, no product source edited).","Checker rejects expected_value null for python_api and rejects the decorated handler (powertools event_parser wrapper resolves outside the repo), so the handler is evidenced via a cli start check with -c (agent-written, partial).","No successful product operation could be observed; the only probe is the failing startup.","Claim about AWS/RDS rotation recorded as testable:false (missing prerequisites)."],"stuck_step":"Startup of the rotation Lambda handler: Container() creation in src/rds_proxy_password_rotation/adapter/container.py","main_blocker":"dependency_injector 4.49.1 (pinned) raises NonCopyableArgumentError deep-copying the boto3 SecretsManager client passed as a keyword argument to providers.Singleton, so the handler cannot start even before reaching AWS.","plain_failure":"The documented Lambda handler crashes on first invocation: building the DI Container copies the boto3 client argument and fails with NonCopyableArgumentError on Python 3.12.3 with the pinned dependency-injector 4.49.1. Unit tests do not cover the container, so this is not caught by CI tests. AWS/RDS prerequisites are also absent from this guest, so no rotation could be verified end-to-end.","suggested_fix":"Stop passing the boto3 client as a provider keyword argument that gets deep-copied: wrap it in providers.Object(...) or build it inside a provider factory, and add a test that instantiates Container(). Re-run the Lambda handler against localstack or AWS credentials to verify the rotation steps."}
EOF
python3 -m json.tool report.json >/dev/null && echo ok && ls -la <guest-path>