[localstack-platform]

This PR refreshes the LocalStack platform steps (between the # >>> localstack-platform markers) to match the project's current settings in job sam of .github/workflows/main.yml, for the platform project lambda-sam-authorizer. It was computed as a three-way merge onto the current file, so changes made since the adoption are kept.

[localstack-platform]

LocalStack PR Review — 🟡 YELLOW

• Critical or High security findings on changed resources: 2

Tested the deployed SAM application in the LocalStack sandbox, including the API Gateway REST API and its custom Lambda authorizer. Requests with valid authorization ('allow') correctly passed authorization and returned 'hello world' from the backend Lambda function, while unauthorized or denied requests returned HTTP 401 and 403 status codes. Direct invocations of both the backend and authorizer Lambda functions also succeeded as expected.

Checks · 3 passed · 0 failed · 0 errored

Check	Result	Expectation
test_apigateway_authorizer	✅ passed	API Gateway REST API should be deployed and respond to requests with appropriate authorization.
test_apigateway_authorizer_deny	✅ passed	API Gateway REST API should reject requests when authorizer returns deny header or invalid token.
test_lambda_direct_invocation	✅ passed	Lambda functions should be directly invokable and return successful responses.

Security scan · 15 on changed resources

Severity	Check	Resource	Finding
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyAuthFunctionRole-3a194992	IAM Service Role sam-app-MyAuthFunctionRole-3a194992 does not prevent against a cross-service confused deputy attack.
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyFunctionRole-f65e7aec	IAM Service Role sam-app-MyFunctionRole-f65e7aec does not prevent against a cross-service confused deputy attack.
Medium	apigateway_restapi_public	sam-app-MyApi-ed21aa47	API Gateway sam-app-MyApi-ed21aa47 ID qkh6cdfec1 is internet accessible.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyAuthFunction-44b575d8	Lambda function sam-app-MyAuthFunction-44b575d8 does not have a Dead Letter Queue configured.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyFunction-1efa0e60	Lambda function sam-app-MyFunction-1efa0e60 does not have a Dead Letter Queue configured.
Medium	s3_bucket_no_mfa_delete	aws-sam-cli-managed-default-samclisourcebucket-b8475127	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-b8475127 has MFA Delete disabled.
Medium	s3_bucket_server_access_logging_enabled	aws-sam-cli-managed-default-samclisourcebucket-b8475127	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-b8475127 has server access logging disabled.
Low	awslambda_function_inside_vpc	sam-app-MyAuthFunction-44b575d8	Lambda function sam-app-MyAuthFunction-44b575d8 is not inside a VPC
Low	awslambda_function_inside_vpc	sam-app-MyFunction-1efa0e60	Lambda function sam-app-MyFunction-1efa0e60 is not inside a VPC
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyAuthFunction-44b575d8	Lambda function sam-app-MyAuthFunction-44b575d8 is not recorded by CloudTrail.
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyFunction-1efa0e60	Lambda function sam-app-MyFunction-1efa0e60 is not recorded by CloudTrail.
Low	s3_bucket_cross_region_replication	aws-sam-cli-managed-default-samclisourcebucket-b8475127	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-b8475127 does not have correct cross region replication configuration.
Low	s3_bucket_event_notifications_enabled	aws-sam-cli-managed-default-samclisourcebucket-b8475127	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-b8475127 does not have event notifications enabled.
Low	s3_bucket_lifecycle_enabled	aws-sam-cli-managed-default-samclisourcebucket-b8475127	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-b8475127 does not have a lifecycle configuration enabled.
Low	s3_bucket_object_lock	aws-sam-cli-managed-default-samclisourcebucket-b8475127	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-b8475127 has Object Lock disabled.

LocalStack infrastructure diff: +6 added · ~0 modified · −6 removed · 4 services

✅ passed · Run #11 · localstack/adopt-update-proj_b1e4056f → main @ 6754c91 · vs latest main run

✨ This CI run reflects an update to the SAM application, likely due to a code change or a SAM CLI version bump. The core Lambda functions (sam-app-MyFunction and sam-app-MyAuthFunction) and their associated IAM roles have been replaced with new versions, indicated by the new suffixes. Similarly, the API Gateway (qkh6cdfec1) and the SAM CLI's managed S3 source bucket (aws-sam-cli-managed-default-samclisourcebucket-b8475127) have also been recreated, which is typical behavior for SAM deployments when underlying resource properties change or a full redeployment is triggered.

API Gateway · +1 added · −1 removed

+ qkh6cdfec1 (AWS::ApiGateway::RestApi · us-east-1)
- shsoaowswk (AWS::ApiGateway::RestApi · us-east-1)

IAM · +2 added · −2 removed

+ sam-app-MyAuthFunctionRole-3a194992 (AWS::IAM::Role · global)
+ sam-app-MyFunctionRole-f65e7aec (AWS::IAM::Role · global)
- sam-app-MyAuthFunctionRole-00857186 (AWS::IAM::Role · global)
- sam-app-MyFunctionRole-6ce928c4 (AWS::IAM::Role · global)

Lambda · +2 added · −2 removed

+ sam-app-MyFunction-1efa0e60 (AWS::Lambda::Function · us-east-1)
+ sam-app-MyAuthFunction-44b575d8 (AWS::Lambda::Function · us-east-1)
- sam-app-MyFunction-74f7936a (AWS::Lambda::Function · us-east-1)
- sam-app-MyAuthFunction-f7f89ee6 (AWS::Lambda::Function · us-east-1)

S3 · +1 added · −1 removed

+ aws-sam-cli-managed-default-samclisourcebucket-b8475127 (AWS::S3::Bucket · global)
- aws-sam-cli-managed-default-samclisourcebucket-cb08a55f (AWS::S3::Bucket · global)

_{View run in LocalStack · Open sandbox · updated for 6754c91 at 2026-10-24T20:09:12Z}