500 Status Code When Using DownloadSensorInstallerById in AWS Lambda

[AMMullan]

I've got a script that downloads the latest CrowdStrike Sensors and it works flawlessly on both my laptop running Python 3.9 and a docker container running Python 3.8 but when I use the DownloadSensorInstallerById in Lambda, I get a dict returned with a 500 status code (exact response is {'status_code': 500, 'headers': {}, 'body': {'errors': [{'message': ''}], 'resources': []}})

Does anyone know of any reason that this wouldn't work in Lambda? It's just a Python 3.8 function and I can confirm that all details up until the call are absolutely identical (aside from the access token obviously).

[jshcodes]

We definitely have examples of FalconPy being used successfully within a Lambda.

Are you including FalconPy as a layer? (A helper script for generating a zip for this can be found here).

Can you log some additional output to CloudWatch? (Confirm you're getting authenticated to the API, etc.)

[AMMullan]

I can guarantee I'm authenticated as I'm running GetCombinedSensorInstallersByQuery before this query and I can loop through the resources that come back from this - it's purely just the DownloadSensorInstallerById that is throwing the 500 error.

[jshcodes]

Can you sanitize and share some of your code? I can try and recreate the issue to see if I can help troubleshoot.

[AMMullan]

Ah, found the problem when trying to simplify this whole thing for sharing... I had set max memory to 128mb but setting it to 256 fixed the problem :) Bit of a strange one as would have expected the whole function to fall over rather than return a dict with a 500 status code.

[jshcodes]

That is a little weird. I'm going to try and recreate this to see if I can't catch an example.

Glad you solved it! 😄