Salesforce is retiring the OAuth 2.0 username-password flow (Winter '27) — Lambdas will fail to authenticate

[umruumum]

Summary

The Salesforce Lambdas authenticate to the Salesforce REST API using the OAuth 2.0
username-password flow (ROPC). Salesforce is retiring this flow for connected apps as a
Release Update enforced in Winter '27, and it is already blocked by default in newly
created orgs. Once enforcement reaches an org, /services/oauth2/token will stop
returning an access token and every Lambda in this package will fail to authenticate.

I'd like to ask what the plan is for migrating this package to a supported flow.

Affected code

sam-app/lambda_functions/salesforce.py (master, 96579b7):

• L51-56 — the token request payload:

  self.auth_data = {
    'grant_type': 'password',
    'client_id': self.consumer_key,
    'client_secret': self.consumer_secret,
    'username': self.username,
    'password': self.password
  }

• L64 — self.password = self.secrets["Password"] + self.secrets["AccessToken"]
  (API user password concatenated with the security token)
• L206 — POST {login_host}/services/oauth2/token with the payload above, on
  InvalidAuthTokenException

Related documentation

The CTI Adapter installation guide currently instructs admins to configure this flow:
https://amazon-connect.github.io/amazon-connect-salesforce-cti/docs/classic/installation/02-guided-setup#setting-up-the-salesforce-api-user

• "Allowing the API user to authenticate using password" tells admins to enable
  Allow OAuth Username-Password Flows, which is exactly the setting being retired.
• "Setting up the Salesforce API User" step 11 tells admins to set the API user's
  password to Never expires.
• The Secrets Manager secret schema requires Password and AccessToken keys, which
  only exist to support this flow.

References

• Salesforce Retirement of OAuth 2.0 Username-Password Flow:
  https://help.salesforce.com/s/articleView?id=005388592&type=1
• Release Update — Retirement of OAuth 2.0 Username-Password Flow for Connected Apps:
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security_unpw_flow_retirement.htm&release=262&type=5

Suggested direction

Since the Lambdas are a server-to-server integration with no end-user context, the
OAuth 2.0 client credentials flow looks like the natural replacement:

• grant_type=client_credentials with the Connected App / External Client App's
  consumer key and secret, and a designated "run as" integration user.
• The Password and AccessToken keys in the Secrets Manager secret would no longer
  be needed, removing the stored user password and security token entirely.
• The existing token caching in Secrets Manager (makeRequest) can stay as-is; only
  the payload and the secret schema change.

JWT bearer flow would be an alternative if key-based auth is preferred, though it
requires certificate management in the deployment.

Questions

1. Is a migration already planned or in progress for a future release?
2. If so, which flow are you targeting (client credentials vs JWT bearer)?
3. Will the Secrets Manager secret schema change, and will there be a documented
   upgrade path for existing deployments (i.e. can existing installs migrate without
   re-running the full installation)?
4. Is a community PR welcome for this, or would you prefer to handle it in-house?

Environment

• Repo: master @ 96579b7
• CTI Adapter docs version: v5.31 (Classic / Lightning both affected)