Lambda SnapStart for Python: Pitfalls Beyond the Java Marketing

# GOOD: import-heavy work before snapshot; network after restore
import json
import boto3
from aws_lambda_powertools import Logger

logger = Logger()
# Pure CPU priming OK
_SCHEMA = json.loads(open("schema.json").read())

# BAD: open connections at import — snapshotted FDs die on restore
# _s3 = boto3.client("s3") # tempting; often wrong with SnapStart
_s3 = None

def _client():
 global _s3
 if _s3 is None:
 _s3 = boto3.client("s3")
 return _s3

def handler(event, context):
 return _client().list_buckets()

import os
import random
import secrets
from pathlib import Path

def _on_restore():
 # Re-seed Python PRNG; prefer secrets for security-sensitive tokens
 random.seed(secrets.token_bytes(32))
 # Force credential refresh — snapshotted STS tokens may be expired
 os.environ.pop("AWS_SESSION_TOKEN_SNAPSHOT_MARKER", None)
 # Clear any cached ephemeral files that assumed /tmp uniqueness
 for p in Path("/tmp").glob("snap-*"):
 p.unlink(missing_ok=True)

# Register with the SnapStart runtime hook API for Python when enabled
try:
 from snapshot_restore_py import register_after_restore # illustrative name
 register_after_restore(_on_restore)
except ImportError:
 pass # local unit tests without SnapStart

# CI matrix must exercise SnapStart restore on the SAME arch as prod (arm64 vs x86_64)
# Native wheels compiled without snap-safe assumptions can SEGV on restore.

# GOOD: integration test that forces restore path
aws lambda invoke --function-name orders:snaplive --payload '{}' out.json

# BAD: only measuring cold Init with SnapStart disabled in staging