[localstack-platform]

This moves the LocalStack in job sam of .github/workflows/main.yml from a Docker container on the runner to a hosted LocalStack sandbox, managed by the LocalStack platform project lambda-sam-authorizer. Everything else in the job runs as before and still reaches LocalStack on localhost:4566.

What changes in .github/workflows/main.yml

• Removes the LocalStack start command and its step
• Starts LocalStack in a platform sandbox (every run)
• Reads the sandbox's LocalStack log with lstk-project logs
• Reports the run and releases the sandbox (if: always())

Nothing outside job sam changes. The steps between the # >>> localstack-platform and # <<< localstack-platform comments belong to the platform: "Update steps" on the project page refreshes them.

What you get

• A fresh sandbox for every run (push, pull request, schedule)
• On pull requests: an agent review with checks, IAM findings and the infrastructure diff, posted on the PR
• On the default branch: the project's Cloud Pod and the baseline future PRs are diffed against

Before merging

• LOCALSTACK_PLATFORM_AUTH_TOKEN repository secret: already in place. Pull requests from forks get no secrets, so the job fails on them.
• LocalStack settings imported into the project: none
• Not carried over:
  • LOCALSTACK_AUTH_TOKEN: the platform passes the project's token
• The sandbox runs the platform's current LocalStack Pro.

To undo this later, use "Revert adoption" on the project page; it opens a PR that restores the job's own LocalStack startup and keeps your other edits.

[localstack-platform]

LocalStack PR Review — 🟡 YELLOW

• Critical or High security findings on changed resources: 2

Verified the SAM application deployed to the platform sandbox as configured in the updated GitHub Actions workflow. Tested the API Gateway REST API setup, custom Lambda token authorizer, and main Lambda function execution. Confirmed SAM deployment artifacts in S3 and associated IAM roles are properly created and functional.

Checks · 7 passed · 0 failed · 0 errored · 4 replaced

Check	Result	Expectation
check_api_gateway_configuration	✅ passed	API Gateway REST API exists and has deployed stages and resources with authorizer configured.
check_api_gateway_invoke	↺ replaced by check_env_vars (errored)	API Gateway endpoint responds with 401/403 when unauthenticated and 200 when authorized token header is supplied.
check_env_vars	↺ replaced by check_boto3_endpoint (passed)	Check environment variables for local endpoint host.
check_api_gateway_invoke_v2	↺ replaced by check_api_gateway_stages (errored)	API Gateway endpoint responds on localhost:4566 with 401/403 when unauthenticated and 200 when authorized token header is supplied.
check_boto3_endpoint	✅ passed	Check boto3 endpoint url.
check_api_gateway_test_invoke	↺ replaced by check_api_gateway_integration (errored)	Test API Gateway authorizer and method via boto3 test_invoke_authorizer and test_invoke_method.
check_lambda_invocations	✅ passed	Invoke MyAuthFunction and MyFunction lambdas and verify their responses.
check_s3_bucket_artifacts	✅ passed	S3 deployment bucket exists and contains deployed SAM artifacts.
check_iam_roles	✅ passed	IAM execution roles for Lambda functions exist and have trust relationship with lambda.amazonaws.com.
check_api_gateway_integration	✅ passed	API Gateway REST API method integration is connected to the Lambda target function.
check_api_gateway_stages	✅ passed	API Gateway deployment stages Stage and Dev are active.

Security scan · 15 on changed resources

Severity	Check	Resource	Finding
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyAuthFunctionRole-49e0b239	IAM Service Role sam-app-MyAuthFunctionRole-49e0b239 does not prevent against a cross-service confused deputy attack.
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyFunctionRole-302db40d	IAM Service Role sam-app-MyFunctionRole-302db40d does not prevent against a cross-service confused deputy attack.
Medium	apigateway_restapi_public	sam-app-MyApi-f258ecd9	API Gateway sam-app-MyApi-f258ecd9 ID tkqmsomrpb is internet accessible.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyAuthFunction-37e15459	Lambda function sam-app-MyAuthFunction-37e15459 does not have a Dead Letter Queue configured.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyFunction-ab144843	Lambda function sam-app-MyFunction-ab144843 does not have a Dead Letter Queue configured.
Medium	s3_bucket_no_mfa_delete	aws-sam-cli-managed-default-samclisourcebucket-21dfeccc	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-21dfeccc has MFA Delete disabled.
Medium	s3_bucket_server_access_logging_enabled	aws-sam-cli-managed-default-samclisourcebucket-21dfeccc	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-21dfeccc has server access logging disabled.
Low	awslambda_function_inside_vpc	sam-app-MyAuthFunction-37e15459	Lambda function sam-app-MyAuthFunction-37e15459 is not inside a VPC
Low	awslambda_function_inside_vpc	sam-app-MyFunction-ab144843	Lambda function sam-app-MyFunction-ab144843 is not inside a VPC
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyAuthFunction-37e15459	Lambda function sam-app-MyAuthFunction-37e15459 is not recorded by CloudTrail.
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyFunction-ab144843	Lambda function sam-app-MyFunction-ab144843 is not recorded by CloudTrail.
Low	s3_bucket_cross_region_replication	aws-sam-cli-managed-default-samclisourcebucket-21dfeccc	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-21dfeccc does not have correct cross region replication configuration.
Low	s3_bucket_event_notifications_enabled	aws-sam-cli-managed-default-samclisourcebucket-21dfeccc	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-21dfeccc does not have event notifications enabled.
Low	s3_bucket_lifecycle_enabled	aws-sam-cli-managed-default-samclisourcebucket-21dfeccc	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-21dfeccc does not have a lifecycle configuration enabled.
Low	s3_bucket_object_lock	aws-sam-cli-managed-default-samclisourcebucket-21dfeccc	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-21dfeccc has Object Lock disabled.

LocalStack infrastructure diff: +6 added · ~0 modified · −6 removed · 4 services

✅ passed · Run #17 · localstack/adopt-proj_b1e4056f → main @ 471234a · vs latest main run

✨ This CI run shows a redeployment of your SAM application. We've replaced the sam-app-MyFunction and sam-app-MyAuthFunction Lambda functions and their associated IAM roles (sam-app-MyFunctionRole, sam-app-MyAuthFunctionRole), likely due to code changes or updates to their configurations. Additionally, an API Gateway (tkqmsomrpb) has been added while an older one (uzygeyngeq) was removed, indicating a potential update to your API endpoints, and the SAM CLI source S3 bucket was also replaced.

API Gateway · +1 added · −1 removed

+ tkqmsomrpb (AWS::ApiGateway::RestApi · us-east-1)
- uzygeyngeq (AWS::ApiGateway::RestApi · us-east-1)

IAM · +2 added · −2 removed

+ sam-app-MyAuthFunctionRole-49e0b239 (AWS::IAM::Role · global)
+ sam-app-MyFunctionRole-302db40d (AWS::IAM::Role · global)
- sam-app-MyAuthFunctionRole-372bcdb3 (AWS::IAM::Role · global)
- sam-app-MyFunctionRole-f755d58d (AWS::IAM::Role · global)

Lambda · +2 added · −2 removed

+ sam-app-MyFunction-ab144843 (AWS::Lambda::Function · us-east-1)
+ sam-app-MyAuthFunction-37e15459 (AWS::Lambda::Function · us-east-1)
- sam-app-MyFunction-3f52ecf1 (AWS::Lambda::Function · us-east-1)
- sam-app-MyAuthFunction-06d02087 (AWS::Lambda::Function · us-east-1)

S3 · +1 added · −1 removed

+ aws-sam-cli-managed-default-samclisourcebucket-21dfeccc (AWS::S3::Bucket · global)
- aws-sam-cli-managed-default-samclisourcebucket-e21f4e9c (AWS::S3::Bucket · global)

_{View run in LocalStack · Open sandbox · updated for 471234a at 2026-10-25T04:06:02Z}