[localstack-platform]

This PR refreshes the LocalStack platform steps (between the # >>> localstack-platform markers) to match the project's current settings in job sam of .github/workflows/main.yml, for the platform project lambda-sam-authorizer. It was computed as a three-way merge onto the current file, so changes made since the adoption are kept.

[localstack-platform]

LocalStack PR Review — 🟡 YELLOW

• Critical or High security findings on changed resources: 2

Verified the SAM application resources in the sandbox, including the API Gateway REST API, the custom Lambda token authorizer, and the main handler Lambda function. Tested direct invocations of both the authorizer and main Lambda functions to confirm proper policy generation and response handling. Finally, validated the API Gateway HTTP endpoint with authorized and unauthorized requests to ensure custom authorizer enforcement works end-to-end.

Checks · 5 passed · 0 failed · 0 errored · 1 replaced

Check	Result	Expectation
check_apigateway_deployment	✅ passed	API Gateway rest API exists and has deployed resources/stages.
check_apigateway_authorizer	✅ passed	API Gateway Custom Authorizer is configured for the REST API.
check_lambda_authorizer_execution	✅ passed	Lambda auth function generates allow policy for 'allow' token and deny for 'deny'.
check_main_lambda_execution	↺ replaced by check_main_lambda_execution_fixed (errored)	Main Lambda function executes successfully and returns expected response.
check_main_lambda_execution_fixed	✅ passed	Main Lambda function executes successfully and returns 200 status code with expected body.
check_apigateway_http_endpoint	✅ passed	API Gateway HTTP endpoint accepts authorized request and rejects unauthorized request.

Security scan · 15 on changed resources

Severity	Check	Resource	Finding
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyAuthFunctionRole-1ceafe78	IAM Service Role sam-app-MyAuthFunctionRole-1ceafe78 does not prevent against a cross-service confused deputy attack.
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyFunctionRole-2d8e16b6	IAM Service Role sam-app-MyFunctionRole-2d8e16b6 does not prevent against a cross-service confused deputy attack.
Medium	apigateway_restapi_public	sam-app-MyApi-361fddbb	API Gateway sam-app-MyApi-361fddbb ID i6panu17gy is internet accessible.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyAuthFunction-dcbcc8a1	Lambda function sam-app-MyAuthFunction-dcbcc8a1 does not have a Dead Letter Queue configured.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyFunction-52a1b81f	Lambda function sam-app-MyFunction-52a1b81f does not have a Dead Letter Queue configured.
Medium	s3_bucket_no_mfa_delete	aws-sam-cli-managed-default-samclisourcebucket-ce5517a3	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-ce5517a3 has MFA Delete disabled.
Medium	s3_bucket_server_access_logging_enabled	aws-sam-cli-managed-default-samclisourcebucket-ce5517a3	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-ce5517a3 has server access logging disabled.
Low	awslambda_function_inside_vpc	sam-app-MyAuthFunction-dcbcc8a1	Lambda function sam-app-MyAuthFunction-dcbcc8a1 is not inside a VPC
Low	awslambda_function_inside_vpc	sam-app-MyFunction-52a1b81f	Lambda function sam-app-MyFunction-52a1b81f is not inside a VPC
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyAuthFunction-dcbcc8a1	Lambda function sam-app-MyAuthFunction-dcbcc8a1 is not recorded by CloudTrail.
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyFunction-52a1b81f	Lambda function sam-app-MyFunction-52a1b81f is not recorded by CloudTrail.
Low	s3_bucket_cross_region_replication	aws-sam-cli-managed-default-samclisourcebucket-ce5517a3	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-ce5517a3 does not have correct cross region replication configuration.
Low	s3_bucket_event_notifications_enabled	aws-sam-cli-managed-default-samclisourcebucket-ce5517a3	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-ce5517a3 does not have event notifications enabled.
Low	s3_bucket_lifecycle_enabled	aws-sam-cli-managed-default-samclisourcebucket-ce5517a3	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-ce5517a3 does not have a lifecycle configuration enabled.
Low	s3_bucket_object_lock	aws-sam-cli-managed-default-samclisourcebucket-ce5517a3	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-ce5517a3 has Object Lock disabled.

LocalStack infrastructure diff: +6 added · ~0 modified · −6 removed · 4 services

✅ passed · Run #5 · localstack/adopt-update-proj_b1e4056f → main @ da1a267 · vs latest main run

✨ This change appears to be a redeployment of a SAM application, indicated by the replacement of several resources with new IDs. Specifically, the sam-app-MyFunction and sam-app-MyAuthFunction Lambda functions and their corresponding IAM roles (sam-app-MyFunctionRole and sam-app-MyAuthFunctionRole) have been updated. A new API Gateway (i6panu17gy) has been added, replacing an old one (erihhfgmjn), and the SAM CLI's managed S3 source bucket has also been refreshed (aws-sam-cli-managed-default-samclisourcebucket). This suggests an update to the application's code or configuration, requiring a full refresh of its serverless components.

API Gateway · +1 added · −1 removed

+ i6panu17gy (AWS::ApiGateway::RestApi · us-east-1)
- erihhfgmjn (AWS::ApiGateway::RestApi · us-east-1)

IAM · +2 added · −2 removed

+ sam-app-MyAuthFunctionRole-1ceafe78 (AWS::IAM::Role · global)
+ sam-app-MyFunctionRole-2d8e16b6 (AWS::IAM::Role · global)
- sam-app-MyAuthFunctionRole-64abd433 (AWS::IAM::Role · global)
- sam-app-MyFunctionRole-243fd53c (AWS::IAM::Role · global)

Lambda · +2 added · −2 removed

+ sam-app-MyFunction-52a1b81f (AWS::Lambda::Function · us-east-1)
+ sam-app-MyAuthFunction-dcbcc8a1 (AWS::Lambda::Function · us-east-1)
- sam-app-MyFunction-e86a348b (AWS::Lambda::Function · us-east-1)
- sam-app-MyAuthFunction-16985dac (AWS::Lambda::Function · us-east-1)

S3 · +1 added · −1 removed

+ aws-sam-cli-managed-default-samclisourcebucket-ce5517a3 (AWS::S3::Bucket · global)
- aws-sam-cli-managed-default-samclisourcebucket-6213f51a (AWS::S3::Bucket · global)

_{View run in LocalStack · Open sandbox · updated for da1a267 at 2026-10-24T18:39:53Z}