Bug: VPC Lattice requests with a query string return 404 in VPCLatticeResolver and VPCLatticeV2Resolver #8571

Expected Behaviour

VPCLatticeResolver and VPCLatticeV2Resolver should route a request like POST /echo?QS1=value1 to the handler registered with @app.post("/echo"), as the other resolvers do.

event.path should be the URL path without the query string, as it is for REST API, HTTP API, Lambda Function URL and ALB events, and the query string should stay available, parsed, in event.query_string_parameters.

Current Behaviour

Every VPC Lattice request that carries a query string returns 404 Not found, on both resolvers.

Why:

• VPC Lattice puts the query string inside the request path (raw_path in V1, path in V2) and also sends it parsed (query_string_parameters / queryStringParameters).
• VPCLatticeEvent.path returns raw_path as-is, and VPCLatticeEventV2 inherits BaseProxyEvent.path, which returns path as-is.
• The resolver matches that value against anchored route regexes (^/echo$), so /echo?QS1=value1 never matches.

Dynamic routes (/orders/<order_id> with /orders/42?expand=items), strip_prefixes and Swagger UI's /swagger?format=json fail the same way.

Evidence that VPC Lattice sends the query string in the path:

• AWS VPC Lattice User Guide, Lambda functions as targets in VPC Lattice:
  • V1 example: "raw_path": "/path/to/resource?query1=value1&query2=value2".
  • V2 example: "path": "/?query1=value1&query2=value2", described as "The path of the request from the client that includes query string parameters."
• AWS Compute Blog, Building private serverless APIs with AWS Lambda and Amazon VPC Lattice: the sample event has "raw_path": "/points?action=add" with "query_string_parameters": {"action": "add"}.
• aws-powertools/powertools-lambda-typescript#5764: an event captured from a live V2 target group in eu-west-1 has path: '/echo?QS1=value1&QS1=value2&single=one'.

The repo fixtures tests/events/vpcLatticeEvent.json and tests/events/vpcLatticeV2Event.json don't have the query string in the path, so the existing tests pass.

Code snippet

from aws_lambda_powertools.event_handler import VPCLatticeResolver, VPCLatticeV2Resolver

app_v2 = VPCLatticeV2Resolver()


@app_v2.post("/echo")
def echo():
    return {"query": app_v2.current_event.query_string_parameters}


# Trimmed from the event captured on a live V2 target group (powertools-lambda-typescript#5764)
event_v2 = {
    "version": "2.0",
    "path": "/echo?QS1=value1&QS1=value2&single=one",
    "method": "POST",
    "headers": {"content-type": ["application/json"]},
    "queryStringParameters": {"QS1": ["value1", "value2"], "single": ["one"]},
    "body": '{"hello":"world"}',
}

app_v1 = VPCLatticeResolver()


@app_v1.put("/points")
def points():
    return {"action": app_v1.current_event.query_string_parameters["action"]}


# V1 event shape from the AWS Compute Blog post
event_v1 = {
    "raw_path": "/points?action=add",
    "method": "PUT",
    "headers": {"content-type": "application/json"},
    "query_string_parameters": {"action": "add"},
    "body": "",
    "is_base64_encoded": False,
}

print("V2:", app_v2.resolve(event_v2, {})["statusCode"])  # 404, expected 200
print("V1:", app_v1.resolve(event_v1, {})["statusCode"])  # 404, expected 200

Possible Solution

Strip the query string in the data classes, which are the source of truth for routing, strip_prefixes, Swagger and user code:

• VPCLatticeEvent.path: return self["raw_path"].partition("?")[0]
• VPCLatticeEventV2: add a path property with return self["path"].partition("?")[0]

VPCLatticeEvent.raw_path stays unchanged. Per RFC 3986 the first ? always starts the query, so an encoded %3F stays in the path. I have a fix with tests and will open a PR for it.

Steps to Reproduce

1. Run the snippet above. The V2 event is the one captured from a live target group in powertools-lambda-typescript#5764, and the V1 event follows the shape in the AWS docs and blog post.
2. Both resolvers return 404 Not found. The same events without the query string in the path return 200.

In a deployment, this is any request with a query string sent to a Lambda target behind a VPC Lattice service, with either event structure version.

Powertools for AWS Lambda (Python) version

latest (3.36.0)

AWS Lambda function runtime

3.14 (not runtime-specific)

Packaging format used

PyPi

Debugging logs

aws_lambda_powertools.event_handler.api_gateway [DEBUG] Converting event to VPC LatticeV2 contract
aws_lambda_powertools.event_handler.api_gateway [DEBUG] No match found for path /echo?QS1=value1&QS1=value2&single=one and method POST
aws_lambda_powertools.event_handler.api_gateway [DEBUG] Converting event to VPC Lattice contract
aws_lambda_powertools.event_handler.api_gateway [DEBUG] No match found for path /points?action=add and method PUT