feat(lambdas): add batch SSM parameter fetching to reduce API calls by thomasnemer · Pull Request #5017 · github-aws-runners/terraform-aws-github-runner

thomasnemer · 2026-02-04T13:03:57Z

This PR intends to reduce SSM AWS API calls by doing the following:

Add getParameters() function to aws-ssm-util that fetches multiple SSM parameters in a single API call with automatic chunking (max 10 per call per AWS API limits).

Apply batch fetching to:

auth.ts: fetch App ID and Private Key in one call (2 calls → 1)
ConfigLoader.ts: fetch multiple matcher config paths in one call
ami.ts: batch resolve SSM parameter values for AMI lookups

Also remove redundant appId SSM fetch in scale-up.ts that was only used for logging.

Add getParameters() function to aws-ssm-util that fetches multiple SSM parameters in a single API call with automatic chunking (max 10 per call per AWS API limits). Apply batch fetching to: - auth.ts: fetch App ID and Private Key in one call (2 calls → 1) - ConfigLoader.ts: fetch multiple matcher config paths in one call - ami.ts: batch resolve SSM parameter values for AMI lookups Also remove redundant appId SSM fetch in scale-up.ts that was only used for logging.

Copilot

Pull request overview

This PR optimizes AWS SSM API usage by implementing batch parameter fetching to reduce the number of API calls. The changes introduce a new getParameters() function that retrieves multiple SSM parameters in a single API call (with automatic chunking for AWS's 10-parameter limit) and applies this optimization across multiple Lambda functions.

Changes:

Added getParameters() function to aws-ssm-util for batch SSM parameter fetching with automatic chunking
Replaced sequential SSM calls with batch fetching in authentication, configuration loading, and AMI housekeeping
Removed redundant appId SSM fetch in scale-up.ts that was only used for logging

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
lambdas/libs/aws-ssm-util/src/index.ts	Implements new `getParameters()` function for batch SSM parameter retrieval
lambdas/functions/webhook/src/ConfigLoader.ts	Replaces sequential parameter fetching with batch call for matcher configs
lambdas/functions/webhook/src/ConfigLoader.test.ts	Updates tests to mock `getParameters()` instead of individual `getParameter()` calls
lambdas/functions/control-plane/src/scale-runners/scale-up.ts	Removes redundant appId SSM fetch used only for logging
lambdas/functions/control-plane/src/github/auth.ts	Batches App ID and Private Key fetching into single SSM call
lambdas/functions/control-plane/src/github/auth.test.ts	Updates tests to verify batch parameter fetching behavior
lambdas/functions/ami-housekeeper/src/ami.ts	Refactors to use batch parameter fetching for AMI SSM lookups
lambdas/functions/ami-housekeeper/src/ami.test.ts	Updates tests to use `GetParametersCommand` instead of `GetParameterCommand`

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

lambdas/functions/webhook/src/ConfigLoader.ts

lambdas/functions/control-plane/src/github/auth.ts

lambdas/functions/ami-housekeeper/src/ami.ts

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

lambdas/functions/webhook/src/ConfigLoader.test.ts:203

There are no tests verifying the behavior when one or more parameters are missing from the getParameters() response. The code at lines 110-117 handles this by adding an error to configLoadingErrors, but this path is not tested. Add a test case where getParameters() returns a Map with only some of the requested parameters to verify that appropriate error messages are added for the missing ones.

    it('should load config successfully from multiple paths', async () => {
      process.env.PARAMETER_RUNNER_MATCHER_CONFIG_PATH = '/path/to/matcher/config-1:/path/to/matcher/config-2';
      process.env.PARAMETER_GITHUB_APP_WEBHOOK_SECRET = '/path/to/webhook/secret';

      const partialMatcher1 =
        '[{"id":"1","arn":"arn:aws:sqs:queue1","matcherConfig":{"labelMatchers":[["a"]],"exactMatch":true}}';
      const partialMatcher2 =
        ',{"id":"2","arn":"arn:aws:sqs:queue2","matcherConfig":{"labelMatchers":[["b"]],"exactMatch":true}}]';

      const combinedMatcherConfig = [
        { id: '1', arn: 'arn:aws:sqs:queue1', matcherConfig: { labelMatchers: [['a']], exactMatch: true } },
        { id: '2', arn: 'arn:aws:sqs:queue2', matcherConfig: { labelMatchers: [['b']], exactMatch: true } },
      ];

      // Mock getParameters for batch fetching multiple paths
      vi.mocked(getParameters).mockResolvedValue(
        new Map([
          ['/path/to/matcher/config-1', partialMatcher1],
          ['/path/to/matcher/config-2', partialMatcher2],
        ]),
      );

      vi.mocked(getParameter).mockImplementation(async (paramPath: string) => {
        if (paramPath === '/path/to/webhook/secret') return 'secret';
        return '';
      });

      const config: ConfigWebhook = await ConfigWebhook.load();

      expect(config.matcherConfig).toEqual(combinedMatcherConfig);
      expect(config.webhookSecret).toBe('secret');
    });

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-16T16:26:49Z

lambdas/libs/aws-ssm-util/src/index.ts

+    const response = await ssmClient.send(
+      new GetParametersCommand({
+        Names: chunk,
+        WithDecryption: true,
+      }),
+    );


The function doesn't handle errors from individual chunk API calls. If one GetParametersCommand fails, the error will propagate and prevent the function from fetching subsequent chunks. This means that if you request 15 parameters and the first chunk of 10 fails, you won't get the remaining 5 parameters even if they would have succeeded.

Consider implementing error handling per chunk to continue fetching other chunks even if one fails, similar to how the ami.ts implementation handles this (lines 226-232 in the diff).

I don't think continuing processing other chunks after an error is the proper way to go here. If we can't fetch some of the SSM parameters, it's probably better to stop than to provide incomplete results.

lambdas/functions/control-plane/src/github/auth.test.ts

lambdas/libs/aws-ssm-util/src/index.ts

Copilot · 2026-02-16T16:26:50Z

lambdas/libs/aws-ssm-util/src/index.ts

+export async function getParameters(parameter_names: string[]): Promise<Map<string, string>> {
+  if (parameter_names.length === 0) {
+    return new Map();
+  }
+
+  const ssmClient = getTracedAWSV3Client(new SSMClient({ region: process.env.AWS_REGION }));
+  const result = new Map<string, string>();
+
+  // AWS SSM GetParameters API has a limit of 10 parameters per call
+  const chunkSize = 10;
+  for (let i = 0; i < parameter_names.length; i += chunkSize) {
+    const chunk = parameter_names.slice(i, i + chunkSize);
+    const response = await ssmClient.send(
+      new GetParametersCommand({
+        Names: chunk,
+        WithDecryption: true,
+      }),
+    );
+
+    for (const param of response.Parameters ?? []) {
+      if (param.Name && param.Value) {
+        result.set(param.Name, param.Value);
+      }
+    }
+  }
+
+  return result;
+}


The new getParameters() function lacks test coverage. The vitest configuration requires 100% test coverage for all code in lambdas/libs/, but no tests were added for this new function. Tests should cover:

Happy path with multiple parameters

Empty parameter list

Chunking behavior when more than 10 parameters are provided

Error handling when SSM API calls fail

Handling of missing parameters (InvalidParameters in response)

Behavior when some parameters exist and others don't

Copilot · 2026-02-16T16:26:50Z

lambdas/libs/aws-ssm-util/src/index.ts

+    for (const param of response.Parameters ?? []) {
+      if (param.Name && param.Value) {
+        result.set(param.Name, param.Value);
+      }
+    }
+  }


The getParameters() function silently ignores parameters that don't have both Name and Value. If a parameter exists but has no value, it will be missing from the returned Map without any error or warning. This differs from the getParameter() function which explicitly throws an error when a parameter is not found (line 15). Consider either:

Throwing an error if any requested parameters are not found in the response

Checking the InvalidParameters field in the response to identify missing parameters

At minimum, documenting this behavior in the function's JSDoc comment

This inconsistency could lead to subtle bugs where callers expect parameters to be present but receive an empty Map entry instead.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Brend-Smits · 2026-03-03T16:09:57Z

@thomasnemer this is great! Thanks a lot for your contribution.
Would you mind providing a quick test plan that maintainers can refer to in order to swiftly test your changes?
Also, please have a look at the remaining copilot feedback, and if not relevant or if you disagree, comment and resolve it.

Thank you!

thomasnemer requested a review from a team as a code owner February 4, 2026 13:03

Brend-Smits requested a review from Copilot February 5, 2026 12:33

Copilot AI reviewed Feb 5, 2026

View reviewed changes

lambdas/functions/webhook/src/ConfigLoader.ts Show resolved Hide resolved

lambdas/functions/control-plane/src/github/auth.ts Outdated Show resolved Hide resolved

lambdas/functions/ami-housekeeper/src/ami.ts Show resolved Hide resolved

fix: early fail auth when environment variables are not populated

88c8b44

thomasnemer requested a review from Copilot February 16, 2026 16:22

Copilot started reviewing on behalf of thomasnemer February 16, 2026 16:22 View session

Copilot AI reviewed Feb 16, 2026

View reviewed changes

Brend-Smits and others added 2 commits March 3, 2026 17:08

Apply suggestions from code review

57a9b0c

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into batch-ssm-parameter-get

ae7fd05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(lambdas): add batch SSM parameter fetching to reduce API calls#5017

feat(lambdas): add batch SSM parameter fetching to reduce API calls#5017
thomasnemer wants to merge 4 commits intogithub-aws-runners:mainfrom
thomasnemer:batch-ssm-parameter-get

thomasnemer commented Feb 4, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

thomasnemer Feb 19, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Brend-Smits commented Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

thomasnemer commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

thomasnemer Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Brend-Smits commented Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

thomasnemer commented Feb 4, 2026 •

edited

Loading