Cryptography: Importing module fails on AWS Lambda running Python 3.6

[harryowens]

I'm having a problem using the cryptography package in a serverless deployment on AWS Lambda (using the Python 3.6 environment).

I'm getting the error Unable to import module 'handlers/users': No module named '_cffi_backend'

I can't seem to work around it by including any additional modules in my requirements.txt so that pip can satisfy the dependencies.

I understand there are issues with cffi in Python 3.6 - is this a barrier to using cryptography with this python version?

Packages:
Python 3.6
cryptography 2.2.2
cffi 1.11.5
pip 10.0.0
pyOpenSSL 17.5.0

cryptography, cffi and pyopenssl included in requirements.txt and installed using pip install -t /path/to/folder -r requirements.txt

[alex]

What platform are you running pip install -t on?

[harryowens]

pip install -t is being run on my Ubuntu 16.04 development box on AWS.

[harryowens]

Perhaps another way of posing the question - is it possible to satisfy the dependencies of cryptography in a Python 3.6 environment using only pip requirements or do I need to satisfy dependencies in another way (which is clearly more difficult in a serverless / AWS Lambda context)?

[alex]

I'm not aware of any general issues with cryptography and Python 3.6. I
suspect the underlying problem here is related to Lambda. I'd recommend
building your packages for Lambda on something closer to the Lamba
environment (e.g. an AWS Linux VM).

On Thu, May 10, 2018 at 9:33 AM h3nry0 [e-mail] wrote:

Perhaps another way of posing the question - is it possible to satisfy the
dependencies of cryptography in a Python 3.6 environment using only pip
requirements or do I need to satisfy dependencies in another way (which is
clearly more difficult in a serverless / AWS Lambda context)?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/pyca/cryptography/issues/4223#issuecomment-388054343,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAADBFwNzIEVvuZ059DsIw5oqIZpw-Eaks5txEGlgaJpZM4T5yyS
.

--
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: D1B3 ADC0 E023 8CA6

[reaperhulk]

I use cryptography in lambda at $work every day so it definitely works. You'll need to build your site-packages with the right env (Amazon Linux docker container) or unpack the manylinux1 wheels yourself though.

[shiroyuki]

@reaperhulk If I understand you correctly, suppose the code is developed on MacOS. To have it work on AWS, I would have to install deps (i.e., build the site-packages) on a Linux environment. Is that accurate?

[reaperhulk]

@shiroyuki you can build it yourself in a docker container, yes, but you should also be able to just unpack and use the manylinux1 x86-64 wheels. Amazon Linux is manylinux1 compatible.

[shiroyuki]

@reaperhulk Thank you for clarification. :)

[husseinkohy]

also important is how you installed python. if through brew you will need to package resources using a virtual env. check here:

https://docs.aws.amazon.com/lambda/latest/dg/lambda-python-how-to-create-deployment-package.html

[gokriznastic]

As pointed by @reaperhulk building the packages on Amazon Linux AMI solved this issue for me. I used the Python 3.7 runtime on both Lambda and the AWS instance.