[localstack-platform]

This PR refreshes the LocalStack platform steps (between the # >>> localstack-platform markers) to match the project's current settings in job sam of .github/workflows/main.yml, for the platform project lambda-sam-authorizer. It was computed as a three-way merge onto the current file, so changes made since the adoption are kept.

[localstack-platform]

LocalStack PR Review — 🟡 YELLOW

• Critical or High security findings on changed resources: 2

Tested the deployed SAM application API Gateway and Lambda authorizer integration in LocalStack. Verified that API Gateway route requests with 'Authorization: allow' successfully pass through the authorizer function and return HTTP 200 with the expected 'hello world' payload. Confirmed that unauthorized or denied requests correctly return HTTP 403 Forbidden.

Checks · 2 passed · 0 failed · 0 errored · 1 replaced

Check	Result	Expectation
verify_api_gateway_and_lambda	✅ passed	The SAM application REST API is configured and accessible.
test_api_gateway_authorizer_endpoint	↺ replaced by test_api_gateway_authorizer_endpoint_v2 (errored)	API Gateway stage Prod exists and calling the endpoint with valid/invalid authorization works.
test_api_gateway_authorizer_endpoint_v2	✅ passed	API Gateway stage allows/denies requests based on authorization header.

Security scan · 15 on changed resources

Severity	Check	Resource	Finding
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyAuthFunctionRole-8dc53d15	IAM Service Role sam-app-MyAuthFunctionRole-8dc53d15 does not prevent against a cross-service confused deputy attack.
High	iam_role_cross_service_confused_deputy_prevention	sam-app-MyFunctionRole-b58ad926	IAM Service Role sam-app-MyFunctionRole-b58ad926 does not prevent against a cross-service confused deputy attack.
Medium	apigateway_restapi_public	sam-app-MyApi-efa59081	API Gateway sam-app-MyApi-efa59081 ID lytbs2rim3 is internet accessible.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyAuthFunction-83875b16	Lambda function sam-app-MyAuthFunction-83875b16 does not have a Dead Letter Queue configured.
Medium	awslambda_function_no_dead_letter_queue	sam-app-MyFunction-645bac3a	Lambda function sam-app-MyFunction-645bac3a does not have a Dead Letter Queue configured.
Medium	s3_bucket_no_mfa_delete	aws-sam-cli-managed-default-samclisourcebucket-5eef2a77	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-5eef2a77 has MFA Delete disabled.
Medium	s3_bucket_server_access_logging_enabled	aws-sam-cli-managed-default-samclisourcebucket-5eef2a77	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-5eef2a77 has server access logging disabled.
Low	awslambda_function_inside_vpc	sam-app-MyAuthFunction-83875b16	Lambda function sam-app-MyAuthFunction-83875b16 is not inside a VPC
Low	awslambda_function_inside_vpc	sam-app-MyFunction-645bac3a	Lambda function sam-app-MyFunction-645bac3a is not inside a VPC
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyAuthFunction-83875b16	Lambda function sam-app-MyAuthFunction-83875b16 is not recorded by CloudTrail.
Low	awslambda_function_invoke_api_operations_cloudtrail_logging_enabled	sam-app-MyFunction-645bac3a	Lambda function sam-app-MyFunction-645bac3a is not recorded by CloudTrail.
Low	s3_bucket_cross_region_replication	aws-sam-cli-managed-default-samclisourcebucket-5eef2a77	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-5eef2a77 does not have correct cross region replication configuration.
Low	s3_bucket_event_notifications_enabled	aws-sam-cli-managed-default-samclisourcebucket-5eef2a77	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-5eef2a77 does not have event notifications enabled.
Low	s3_bucket_lifecycle_enabled	aws-sam-cli-managed-default-samclisourcebucket-5eef2a77	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-5eef2a77 does not have a lifecycle configuration enabled.
Low	s3_bucket_object_lock	aws-sam-cli-managed-default-samclisourcebucket-5eef2a77	S3 Bucket aws-sam-cli-managed-default-samclisourcebucket-5eef2a77 has Object Lock disabled.

LocalStack infrastructure diff: +6 added · ~0 modified · −6 removed · 4 services

✅ passed · Run #13 · localstack/adopt-update-proj_b1e4056f → main @ 3167e73 · vs latest main run

✨ This CI run indicates a redeployment of your SAM application. We see the old API Gateway shsoaowswk, IAM roles sam-app-MyAuthFunctionRole-00857186 and sam-app-MyFunctionRole-6ce928c4, and Lambda functions sam-app-MyFunction-74f7936a and sam-app-MyAuthFunction-f7f89ee6 have been removed, along with the S3 source bucket aws-sam-cli-managed-default-samclisourcebucket-cb08a55f. New versions of these resources, including API Gateway lytbs2rim3, IAM roles sam-app-MyAuthFunctionRole-8dc53d15 and sam-app-MyFunctionRole-b58ad926, Lambda functions sam-app-MyFunction-645bac3a and sam-app-MyAuthFunction-83875b16, and S3 bucket aws-sam-cli-managed-default-samclisourcebucket-5eef2a77, have been added, suggesting a full replacement of the application's backend components, likely due to a code change or update.

API Gateway · +1 added · −1 removed

+ lytbs2rim3 (AWS::ApiGateway::RestApi · us-east-1)
- shsoaowswk (AWS::ApiGateway::RestApi · us-east-1)

IAM · +2 added · −2 removed

+ sam-app-MyAuthFunctionRole-8dc53d15 (AWS::IAM::Role · global)
+ sam-app-MyFunctionRole-b58ad926 (AWS::IAM::Role · global)
- sam-app-MyAuthFunctionRole-00857186 (AWS::IAM::Role · global)
- sam-app-MyFunctionRole-6ce928c4 (AWS::IAM::Role · global)

Lambda · +2 added · −2 removed

+ sam-app-MyFunction-645bac3a (AWS::Lambda::Function · us-east-1)
+ sam-app-MyAuthFunction-83875b16 (AWS::Lambda::Function · us-east-1)
- sam-app-MyFunction-74f7936a (AWS::Lambda::Function · us-east-1)
- sam-app-MyAuthFunction-f7f89ee6 (AWS::Lambda::Function · us-east-1)

S3 · +1 added · −1 removed

+ aws-sam-cli-managed-default-samclisourcebucket-5eef2a77 (AWS::S3::Bucket · global)
- aws-sam-cli-managed-default-samclisourcebucket-cb08a55f (AWS::S3::Bucket · global)

_{View run in LocalStack · Open sandbox · updated for 3167e73 at 2026-10-24T22:16:28Z}