[localstack-platform]

This PR refreshes the LocalStack platform steps (between the # >>> localstack-platform markers) to match the project's current settings in job sam of .github/workflows/main.yml, for the platform project lambda-sam-authorizer. It was computed as a three-way merge onto the current file, so changes made since the adoption are kept.

[localstack-platform]

LocalStack PR Review — 🟡 YELLOW

• Critical or High security findings on changed resources: 2

Tested the deployed SAM application components including API Gateway, the custom Lambda authorizer, and the backend Lambda function. Verified that API Gateway endpoints enforce custom authorization by returning 401 Unauthorized for unauthenticated requests and 200 OK with backend responses for validly authorized requests. Direct Lambda function invocations for both authorizer and backend functions were also tested and confirmed operational.

Checks · 6 passed · 0 failed · 0 errored · 2 replaced

Check	Result	Expectation
check_api_gateway_routes	✅ passed	API Gateway REST API 5yhcc8gu64 should exist and be callable.
check_api_gateway_stages_and_invocation	↺ replaced by check_api_gateway_stages_and_invocation_v2 (errored)	API Gateway stage Prog or Prod exists and HTTP requests work.
check_env_vars	✅ passed	Check env vars to find LocalStack endpoint.
check_api_gateway_stages_and_invocation_v2	✅ passed	API Gateway endpoint responds appropriately when unauthenticated vs authenticated.
check_auth_lambda_function	✅ passed	MyAuthFunction lambda function can be invoked and returns an authorization policy.
check_api_gateway_auth_success	↺ replaced by check_api_gateway_auth_success_v2 (errored)	API Gateway request with Authorization header 'allow' succeeds.
check_api_gateway_auth_success_v2	✅ passed	API Gateway request with Authorization header 'allow' succeeds and returns 'hello world'.
check_my_function_lambda	✅ passed	MyFunction lambda function can be invoked directly and returns expected body.

Security scan · 15 on changed resources

Severity	Check	Resource	Finding
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyAuthFunctionRole-64ea3ac9	IAM Service Role sam-app-MyAuthFunctionRole-64ea3ac9 does not prevent against a cross-service confused deputy attack.
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyFunctionRole-a9eed0ab	IAM Service Role sam-app-MyFunctionRole-a9eed0ab does not prevent against a cross-service confused deputy attack.
Medium	apigateway_restapi_public	sam-app-MyApi-96b6fb05	API Gateway sam-app-MyApi-96b6fb05 ID 5yhcc8gu64 is internet accessible.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyAuthFunction-aad6b410	Lambda function sam-app-MyAuthFunction-aad6b410 does not have a Dead Letter Queue configured.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyFunction-473de1a0	Lambda function sam-app-MyFunction-473de1a0 does not have a Dead Letter Queue configured.
Medium	s3_bucket_no_mfa_delete	aws-sam-cli-managed-default-samclisourcebucket-d6f38137	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-d6f38137 has MFA Delete disabled.
Medium	s3_bucket_server_access_logging_enabled	aws-sam-cli-managed-default-samclisourcebucket-d6f38137	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-d6f38137 has server access logging disabled.
Low	awslambda_function_inside_vpc	sam-app-MyAuthFunction-aad6b410	Lambda function sam-app-MyAuthFunction-aad6b410 is not inside a VPC
Low	awslambda_function_inside_vpc	sam-app-MyFunction-473de1a0	Lambda function sam-app-MyFunction-473de1a0 is not inside a VPC
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyAuthFunction-aad6b410	Lambda function sam-app-MyAuthFunction-aad6b410 is not recorded by CloudTrail.
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyFunction-473de1a0	Lambda function sam-app-MyFunction-473de1a0 is not recorded by CloudTrail.
Low	s3_bucket_cross_region_replication	aws-sam-cli-managed-default-samclisourcebucket-d6f38137	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-d6f38137 does not have correct cross region replication configuration.
Low	s3_bucket_event_notifications_enabled	aws-sam-cli-managed-default-samclisourcebucket-d6f38137	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-d6f38137 does not have event notifications enabled.
Low	s3_bucket_lifecycle_enabled	aws-sam-cli-managed-default-samclisourcebucket-d6f38137	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-d6f38137 does not have a lifecycle configuration enabled.
Low	s3_bucket_object_lock	aws-sam-cli-managed-default-samclisourcebucket-d6f38137	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-d6f38137 has Object Lock disabled.

LocalStack infrastructure diff: +6 added · ~0 modified · −6 removed · 4 services

✅ passed · Run #20 · localstack/adopt-update-proj_b1e4056f → main @ edba22b · vs latest main run

✨ This change primarily reflects an update to the SAM application, likely due to a code change or dependency update. The sam-app-MyFunction and sam-app-MyAuthFunction Lambda functions, along with their associated IAM roles (sam-app-MyFunctionRole and sam-app-MyAuthFunctionRole), have been replaced, indicated by the removal of old versions and addition of new ones. Similarly, the API Gateway (apigateway) and the SAM CLI's managed S3 source bucket (aws-sam-cli-managed-default-samclisourcebucket) have also been recreated, suggesting a full redeployment of the SAM application.

API Gateway · +1 added · −1 removed

+ 5yhcc8gu64 (AWS::ApiGateway::RestApi · us-east-1)
- sxubeouyk5 (AWS::ApiGateway::RestApi · us-east-1)

IAM · +2 added · −2 removed

+ sam-app-MyAuthFunctionRole-64ea3ac9 (AWS::IAM::Role · global)
+ sam-app-MyFunctionRole-a9eed0ab (AWS::IAM::Role · global)
- sam-app-MyAuthFunctionRole-a33f7b68 (AWS::IAM::Role · global)
- sam-app-MyFunctionRole-aab6c142 (AWS::IAM::Role · global)

Lambda · +2 added · −2 removed

+ sam-app-MyFunction-473de1a0 (AWS::Lambda::Function · us-east-1)
+ sam-app-MyAuthFunction-aad6b410 (AWS::Lambda::Function · us-east-1)
- sam-app-MyFunction-f3e70302 (AWS::Lambda::Function · us-east-1)
- sam-app-MyAuthFunction-146f4f3e (AWS::Lambda::Function · us-east-1)

S3 · +1 added · −1 removed

+ aws-sam-cli-managed-default-samclisourcebucket-d6f38137 (AWS::S3::Bucket · global)
- aws-sam-cli-managed-default-samclisourcebucket-2fb53492 (AWS::S3::Bucket · global)

_{View run in LocalStack · Open sandbox · updated for edba22b at 2026-10-25T04:28:44Z}