[localstack-platform]

This moves the LocalStack in job sam of .github/workflows/main.yml from a Docker container on the runner to a hosted LocalStack sandbox, managed by the LocalStack platform project lambda-sam-authorizer. Everything else in the job runs as before and still reaches LocalStack on localhost:4566.

What changes in .github/workflows/main.yml

• Removes the LocalStack start command and its step
• Starts LocalStack in a platform sandbox (every run)
• Reads the sandbox's LocalStack log with lstk-project logs
• Reports the run and releases the sandbox (if: always())

Nothing outside job sam changes. The steps between the # >>> localstack-platform and # <<< localstack-platform comments belong to the platform: "Update CI workflow" on the project page refreshes them.

What you get

• A fresh sandbox for every run (push, pull request, schedule)
• On pull requests: an agent review with checks, IAM findings and the infrastructure diff, posted on the PR
• On the default branch: the project's Cloud Pod and the baseline future PRs are diffed against

Before merging

• Add the LOCALSTACK_PLATFORM_AUTH_TOKEN repository secret: a CI key from the LocalStack workspace that owns the project (the project page can add it for you). The job fails without it, including on pull requests from forks, which get no secrets.
• LocalStack settings imported into the project: none
• Not carried over:
  • LOCALSTACK_AUTH_TOKEN: the platform passes the project's token
• The sandbox runs the platform's current LocalStack Pro.

To undo this later, use "Revert adoption" on the project page; it opens a PR that restores the job's own LocalStack startup and keeps your other edits.

[localstack-platform]

LocalStack PR Review — 🟡 YELLOW

• Critical or High security findings on changed resources: 2

Verified the SAM application deployed to the LocalStack sandbox, including the API Gateway REST API, Lambda functions, and custom token authorizer. Directly invoked both the main Lambda function and authorizer function to confirm successful execution. Tested the public HTTP API Gateway endpoint with authorized, unauthorized, and missing token headers to verify routing and custom authorizer behavior.

Checks · 5 passed · 0 failed · 0 errored · 2 replaced

Check	Result	Expectation
check_apigateway_structure	↺ replaced by check_apigateway_structure_v2 (errored)	API Gateway rest API zqwvxiexvt exists and has resources/stages configured.
check_apigateway_structure_v2	↺ replaced by check_apigateway_structure_v3 (errored)	API Gateway rest API zqwvxiexvt exists and has resources/stages configured.
check_apigateway_structure_v3	✅ passed	API Gateway rest API zqwvxiexvt exists and has resources/stages configured.
check_apigateway_authorizer	✅ passed	API Gateway authorizers exist and are configured for rest API zqwvxiexvt.
check_lambda_direct_invocation	✅ passed	Lambda functions sam-app-MyFunction-a0b42da7 and sam-app-MyAuthFunction-0509bebc execute successfully when invoked directly.
check_apigateway_http_endpoint	✅ passed	API Gateway endpoint is accessible via HTTP request with valid Authorization header.
check_apigateway_unauthorized	✅ passed	API Gateway endpoint returns 401 or 403 when authorization header is missing or denied.

Security scan · 15 on changed resources

Severity	Check	Resource	Finding
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyAuthFunctionRole-be532c0c	IAM Service Role sam-app-MyAuthFunctionRole-be532c0c does not prevent against a cross-service confused deputy attack.
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyFunctionRole-fddfb687	IAM Service Role sam-app-MyFunctionRole-fddfb687 does not prevent against a cross-service confused deputy attack.
Medium	apigateway_restapi_public	sam-app-MyApi-2a783ce3	API Gateway sam-app-MyApi-2a783ce3 ID zqwvxiexvt is internet accessible.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyAuthFunction-0509bebc	Lambda function sam-app-MyAuthFunction-0509bebc does not have a Dead Letter Queue configured.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyFunction-a0b42da7	Lambda function sam-app-MyFunction-a0b42da7 does not have a Dead Letter Queue configured.
Medium	s3_bucket_no_mfa_delete	aws-sam-cli-managed-default-samclisourcebucket-74eeb82d	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-74eeb82d has MFA Delete disabled.
Medium	s3_bucket_server_access_logging_enabled	aws-sam-cli-managed-default-samclisourcebucket-74eeb82d	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-74eeb82d has server access logging disabled.
Low	awslambda_function_inside_vpc	sam-app-MyAuthFunction-0509bebc	Lambda function sam-app-MyAuthFunction-0509bebc is not inside a VPC
Low	awslambda_function_inside_vpc	sam-app-MyFunction-a0b42da7	Lambda function sam-app-MyFunction-a0b42da7 is not inside a VPC
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyAuthFunction-0509bebc	Lambda function sam-app-MyAuthFunction-0509bebc is not recorded by CloudTrail.
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyFunction-a0b42da7	Lambda function sam-app-MyFunction-a0b42da7 is not recorded by CloudTrail.
Low	s3_bucket_cross_region_replication	aws-sam-cli-managed-default-samclisourcebucket-74eeb82d	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-74eeb82d does not have correct cross region replication configuration.
Low	s3_bucket_event_notifications_enabled	aws-sam-cli-managed-default-samclisourcebucket-74eeb82d	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-74eeb82d does not have event notifications enabled.
Low	s3_bucket_lifecycle_enabled	aws-sam-cli-managed-default-samclisourcebucket-74eeb82d	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-74eeb82d does not have a lifecycle configuration enabled.
Low	s3_bucket_object_lock	aws-sam-cli-managed-default-samclisourcebucket-74eeb82d	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-74eeb82d has Object Lock disabled.

First infrastructure snapshot captured

✅ passed · Run #3 · localstack/adopt-proj_b1e4056f → main @ 3ee97b6

6 resources across 4 services. Future runs will diff against main.

Snapshot inventory

• IAM · 2
• Lambda · 2
• API Gateway · 1
• S3 · 1

_{View run in LocalStack · Open sandbox · updated for 3ee97b6 at 2026-10-24T18:26:02Z}