Module token 

Idempotency tokens, unique per attempt by construction (TRAP-1).

What a clientToken actually is

A permanent idempotency key, not a request deduplication window. Measured 2026-08-02, the expensive way: delete an image, recreate it from the same bytes under the same name with a token derived from that identity, and the service replays the original create as a no-op. The image then sits in CREATING with its builds never scheduled, cannot be deleted (CREATING forbids it), and its only version cannot be dropped either (it is the last one). Two images were wedged that way for roughly fifteen hours.

Fresh defaults and explicit launch recovery

The previous Python shape defaulted correctly and accepted client_token=<content digest> — which is precisely the value that wedges an image, offered as the natural thing to pass. Image creation still forbids caller tokens: create_token and run_token take a scope label and mint the token themselves. A label lands next to the nonce and can never replace it.

Run requests additionally accept a persisted client_token for recovery after a lost launch response. That opt-in must identify exactly one launch with identical inputs. A new VM needs a new key, even when its image and other parameters are unchanged.

The shape, and which end gets truncated

<verb>-<label>-<16 hex>, with verb one of create or run and the nonce eight bytes of fresh randomness rendered as sixteen hex characters.

The label is truncated to its tail, not its head: run’s scope defaults to the image identifier, which is a full ARN, and an ARN’s distinguishing part is the resource name at the end while every ARN in a region shares its prefix. Truncating the head would collapse two different images onto one label.

The nonce is never truncated. That ordering is the whole property: a shortened label cannot make two attempts collide, because collision-freedom lives entirely in the sixteen hex characters and the truncation happens before them. Found 2026-08-07 by the drift checker’s coverage report naming RunMicrovmRequestClientTokenString as unbound — an ap-northeast-1 ARN carrying a legal 64-character image name mints a 142-character token, over the 128 ceiling, and botocore does not check max, so it would have gone to the wire and failed a launch on a field the caller never set.

Functions

create_token

An image-create idempotency token, unique per attempt.

run_token

A run idempotency token, unique per attempt. Same rule as create_token.