Module token 

Idempotency tokens, unique per attempt by construction (TRAP-1).

What a clientToken actually is

A permanent idempotency key, not a request deduplication window. Measured 2026-08-02, the expensive way: delete an image, recreate it from the same bytes under the same name with a token derived from that identity, and the service replays the original create as a no-op. The image then sits in CREATING with its builds never scheduled, cannot be deleted (CREATING forbids it), and its only version cannot be dropped either (it is the last one). Two images were wedged that way for roughly fifteen hours.

Why there is no way to pass one

The previous Python shape defaulted correctly and accepted client_token=<content digest> — which is precisely the value that wedges an image, offered as the natural thing to pass. So the closure here is the absence of the parameter: create_token and run_token take a scope label and mint the token themselves. A label lands next to the nonce and can never replace it.

That is the difference between a default a caller can override and a mistake a caller cannot write. grep for client_token across this module’s public surface finds nothing, and the test at the bottom of this file asserts the label cannot reach the nonce’s position no matter what is passed.

The shape, and which end gets truncated

<verb>-<label>-<16 hex>, with verb one of create or run and the nonce eight bytes of fresh randomness rendered as sixteen hex characters.

The label is truncated to its tail, not its head: run’s scope defaults to the image identifier, which is a full ARN, and an ARN’s distinguishing part is the resource name at the end while every ARN in a region shares its prefix. Truncating the head would collapse two different images onto one label.

The nonce is never truncated. That ordering is the whole property: a shortened label cannot make two attempts collide, because collision-freedom lives entirely in the sixteen hex characters and the truncation happens before them. Found 2026-08-07 by the drift checker’s coverage report naming RunMicrovmRequestClientTokenString as unbound — an ap-northeast-1 ARN carrying a legal 64-character image name mints a 142-character token, over the 128 ceiling, and botocore does not check max, so it would have gone to the wire and failed a launch on a field the caller never set.

Functions

create_token

An image-create idempotency token, unique per attempt.

run_token

A run idempotency token, unique per attempt. Same rule as create_token.