(lambda-python): document that not using a lockfile will not allow transitive dependencies to be updated

[zxkane]

Built a lambda layer for python runtime, the source is not changed. However the asset artifact is changed after rebuilding it. The cdk deploy(or cdk-assets) does not upload the newer asset file to stage bucket without any warning.

Reproduction Steps

create a python lambda layer like below,

Has a requirements.txt like below,

awswrangler == 2.4.0

Then build a python layer from above requirements.txt,

        new PythonLayerVersion(this, 'AwsDataWranglerLayer', {
          entry: path.join(__dirname, '../lambda.d/layer.d/awswrangler'),
          compatibleRuntimes: [Runtime.PYTHON_3_8],
        }),

The lambda layer might be varied when one dependency of awswrangler is updated(such as six). The lambda layer zip might be changed, but the hash still is same(the requirements.txt is not changed).

While the asset artifact is cached in stage bucket of cdk, the newer lambda layer won’t be uploaded to stage bucket again.

What did you expect to happen?

• upload the new asset artifact if the size(hash sum) is changed

or

• print out the warning message if the assets system finds the cached one and local one are inconsistent

What actually happened?

Environment

• CDK CLI Version : v1.102.0
• Framework Version:
• Node.js Version: v12.21.0
• OS :
• Language (Version): ts

Other

---

This is 🐛 Bug Report

[eladb]

The Python bundling system identifies a bundle based on the hash of the sources and not the hash of the artifact because pip produces a non-stable output (contains timestamps I believe). If we used artifact hashes, every build would have produced a different output, which means that assets will always be validated.

The recommended solution is commit a lock file, which will be included as part of the source hash calculation. I am not 100% sure what's the best way to do that if you just use requirements.txt, but both poetry and pipenv support lockfiles and I would recommend using them as a way to ensure you get a stable output.

I am repurposing this issue to expand about this in our documentation.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.