sqs | SQS client | AWS library

I would aim for the process which requires the least complexity / smallest changes to your Lambda. You could use the AWS SDK to enable / disable your Lambda's subscription, rather than actually deleting and recreating it. See this question on how to do so and specifically the enabled parameter in the updateEventSourceMapping() method in the docs it links to:

Enabled — (Boolean)

When true, the event source mapping is active. When false, Lambda pauses polling and invocation.

Default: True

The advantage is that the only thing you're changing is the enabled flag - everything else (the SQS-Lambda subscription, if you will) is unchanged.

This approach still has the danger that if the enabler/disabler lambda(s) fail, your processing will not occur during your target hours. Particularly, I'm not personally super confident in the success rate of AWS's self-mutating commands - this might just be my bias, but it definitely leans toward "infra changes tend to fail more often than regular AWS logic".

It's worth considering whether you really need this implementation, or whether the time-based aggregation can be done on the results (e.g., let this Lambda processing run on events as they come in and write the output to some holding pen, then at Xpm when you trust all events have come in, move the results for today from the holding pen into your main output).

This approach may be safer, in that a failed trigger on the "moving" step could be easier / faster to recover from than a failed trigger on the above "process all my data now" step, and it would not depend on changing the Lambda definition.

Your custom bus will not receive any "aws.ssm" events. All aws.* are going to default bus only. The custom bus can only receive custom events from your application, e.g.:

I figured it out. You better not hold anything in your mouth, because this is hilarious!

Basically being all out of options, I locked on to the last discernible difference between this deployment and the ones that worked: The filesize of the jar being deployed. The one that failed was by far the smallest. So I bloated it up by some 60% to make it comparable to everything else... and that fixed it!

This sounds preposterous. Here's my hypothesis on what's going on: If the upload takes too little time, the lambda somehow needs longer to change its state. I'm not sure why that would be, you'd expect the state to change when things are done, not to take longer if things are done faster, right? Maybe there's a minimum time for the state to remain? I wouldn't know. There's one thing to support this hypothesis, though: The deployment from my local computer always worked. That upload would naturally take longer than jenkins needs from inside the aws vpc. So this hypothesis, as ludicrous as it sounds, fits all the facts that I have on hand.

Maybe somebody with a better understanding of the lambda-internal mechanisms can add a comment to this explaining how this can happen...

I have checked with a Snowflake representative - irrespective of MONITOR and OPERATE privileges, if you want to use /insertReport, you must have OWNERSHIP of the pipe.

The permissions and features found here https://docs.snowflake.com/en/release-notes/2021-03.html#snowpipe-support-for-non-pipe-owners-to-manage-pipes-preview do not mention /insertReport at all. You can let a sub-role start/pause/load/read/check (via SQL) a pipe, but there are no privileges that let non-owners use /insertReport.

It's always tricky to use SQS with Lambda (concurrency limit configured) because in short, is not gonna work, instead, you will get some throttling records because the lambda can't process messages limited by the concurrency.

You can check this article which explains the why and a workaround solution : https://zaccharles.medium.com/lambda-concurrency-limits-and-sqs-triggers-dont-mix-well-sometimes-eb23d90122e0

check also this AWS documentation for further information about this subject https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-queueconfig

const sqsInterval is scoped inside try{ }. Declare it outside with let

For standard uses cases you do not have to actively manage success-failure communication between lambda and SQS. If the lambda returns without error within the timeout period, SQS will know the message was successfully processed. If the function returns an error, then SQS will retry a configurable number of times and finally direct still-failing messages to a Dead Letter Queue (if configured).

Docs: Amazon SQS supports dead-letter queues, which other queues (source queues) can target for messages that can't be processed (consumed) successfully.

Important: Add your DLQ to the SQS queue, not the Lambda. Lambda DLQs are a way to handle errors for async (event-driven) invocation.

Here is the benchmarking for the existing to OP's question (borrow test data from @Marek Fiołka but with n <- 10000)

This appears to be a bug in Poetry. Or at least it's not clear from the documentation what the expected behavior would be in a case such as yours.

In your pyproject.toml, you specify two dependencies as required in this section: