Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
aws-cdk-local
Advanced tools
This project provides a thin wrapper script cdklocal
for using the AWS CDK library against local APIs provided by LocalStack.
Note: This project replaces the old (deprecated) repo which was a fork of the AWS CDK repo. Instead of forking the repo and applying changes, we now simply provide a simple wrapper script cdklocal
which applies runtime patching. The advantage of the new approach is that you should be able to use arbitrary CDK versions under the cover.
The cdklocal
command line is published as an npm library:
$ npm install -g aws-cdk-local aws-cdk
...
$ cdklocal --version
1.65.5
Note: Starting with version 1.65.2
, the dependency aws-cdk
needs to be installed manually
(to decouple the two libraries, and allow using arbitrary versions of aws-cdk
under the covers).
(Note: Depending on your local setup, you may or may not have to use the global npm
installation flag -g
above.)
MODULE_NOT_FOUND
issueOn Mac OS, brew can be used to install AWS CDK, which might result in a MODULE_NOT_FOUND
error from cdklocal
.
To resolve this, set the NODE_PATH
variable pointing to your AWS CDK's node_module
folder to expand the lookup path for modules.
$ export NODE_PATH=$NODE_PATH:/opt/homebrew/Cellar/aws-cdk/<CDK_VERSION>/libexec/lib/node_modules
The following environment variables can be configured:
AWS_ENDPOINT_URL
: The endpoint URL to connect to (combination of USE_SSL
/LOCALSTACK_HOSTNAME
/EDGE_PORT
below)EDGE_PORT
(deprecated): Port under which LocalStack edge service is accessible (default: 4566
)LOCALSTACK_HOSTNAME
(deprecated): Target host under which LocalStack edge service is accessible (default: localhost
)USE_SSL
(deprecated): Whether to use SSL to connect to the LocalStack endpoint, i.e., connect via HTTPS.LAMBDA_MOUNT_CODE
: Whether to use local Lambda code mounting (via setting __local__
S3 bucket name). Note: may require CDK version <2.14.0 to be fully functional.BUCKET_MARKER_LOCAL
: Magic S3 bucket name for Lambda mount and hot reloading (default: __local__
, will default to hot-reload
in a future release)The CDK command line ships with a sample app generator to run a quick test for getting started:
$ mkdir /tmp/test; cd /tmp/test
$ cdklocal init sample-app --language=javascript
...
Make sure that LocalStack is installed and started up with the required services:
$ SERVICES=serverless,sqs,sns localstack start
Then deploy the sample app against the local APIs via the cdklocal
command line:
$ cdklocal deploy
...
Do you wish to deploy these changes (y/n)? y
...
Stack ARN:
arn:aws:cloudformation:us-east-1:000000000000:stack/TestStack/e3debc0a-311e-4968-8230-ed78f89cb614
Once the deployment is done, you can inspect the created resources via the awslocal
command line:
$ awslocal sns list-topics
{
"Topics": [
{
"TopicArn": "arn:aws:sns:us-east-1:000000000000:TestStack-TestTopic339EC197-79F43WWCCS4Z"
}
]
}
2.167.0
aws-cdk
not foundlocalhost
on macOSlocalhost
on MacOSLAMBDA_MOUNT_CODE
config to enable local Lambda code mountingThe AWS CDK is distributed under the Apache License, Version 2.0.
FAQs
CDK Toolkit for use with LocalStack
We found that aws-cdk-local demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.