chore: upgrade CDK stack runtime, remove SDK v2, add WAF ACL - #67
Conversation
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Summary
This PR upgrades the CDK stack runtime to Node.js 24 and removes AWS SDK v2 dependencies, which aligns with AWS best practices. However, there are critical issues that must be addressed before merge.
Critical Issues Requiring Action
-
Logic Error: The Lambda function removed all DynamoDB interaction code, but the CDK stack still configures DynamoDB permissions and environment variables. This creates a mismatch between infrastructure and application code.
-
Security Vulnerability: The API Gateway CORS configuration allows all origins (
gateway.Cors.ALL_ORIGINS), exposing the API to CSRF attacks and unauthorized access.
Recommended Actions
- Restore DynamoDB client and operations in the Lambda function, OR remove DynamoDB-related infrastructure if not needed
- Replace
gateway.Cors.ALL_ORIGINSwith specific allowed domain(s) - Align infrastructure configuration with actual Lambda function requirements
The WAFv2 additions are a positive security improvement. Please address the blocking issues before merging.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
| handler: 'handler', | ||
| runtime: lambda.Runtime.NODEJS_24_X, | ||
| environment: { | ||
| DYNAMODB_TABLE_NAME: dynamodbTable.tableName, |
There was a problem hiding this comment.
Lambda function no longer interacts with DynamoDB after removing AWS SDK v2. Remove this environment variable or restore DynamoDB client in the Lambda function to match infrastructure expectations.
| restApiName: "Demo API", | ||
| description: "Demo API with Lambda and DynamoDB", | ||
| defaultCorsPreflightOptions: { | ||
| allowOrigins: gateway.Cors.ALL_ORIGINS, |
There was a problem hiding this comment.
🛑 Security Vulnerability: Using gateway.Cors.ALL_ORIGINS exposes the API to any domain, enabling cross-site request forgery (CSRF) and unauthorized access1. Replace with specific allowed origins for production use.
| allowOrigins: gateway.Cors.ALL_ORIGINS, | |
| allowOrigins: [''], // Replace with your actual domain(s) |
Footnotes
-
CWE-346: Origin Validation Error - https://cwe.mitre.org/data/definitions/346.html ↩
| }; | ||
| import { APIGatewayEvent, Context, APIGatewayProxyResult } from 'aws-lambda'; | ||
|
|
||
| export const handler = async ( |
There was a problem hiding this comment.
🛑 Logic Error: Lambda function removes all DynamoDB interaction code while the CDK stack (lines 34, 49 in cdk-app-stack.ts) still grants DynamoDB permissions and passes DYNAMODB_TABLE_NAME environment variable. This creates a mismatch where infrastructure expects database operations but the function cannot perform them. Either restore DynamoDB client initialization and operations in this function, or remove the DynamoDB-related infrastructure configuration if database access is not needed.
1 participant
Description
Type of Change
Testing
npm run buildpassesnpm testpassesnpm run lintpasses (if applicable)npm run synthpasses (if applicable)Platform Impact
Checklist