[localstack-platform]

This moves the LocalStack in job sam of .github/workflows/main.yml from a Docker container on the runner to a hosted LocalStack sandbox, managed by the LocalStack platform project lambda-sam-authorizer. Everything else in the job runs as before and still reaches LocalStack on localhost:4566.

What changes in .github/workflows/main.yml

• Removes the LocalStack start command and its step
• Starts LocalStack in a platform sandbox (every run)
• Reads the sandbox's LocalStack log with lstk-project logs
• Reports the run and releases the sandbox (if: always())

Nothing outside job sam changes. The steps between the # >>> localstack-platform and # <<< localstack-platform comments belong to the platform: "Update steps" on the project page refreshes them.

What you get

• A fresh sandbox for every run (push, pull request, schedule)
• On pull requests: an agent review with checks, IAM findings and the infrastructure diff, posted on the PR
• On the default branch: the project's Cloud Pod and the baseline future PRs are diffed against

Before merging

• LOCALSTACK_PLATFORM_AUTH_TOKEN repository secret: already in place. Pull requests from forks get no secrets, so the job fails on them.
• LocalStack settings imported into the project: none
• Not carried over:
  • LOCALSTACK_AUTH_TOKEN: the platform passes the project's token
• The sandbox runs the platform's current LocalStack Pro.

To undo this later, use "Revert adoption" on the project page; it opens a PR that restores the job's own LocalStack startup and keeps your other edits.

[localstack-platform]

LocalStack PR Review — 🟡 YELLOW

• Critical or High security findings on changed resources: 2

Tested the SAM application deployed in the LocalStack sandbox after updating the GitHub workflow to use platform sandboxes. Verified the API Gateway REST API and its custom Lambda authorizer by invoking endpoints with valid and invalid authorization tokens. Directly invoked both the backend Lambda and custom authorizer Lambda functions, and verified S3 bucket operations on the SAM CLI managed deployment bucket.

Checks · 3 passed · 0 failed · 0 errored · 1 replaced

Check	Result	Expectation
check_api_gateway_endpoint	↺ replaced by check_api_gateway_endpoint_v2 (errored)	API Gateway rest API xrerdbgif5 exists and responds to HTTP requests.
check_api_gateway_endpoint_v2	✅ passed	API Gateway custom authorizer and endpoint return expected responses when invoked with valid/invalid authorization headers.
check_lambda_invocations	✅ passed	Lambda functions sam-app-MyFunction and sam-app-MyAuthFunction can be invoked directly and return valid responses.
check_sam_s3_bucket	✅ passed	S3 bucket created by SAM CLI exists and supports object operations.

Security scan · 15 on changed resources

Severity	Check	Resource	Finding
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyAuthFunctionRole-6aabc72d	IAM Service Role sam-app-MyAuthFunctionRole-6aabc72d does not prevent against a cross-service confused deputy attack.
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyFunctionRole-d0c033b1	IAM Service Role sam-app-MyFunctionRole-d0c033b1 does not prevent against a cross-service confused deputy attack.
Medium	apigateway_restapi_public	sam-app-MyApi-8e0240af	API Gateway sam-app-MyApi-8e0240af ID xrerdbgif5 is internet accessible.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyAuthFunction-c9b1c643	Lambda function sam-app-MyAuthFunction-c9b1c643 does not have a Dead Letter Queue configured.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyFunction-d72eb6b1	Lambda function sam-app-MyFunction-d72eb6b1 does not have a Dead Letter Queue configured.
Medium	s3_bucket_no_mfa_delete	aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1 has MFA Delete disabled.
Medium	s3_bucket_server_access_logging_enabled	aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1 has server access logging disabled.
Low	awslambda_function_inside_vpc	sam-app-MyAuthFunction-c9b1c643	Lambda function sam-app-MyAuthFunction-c9b1c643 is not inside a VPC
Low	awslambda_function_inside_vpc	sam-app-MyFunction-d72eb6b1	Lambda function sam-app-MyFunction-d72eb6b1 is not inside a VPC
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyAuthFunction-c9b1c643	Lambda function sam-app-MyAuthFunction-c9b1c643 is not recorded by CloudTrail.
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyFunction-d72eb6b1	Lambda function sam-app-MyFunction-d72eb6b1 is not recorded by CloudTrail.
Low	s3_bucket_cross_region_replication	aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1 does not have correct cross region replication configuration.
Low	s3_bucket_event_notifications_enabled	aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1 does not have event notifications enabled.
Low	s3_bucket_lifecycle_enabled	aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1 does not have a lifecycle configuration enabled.
Low	s3_bucket_object_lock	aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1 has Object Lock disabled.

LocalStack infrastructure diff: +6 added · ~0 modified · −6 removed · 4 services

✅ passed · Run #9 · localstack/adopt-proj_b1e4056f → main @ 983acbc · vs latest main run

✨ This CI run indicates a redeployment of your SAM application. We see the old API Gateway bgczd7iun8, Lambda functions sam-app-MyFunction-5c8edc42 and sam-app-MyAuthFunction-be4c85c8, and their associated IAM roles sam-app-MyAuthFunctionRole-0c638d99 and sam-app-MyFunctionRole-bc7f603f have been removed. New versions of these resources, including API Gateway xrerdbgif5, Lambda functions sam-app-MyFunction-d72eb6b1 and sam-app-MyAuthFunction-c9b1c643, and IAM roles sam-app-MyAuthFunctionRole-6aabc72d and sam-app-MyFunctionRole-d0c033b1, have been created, along with a new S3 source bucket aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1. This suggests a full update or recreation of the SAM application stack, likely due to code changes or configuration updates.

API Gateway · +1 added · −1 removed

+ xrerdbgif5 (AWS::ApiGateway::RestApi · us-east-1)
- bgczd7iun8 (AWS::ApiGateway::RestApi · us-east-1)

IAM · +2 added · −2 removed

+ sam-app-MyAuthFunctionRole-6aabc72d (AWS::IAM::Role · global)
+ sam-app-MyFunctionRole-d0c033b1 (AWS::IAM::Role · global)
- sam-app-MyAuthFunctionRole-0c638d99 (AWS::IAM::Role · global)
- sam-app-MyFunctionRole-bc7f603f (AWS::IAM::Role · global)

Lambda · +2 added · −2 removed

+ sam-app-MyFunction-d72eb6b1 (AWS::Lambda::Function · us-east-1)
+ sam-app-MyAuthFunction-c9b1c643 (AWS::Lambda::Function · us-east-1)
- sam-app-MyFunction-5c8edc42 (AWS::Lambda::Function · us-east-1)
- sam-app-MyAuthFunction-be4c85c8 (AWS::Lambda::Function · us-east-1)

S3 · +1 added · −1 removed

+ aws-sam-cli-managed-default-samclisourcebucket-ef4d9be1 (AWS::S3::Bucket · global)
- aws-sam-cli-managed-default-samclisourcebucket-922f52e0 (AWS::S3::Bucket · global)

_{View run in LocalStack · Open sandbox · updated for 983acbc at 2026-10-24T20:02:21Z}