The following are recommended security hardening measures to consider when deploying this solution in production.
-
Amazon Simple Notification Service (Amazon SNS) Topic AWS Key Management Service (AWS KMS) Encryption — Enable server-side encryption with a customer-managed KMS CMK on the SNS topic. This solution uses it for low-sensitivity notification data (AMI IDs, PR links).
-
AWS Secrets Manager CMK Encryption — Use a customer-managed KMS key instead of the default AWS-managed key (
aws/secretsmanager) for stricter key rotation and access control. -
AWS Lambda Environment Variable Encryption — Encrypt AWS Lambda environment variables with a customer-managed KMS key. This solution stores only non-sensitive config (ARNs, repo names, branch names) — secrets are fetched at runtime from Secrets Manager.
-
Specific Exception Handling — The release notes fetcher uses a broad
except Exceptionfor resilience. In production, narrow to specific exception types (URLError,HTTPError,JSONDecodeError). -
Lambda Input Validation — Add schema validation on Lambda event payloads if functions are exposed to untrusted callers. In this solution, all invocations come from trusted AWS services (Amazon EventBridge, AWS Step Functions).
-
Amazon Virtual Private Cloud (Amazon VPC) Deployment for Lambda — Deploy Lambda functions into a VPC with private subnets if they access VPC-bound resources. This solution accesses only AWS APIs and GitHub over HTTPS, so VPC deployment is optional.
-
Lambda Dead Letter Queues — Configure Amazon Simple Queue Service (Amazon SQS) dead letter queues on Lambda functions for asynchronous invocations. In this solution, Step Functions handles retries and error states natively.
-
Amazon CloudWatch Logs KMS Encryption — Create explicit Amazon CloudWatch Log Groups with KMS encryption and a retention policy. This solution's logs contain only operational data (AMI IDs, analysis summaries), no secrets or PII.
If you discover a potential security issue in this project, we ask that you notify AWS Security via our vulnerability reporting page. Please do not create a public GitHub issue.