Gathering detailed insights and metrics for @aws-cdk/aws-redshift-alpha
Gathering detailed insights and metrics for @aws-cdk/aws-redshift-alpha
The AWS Cloud Development Kit is a framework for defining cloud infrastructure in code
Installations
npm install @aws-cdk/aws-redshift-alphaDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS
Min. Node Version
>= 14.15.0
Node Version
18.20.6
NPM Version
10.9.2
Releases
622
Languages
12
TypeScript
JavaScript
Python
Shell
Dockerfile
Alloy
Velocity Template Language
Batchfile
C#
HTML
Go
Ruby
TypeScript (97.73%)
JavaScript (1.4%)
Python (0.57%)
Shell (0.22%)
Dockerfile (0.04%)
Alloy (0.02%)
Velocity Template Language (0.01%)
Developer
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
Apache-2.0 License
12,307 Stars
16,109 Commits
4,209 Forks
228 Watchers
244 Branches
1,620 Contributors
Updated on Jul 17, 2025
Maintainers
2
Package Meta Information
Latest Version
2.206.0-alpha.0
Package Id
@aws-cdk/aws-redshift-alpha@2.206.0-alpha.0
Unpacked Size
649.71 kB
Size
149.55 kB
File Count
53
NPM Version
10.9.2
Node Version
18.20.6
Published on
Jul 16, 2025
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Amazon Redshift Construct Library
The APIs of higher level constructs in this module are experimental and under active development. They are subject to non-backward compatible changes or removal in any future version. These are not subject to the Semantic Versioning model and breaking changes will be announced in the release notes. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.
Starting a Redshift Cluster Database
To set up a Redshift cluster, define a Cluster. It will be launched in a VPC.
You can specify a VPC, otherwise one will be created. The nodes are always launched in private subnets and are encrypted by default.
1import * as ec2 from 'aws-cdk-lib/aws-ec2'; 2 3const vpc = new ec2.Vpc(this, 'Vpc'); 4const cluster = new Cluster(this, 'Redshift', { 5 masterUser: { 6 masterUsername: 'admin', 7 }, 8 vpc 9});
By default, the master password will be generated and stored in AWS Secrets Manager.
You can specify characters to not include in generated passwords by setting excludeCharacters property.
1import * as ec2 from 'aws-cdk-lib/aws-ec2'; 2 3const vpc = new ec2.Vpc(this, 'Vpc'); 4const cluster = new Cluster(this, 'Redshift', { 5 masterUser: { 6 masterUsername: 'admin', 7 excludeCharacters: '"@/\\\ \'`', 8 }, 9 vpc 10});
A default database named default_db will be created in the cluster. To change the name of this database set the defaultDatabaseName attribute in the constructor properties.
By default, the cluster will not be publicly accessible.
Depending on your use case, you can make the cluster publicly accessible with the publiclyAccessible property.
Adding a logging bucket for database audit logging to S3
Amazon Redshift logs information about connections and user activities in your database. These logs help you to monitor the database for security and troubleshooting purposes, a process called database auditing. To send these logs to an S3 bucket, specify the loggingProperties when creating a new cluster.
1import * as ec2 from 'aws-cdk-lib/aws-ec2';
2import * as s3 from 'aws-cdk-lib/aws-s3';
3
4const vpc = new ec2.Vpc(this, 'Vpc');
5const bucket = s3.Bucket.fromBucketName(this, 'bucket', 'amzn-s3-demo-bucket');
6
7const cluster = new Cluster(this, 'Redshift', {
8 masterUser: {
9 masterUsername: 'admin',
10 },
11 vpc,
12 loggingProperties: {
13 loggingBucket: bucket,
14 loggingKeyPrefix: 'prefix',
15 }
16});Availability Zone Relocation
By using relocation in Amazon Redshift, you allow Amazon Redshift to move a cluster to another Availability Zone (AZ) without any loss of data or changes to your applications. This feature can be applied to both new and existing clusters.
To enable this feature, set the availabilityZoneRelocation property to true.
1import * as ec2 from 'aws-cdk-lib/aws-ec2'; 2 3declare const vpc: ec2.IVpc; 4 5const cluster = new Cluster(this, 'Redshift', { 6 masterUser: { 7 masterUsername: 'admin', 8 }, 9 vpc, 10 nodeType: NodeType.RA3_XLPLUS, 11 availabilityZoneRelocation: true, 12});
Note: The availabilityZoneRelocation property is only available for RA3 node types.
Connecting
To control who can access the cluster, use the .connections attribute. Redshift Clusters have
a default port, so you don't need to specify the port:
1cluster.connections.allowDefaultPortFromAnyIpv4('Open to the world');The endpoint to access your database cluster will be available as the .clusterEndpoint attribute:
1cluster.clusterEndpoint.socketAddress; // "HOSTNAME:PORT"
Database Resources
This module allows for the creation of non-CloudFormation database resources such as users and tables. This allows you to manage identities, permissions, and stateful resources within your Redshift cluster from your CDK application.
Because these resources are not available in CloudFormation, this library leverages custom resources to manage them. In addition to the IAM permissions required to make Redshift service calls, the execution role for the custom resource handler requires database credentials to create resources within the cluster.
These database credentials can be supplied explicitly through the adminUser properties
of the various database resource constructs. Alternatively, the credentials can be
automatically pulled from the Redshift cluster's default administrator
credentials. However, this option is only available if the password for the credentials
was generated by the CDK application (ie., no value vas provided for the masterPassword
property
of
Cluster.masterUser).
Creating Users
Create a user within a Redshift cluster database by instantiating a User construct. This
will generate a username and password, store the credentials in a AWS Secrets Manager
Secret,
and make a query to the Redshift cluster to create a new database user with the
credentials.
1new User(this, 'User', {
2 cluster: cluster,
3 databaseName: 'databaseName',
4});By default, the user credentials are encrypted with your AWS account's default Secrets
Manager encryption key. You can specify the encryption key used for this purpose by
supplying a key in the encryptionKey property.
1import * as kms from 'aws-cdk-lib/aws-kms';
2
3const encryptionKey = new kms.Key(this, 'Key');
4new User(this, 'User', {
5 encryptionKey: encryptionKey,
6 cluster: cluster,
7 databaseName: 'databaseName',
8});By default, a username is automatically generated from the user construct ID and its path
in the construct tree. You can specify a particular username by providing a value for the
username property. Usernames must be valid identifiers; see: Names and
identifiers in the Amazon
Redshift Database Developer Guide.
1new User(this, 'User', {
2 username: 'myuser',
3 cluster: cluster,
4 databaseName: 'databaseName',
5});The user password is generated by AWS Secrets Manager using the default configuration
found in
secretsmanager.SecretStringGenerator,
except with password length 30 and some SQL-incompliant characters excluded. The
plaintext for the password will never be present in the CDK application; instead, a
CloudFormation Dynamic
Reference
will be used wherever the password value is required.
You can specify characters to not include in generated passwords by setting excludeCharacters property.
1new User(this, 'User', { 2 cluster: cluster, 3 databaseName: 'databaseName', 4 excludeCharacters: '"@/\\\ \'`', 5});
Creating Tables
Create a table within a Redshift cluster database by instantiating a Table
construct. This will make a query to the Redshift cluster to create a new database table
with the supplied schema.
1new Table(this, 'Table', { 2 tableColumns: [{ name: 'col1', dataType: 'varchar(4)' }, { name: 'col2', dataType: 'float' }], 3 cluster: cluster, 4 databaseName: 'databaseName', 5});
Tables greater than v2.114.1 can have their table name changed, for versions <= v2.114.1, this would not be possible. Therefore, changing of table names for <= v2.114.1 have been disabled.
1new Table(this, 'Table', {
2 tableName: 'oldTableName' // This value can be change for versions greater than v2.114.1
3 tableColumns: [{ name: 'col1', dataType: 'varchar(4)' }, { name: 'col2', dataType: 'float' }],
4 cluster: cluster,
5 databaseName: 'databaseName',
6});The table can be configured to have distStyle attribute and a distKey column:
1new Table(this, 'Table', { 2 tableColumns: [ 3 { name: 'col1', dataType: 'varchar(4)', distKey: true }, 4 { name: 'col2', dataType: 'float' }, 5 ], 6 cluster: cluster, 7 databaseName: 'databaseName', 8 distStyle: TableDistStyle.KEY, 9});
The table can also be configured to have sortStyle attribute and sortKey columns:
1new Table(this, 'Table', { 2 tableColumns: [ 3 { name: 'col1', dataType: 'varchar(4)', sortKey: true }, 4 { name: 'col2', dataType: 'float', sortKey: true }, 5 ], 6 cluster: cluster, 7 databaseName: 'databaseName', 8 sortStyle: TableSortStyle.COMPOUND, 9});
Tables and their respective columns can be configured to contain comments:
1new Table(this, 'Table', { 2 tableColumns: [ 3 { name: 'col1', dataType: 'varchar(4)', comment: 'This is a column comment' }, 4 { name: 'col2', dataType: 'float', comment: 'This is a another column comment' } 5 ], 6 cluster: cluster, 7 databaseName: 'databaseName', 8 tableComment: 'This is a table comment', 9});
Table columns can be configured to use a specific compression encoding:
1import { ColumnEncoding } from '@aws-cdk/aws-redshift-alpha'; 2 3new Table(this, 'Table', { 4 tableColumns: [ 5 { name: 'col1', dataType: 'varchar(4)', encoding: ColumnEncoding.TEXT32K }, 6 { name: 'col2', dataType: 'float', encoding: ColumnEncoding.DELTA32K }, 7 ], 8 cluster: cluster, 9 databaseName: 'databaseName', 10});
Table columns can also contain an id attribute, which can allow table columns to be renamed.
NOTE To use the id attribute, you must also enable the @aws-cdk/aws-redshift:columnId feature flag.
1new Table(this, 'Table', { 2 tableColumns: [ 3 { id: 'col1', name: 'col1', dataType: 'varchar(4)' }, 4 { id: 'col2', name: 'col2', dataType: 'float' } 5 ], 6 cluster: cluster, 7 databaseName: 'databaseName', 8});
Query execution duration is limited to 1 minute by default. You can change this by setting the timeout property.
Valid timeout values are between 1 seconds and 15 minutes.
1import { Duration } from 'aws-cdk-lib'; 2 3new Table(this, 'Table', { 4 tableColumns: [ 5 { id: 'col1', name: 'col1', dataType: 'varchar(4)' }, 6 { id: 'col2', name: 'col2', dataType: 'float' } 7 ], 8 cluster: cluster, 9 databaseName: 'databaseName', 10 timeout: Duration.minutes(15), 11});
Granting Privileges
You can give a user privileges to perform certain actions on a table by using the
Table.grant() method.
1const user = new User(this, 'User', { 2 cluster: cluster, 3 databaseName: 'databaseName', 4}); 5const table = new Table(this, 'Table', { 6 tableColumns: [{ name: 'col1', dataType: 'varchar(4)' }, { name: 'col2', dataType: 'float' }], 7 cluster: cluster, 8 databaseName: 'databaseName', 9}); 10 11table.grant(user, TableAction.DROP, TableAction.SELECT);
Take care when managing privileges via the CDK, as attempting to manage a user's
privileges on the same table in multiple CDK applications could lead to accidentally
overriding these permissions. Consider the following two CDK applications which both refer
to the same user and table. In application 1, the resources are created and the user is
given INSERT permissions on the table:
1const databaseName = 'databaseName'; 2const username = 'myuser' 3const tableName = 'mytable' 4 5const user = new User(this, 'User', { 6 username: username, 7 cluster: cluster, 8 databaseName: databaseName, 9}); 10const table = new Table(this, 'Table', { 11 tableColumns: [{ name: 'col1', dataType: 'varchar(4)' }, { name: 'col2', dataType: 'float' }], 12 cluster: cluster, 13 databaseName: databaseName, 14}); 15table.grant(user, TableAction.INSERT);
In application 2, the resources are imported and the user is given INSERT permissions on
the table:
1const databaseName = 'databaseName'; 2const username = 'myuser' 3const tableName = 'mytable' 4 5const user = User.fromUserAttributes(this, 'User', { 6 username: username, 7 password: SecretValue.unsafePlainText('NOT_FOR_PRODUCTION'), 8 cluster: cluster, 9 databaseName: databaseName, 10}); 11const table = Table.fromTableAttributes(this, 'Table', { 12 tableName: tableName, 13 tableColumns: [{ name: 'col1', dataType: 'varchar(4)' }, { name: 'col2', dataType: 'float' }], 14 cluster: cluster, 15 databaseName: 'databaseName', 16}); 17table.grant(user, TableAction.INSERT);
Both applications attempt to grant the user the appropriate privilege on the table by
submitting a GRANT USER SQL query to the Redshift cluster. Note that the latter of these
two calls will have no effect since the user has already been granted the privilege.
Now, if application 1 were to remove the call to grant, a REVOKE USER SQL query is
submitted to the Redshift cluster. In general, application 1 does not know that
application 2 has also granted this permission and thus cannot decide not to issue the
revocation. This leads to the undesirable state where application 2 still contains the
call to grant but the user does not have the specified permission.
Note that this does not occur when duplicate privileges are granted within the same application, as such privileges are de-duplicated before any SQL query is submitted.
Rotating credentials
When the master password is generated and stored in AWS Secrets Manager, it can be rotated automatically:
1cluster.addRotationSingleUser(); // Will rotate automatically after 30 days
The multi user rotation scheme is also available:
1
2const user = new User(this, 'User', {
3 cluster: cluster,
4 databaseName: 'databaseName',
5});
6cluster.addRotationMultiUser('MultiUserRotation', {
7 secret: user.secret,
8});Adding Parameters
You can add a parameter to a parameter group withClusterParameterGroup.addParameter().
1import { ClusterParameterGroup } from '@aws-cdk/aws-redshift-alpha'; 2 3const params = new ClusterParameterGroup(this, 'Params', { 4 description: 'desc', 5 parameters: { 6 require_ssl: 'true', 7 }, 8}); 9 10params.addParameter('enable_user_activity_logging', 'true');
Additionally, you can add a parameter to the cluster's associated parameter group with Cluster.addToParameterGroup(). If the cluster does not have an associated parameter group, a new parameter group is created.
1import * as ec2 from 'aws-cdk-lib/aws-ec2'; 2import * as cdk from 'aws-cdk-lib'; 3declare const vpc: ec2.Vpc; 4 5const cluster = new Cluster(this, 'Cluster', { 6 masterUser: { 7 masterUsername: 'admin', 8 masterPassword: cdk.SecretValue.unsafePlainText('tooshort'), 9 }, 10 vpc, 11}); 12 13cluster.addToParameterGroup('enable_user_activity_logging', 'true');
Rebooting for Parameter Updates
In most cases, existing clusters must be manually rebooted to apply parameter changes. You can automate parameter related reboots by setting the cluster's rebootForParameterChanges property to true , or by using Cluster.enableRebootForParameterChanges().
1import * as ec2 from 'aws-cdk-lib/aws-ec2'; 2import * as cdk from 'aws-cdk-lib'; 3declare const vpc: ec2.Vpc; 4 5const cluster = new Cluster(this, 'Cluster', { 6 masterUser: { 7 masterUsername: 'admin', 8 masterPassword: cdk.SecretValue.unsafePlainText('tooshort'), 9 }, 10 vpc, 11}); 12 13cluster.addToParameterGroup('enable_user_activity_logging', 'true'); 14cluster.enableRebootForParameterChanges()
Resource Action
You can perform various actions on the Redshift resource by specifying the resourceAction property,
including pausing and resuming the cluster, as well as initiating failover for Multi-AZ clusters.
1import * as ec2 from 'aws-cdk-lib/aws-ec2';
2import { ResourceAction } from '@aws-cdk/aws-redshift-alpha';
3
4declare const vpc: ec2.IVpc;
5
6// Pause the cluster
7new Cluster(this, 'PausedCluster', {
8 masterUser: {
9 masterUsername: 'admin',
10 },
11 vpc,
12 resourceAction: ResourceAction.PAUSE,
13});
14
15// Resume the cluster
16new Cluster(this, 'ResumedCluster', {
17 masterUser: {
18 masterUsername: 'admin',
19 },
20 vpc,
21 resourceAction: ResourceAction.RESUME,
22});
23
24// Failover the cluster
25new Cluster(this, 'FailOverCluster', {
26 masterUser: {
27 masterUsername: 'admin',
28 },
29 // VPC must have 3 AZs for the cluster which executes failover action
30 vpc,
31 // Must be a multi-AZ cluster to failover
32 multiAz: true,
33 resourceAction: ResourceAction.FAILOVER_PRIMARY_COMPUTE,
34});Elastic IP
If you configure your cluster to be publicly accessible, you can optionally select an elastic IP address to use for the external IP address. An elastic IP address is a static IP address that is associated with your AWS account. You can use an elastic IP address to connect to your cluster from outside the VPC. An elastic IP address gives you the ability to change your underlying configuration without affecting the IP address that clients use to connect to your cluster. This approach can be helpful for situations such as recovery after a failure.
1import * as ec2 from 'aws-cdk-lib/aws-ec2'; 2import * as cdk from 'aws-cdk-lib'; 3declare const vpc: ec2.Vpc; 4 5new Cluster(this, 'Redshift', { 6 masterUser: { 7 masterUsername: 'admin', 8 masterPassword: cdk.SecretValue.unsafePlainText('tooshort'), 9 }, 10 vpc, 11 publiclyAccessible: true, 12 elasticIp: '10.123.123.255', // A elastic ip you own 13})
If the Cluster is in a VPC and you want to connect to it using the private IP address from within the cluster, it is important to enable DNS resolution and DNS hostnames in the VPC config. If these parameters would not be set, connections from within the VPC would connect to the elastic IP address and not the private IP address.
1import * as ec2 from 'aws-cdk-lib/aws-ec2'; 2const vpc = new ec2.Vpc(this, 'VPC', { 3 enableDnsSupport: true, 4 enableDnsHostnames: true, 5});
Note that if there is already an existing, public accessible Cluster, which VPC configuration is changed to use DNS hostnames and DNS resolution, connections still use the elastic IP address until the cluster is resized.
Elastic IP vs. Cluster node public IP
The elastic IP address is an external IP address for accessing the cluster outside of a VPC. It's not related to the cluster node public IP addresses and private IP addresses that are accessible via the clusterEndpoint property. The public and private cluster node IP addresses appear regardless of whether the cluster is publicly accessible or not. They are used only in certain circumstances to configure ingress rules on the remote host. These circumstances occur when you load data from an Amazon EC2 instance or other remote host using a Secure Shell (SSH) connection.
Attach Elastic IP after Cluster creation
In some cases, you might want to associate the cluster with an elastic IP address or change an elastic IP address that is associated with the cluster. To attach an elastic IP address after the cluster is created, first update the cluster so that it is not publicly accessible, then make it both publicly accessible and add an Elastic IP address in the same operation.
Enhanced VPC Routing
When you use Amazon Redshift enhanced VPC routing, Amazon Redshift forces all COPY and UNLOAD traffic between your cluster and your data repositories through your virtual private cloud (VPC) based on the Amazon VPC service. By using enhanced VPC routing, you can use standard VPC features, such as VPC security groups, network access control lists (ACLs), VPC endpoints, VPC endpoint policies, internet gateways, and Domain Name System (DNS) servers, as described in the Amazon VPC User Guide. You use these features to tightly manage the flow of data between your Amazon Redshift cluster and other resources. When you use enhanced VPC routing to route traffic through your VPC, you can also use VPC flow logs to monitor COPY and UNLOAD traffic.
1import * as ec2 from 'aws-cdk-lib/aws-ec2'; 2import * as cdk from 'aws-cdk-lib'; 3declare const vpc: ec2.Vpc; 4 5new Cluster(this, 'Redshift', { 6 masterUser: { 7 masterUsername: 'admin', 8 masterPassword: cdk.SecretValue.unsafePlainText('tooshort'), 9 }, 10 vpc, 11 enhancedVpcRouting: true, 12})
If enhanced VPC routing is not enabled, Amazon Redshift routes traffic through the internet, including traffic to other services within the AWS network.
Default IAM role
Some Amazon Redshift features require Amazon Redshift to access other AWS services on your behalf. For your Amazon Redshift clusters to act on your behalf, you supply security credentials to your clusters. The preferred method to supply security credentials is to specify an AWS Identity and Access Management (IAM) role.
When you create an IAM role and set it as the default for the cluster using console, you don't have to provide the IAM role's Amazon Resource Name (ARN) to perform authentication and authorization.
1import * as ec2 from 'aws-cdk-lib/aws-ec2';
2import * as iam from 'aws-cdk-lib/aws-iam';
3declare const vpc: ec2.Vpc;
4
5const defaultRole = new iam.Role(this, 'DefaultRole', {
6 assumedBy: new iam.ServicePrincipal('redshift.amazonaws.com'),
7},
8);
9
10new Cluster(this, 'Redshift', {
11 masterUser: {
12 masterUsername: 'admin',
13 },
14 vpc,
15 roles: [defaultRole],
16 defaultRole: defaultRole,
17});A default role can also be added to a cluster using the addDefaultIamRole method.
1import * as ec2 from 'aws-cdk-lib/aws-ec2';
2import * as iam from 'aws-cdk-lib/aws-iam';
3declare const vpc: ec2.Vpc;
4
5const defaultRole = new iam.Role(this, 'DefaultRole', {
6 assumedBy: new iam.ServicePrincipal('redshift.amazonaws.com'),
7},
8);
9
10const redshiftCluster = new Cluster(this, 'Redshift', {
11 masterUser: {
12 masterUsername: 'admin',
13 },
14 vpc,
15 roles: [defaultRole],
16});
17
18redshiftCluster.addDefaultIamRole(defaultRole);IAM roles
Attaching IAM roles to a Redshift Cluster grants permissions to the Redshift service to perform actions on your behalf.
1import * as ec2 from 'aws-cdk-lib/aws-ec2'; 2import * as iam from 'aws-cdk-lib/aws-iam'; 3declare const vpc: ec2.Vpc 4 5const role = new iam.Role(this, 'Role', { 6 assumedBy: new iam.ServicePrincipal('redshift.amazonaws.com'), 7}); 8const cluster = new Cluster(this, 'Redshift', { 9 masterUser: { 10 masterUsername: 'admin', 11 }, 12 vpc, 13 roles: [role], 14});
Additional IAM roles can be attached to a cluster using the addIamRole method.
1import * as ec2 from 'aws-cdk-lib/aws-ec2'; 2import * as iam from 'aws-cdk-lib/aws-iam'; 3declare const vpc: ec2.Vpc 4 5const role = new iam.Role(this, 'Role', { 6 assumedBy: new iam.ServicePrincipal('redshift.amazonaws.com'), 7}); 8const cluster = new Cluster(this, 'Redshift', { 9 masterUser: { 10 masterUsername: 'admin', 11 }, 12 vpc, 13}); 14cluster.addIamRole(role);
Multi-AZ
Amazon Redshift supports multiple Availability Zones (Multi-AZ) deployments for provisioned RA3 clusters. By using Multi-AZ deployments, your Amazon Redshift data warehouse can continue operating in failure scenarios when an unexpected event happens in an Availability Zone.
To create a Multi-AZ cluster, set the multiAz property to true when creating the cluster.
1declare const vpc: ec2.IVpc;
2
3new redshift.Cluster(stack, 'Cluster', {
4 masterUser: {
5 masterUsername: 'admin',
6 },
7 vpc, // 3 AZs are required for Multi-AZ
8 nodeType: redshift.NodeType.RA3_XLPLUS, // must be RA3 node type
9 clusterType: redshift.ClusterType.MULTI_NODE, // must be MULTI_NODE
10 numberOfNodes: 2, // must be 2 or more
11 multiAz: true,
12});Resizing
As your data warehousing needs change, it's possible to resize your Redshift cluster. If the cluster was deployed via CDK, it's important to resize it via CDK so the change is registered in the AWS CloudFormation template. There are two types of resize operations:
-
Elastic resize - Number of nodes and node type can be changed, but not at the same time. Elastic resize is the default behavior, as it's a fast operation and typically completes in minutes. Elastic resize is only supported on clusters of the following types:
- dc1.large (if your cluster is in a VPC)
- dc1.8xlarge (if your cluster is in a VPC)
- dc2.large
- dc2.8xlarge
- ds2.xlarge
- ds2.8xlarge
- ra3.large
- ra3.xlplus
- ra3.4xlarge
- ra3.16xlarge
-
Classic resize - Number of nodes, node type, or both, can be changed. This operation takes longer to complete, but is useful when the resize operation doesn't meet the criteria of an elastic resize. If you prefer classic resizing, you can set the
classicResizingflag when creating the cluster.
There are other constraints to be aware of, for example, elastic resizing does not support single-node clusters and there are limits on the number of nodes you can add to a cluster. See the AWS Redshift Documentation and AWS API Documentation for more details.
Maintenance track name
When Amazon Redshift releases a new cluster version, your cluster is updated during its maintenance window. You can control whether your cluster is updated to the most recent approved release or to the previous release. See the AWS Redshift Documentation for more details.
To control which cluster version is applied during a maintenance window, set the maintenanceTrackName property for the cluster.
1new redshift.Cluster(stack, 'Cluster', {
2 masterUser: {
3 masterUsername: 'admin',
4 },
5 vpc,
6 maintenanceTrackName: redshift.MaintenanceTrackName.CURRENT,
7});You can specify one of the following MaintenanceTrackName values:
CURRENT: Use the most current approved cluster version.TRAILING: Use the cluster version before the current version.
No vulnerabilities found.
Reason
all changesets reviewed
Reason
30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/aws/.github/SECURITY.md:1
- Info: Found linked content: github.com/aws/.github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/aws/.github/SECURITY.md:1
- Info: Found text in security policy: github.com/aws/.github/SECURITY.md:1
Reason
project is fuzzed
Details
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-applicationautoscaling/test/step-scaling-policy.test.ts:1
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-applicationautoscaling/test/util.ts:2
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-autoscaling-common/test/intervals.test.ts:1
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-autoscaling-common/test/util.ts:1
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/aspect.prop.test.ts:2
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/fn.test.ts:1
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/private/linked-queue.test.ts:1
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-applicationautoscaling/test/step-scaling-policy.test.ts:1
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-applicationautoscaling/test/util.ts:2
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-autoscaling-common/test/intervals.test.ts:1
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-autoscaling-common/test/util.ts:1
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/aspect.prop.test.ts:2
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/fn.test.ts:1
- Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/private/linked-queue.test.ts:1
Reason
SAST tool detected but not run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Warn: 25 commits out of 30 are checked with a SAST tool
Reason
5 out of the last 5 releases have a total of 5 signed artifacts.
Details
- Info: signed release artifact: aws-cdk-2.205.0.zip.sig: https://github.com/aws/aws-cdk/releases/tag/v2.205.0
- Info: signed release artifact: aws-cdk-2.204.0.zip.sig: https://github.com/aws/aws-cdk/releases/tag/v2.204.0
- Info: signed release artifact: aws-cdk-2.203.1.zip.sig: https://github.com/aws/aws-cdk/releases/tag/v2.203.1
- Info: signed release artifact: aws-cdk-2.203.0.zip.sig: https://github.com/aws/aws-cdk/releases/tag/v2.203.0
- Info: signed release artifact: aws-cdk-2.202.0.zip.sig: https://github.com/aws/aws-cdk/releases/tag/v2.202.0
- Warn: release artifact v2.205.0 does not have provenance: https://api.github.com/repos/aws/aws-cdk/releases/232526029
- Warn: release artifact v2.204.0 does not have provenance: https://api.github.com/repos/aws/aws-cdk/releases/230056825
- Warn: release artifact v2.203.1 does not have provenance: https://api.github.com/repos/aws/aws-cdk/releases/229503341
- Warn: release artifact v2.203.0 does not have provenance: https://api.github.com/repos/aws/aws-cdk/releases/229140489
- Warn: release artifact v2.202.0 does not have provenance: https://api.github.com/repos/aws/aws-cdk/releases/226721774
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
dangerous workflow patterns detected
Details
- Warn: script injection with untrusted input ' github.event.pull_request.head.ref ': .github/workflows/analytics-metadata-updater.yml:46
- Warn: script injection with untrusted input ' github.event.pull_request.head.ref ': .github/workflows/analytics-metadata-updater.yml:46
- Warn: script injection with untrusted input ' github.event.pull_request.head.ref ': .github/workflows/analytics-metadata-updater.yml:46
- Warn: script injection with untrusted input ' github.event.pull_request.head.ref ': .github/workflows/analytics-metadata-updater.yml:46
- Warn: script injection with untrusted input ' github.event.pull_request.head.ref ': .github/workflows/lambda-runtime-tests.yml:44
- Warn: script injection with untrusted input ' github.event.pull_request.head.ref ': .github/workflows/lambda-runtime-tests.yml:44
- Warn: script injection with untrusted input ' github.event.pull_request.head.ref ': .github/workflows/lambda-runtime-tests.yml:44
- Warn: script injection with untrusted input ' github.event.pull_request.head.ref ': .github/workflows/lambda-runtime-tests.yml:44
- Warn: untrusted code checkout '${{ github.event.pull_request.head.sha }}': .github/workflows/request-cli-integ-test.yml:13
- Warn: untrusted code checkout '${{ github.event.pull_request.head.sha }}': .github/workflows/request-cli-integ-test.yml:34
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/analytics-metadata-updater.yml:13
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/close-stale-issues.yml:15
- Info: jobLevel 'packages' permission set to 'read': .github/workflows/codeql.yml:25
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:28
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:29
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/enum-auto-updater.yml:12
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/enum-static-mapping-updater.yml:12
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/lambda-runtime-tests.yml:12
- Info: jobLevel 'statuses' permission set to 'read': .github/workflows/pr-linter.yml:66
- Info: jobLevel 'issues' permission set to 'read': .github/workflows/pr-linter.yml:67
- Info: jobLevel 'checks' permission set to 'read': .github/workflows/pr-linter.yml:68
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/pr-linter.yml:64
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/spec-update.yml:15
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/spec-update.yml:81
- Info: found token with 'none' permissions: .github/workflows/spec-update.yml:82
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/spec-update.yml:123
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/sync-from-upstream.yml:43
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/update-metadata-regions.yml:45
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/yarn-upgrade-need-manual-work.yml:21
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/yarn-upgrade-need-manual-work.yml:78
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/yarn-upgrade.yml:13
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/yarn-upgrade.yml:92
- Warn: no topLevel permission defined: .github/workflows/analytics-metadata-updater.yml:1
- Warn: no topLevel permission defined: .github/workflows/auto-approve.yml:1
- Warn: no topLevel permission defined: .github/workflows/check-lfs.yml:1
- Warn: no topLevel permission defined: .github/workflows/close-stale-issues.yml:1
- Warn: no topLevel permission defined: .github/workflows/close-stale-prs.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/codecov-collect.yml:7
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/codecov-upload.yml:10
- Info: topLevel 'actions' permission set to 'read': .github/workflows/codecov-upload.yml:12
- Warn: no topLevel permission defined: .github/workflows/codeql.yml:1
- Warn: no topLevel permission defined: .github/workflows/enum-auto-updater.yml:1
- Warn: no topLevel permission defined: .github/workflows/enum-static-mapping-updater.yml:1
- Warn: no topLevel permission defined: .github/workflows/github-merit-badger.yml:1
- Warn: no topLevel permission defined: .github/workflows/handle-stale-discussions.yml:1
- Warn: no topLevel permission defined: .github/workflows/issue-label-assign.yml:1
- Warn: no topLevel permission defined: .github/workflows/issue-regression-labeler.yml:1
- Warn: no topLevel permission defined: .github/workflows/issue-reprioritization.yml:1
- Warn: no topLevel permission defined: .github/workflows/lambda-runtime-tests.yml:1
- Warn: no topLevel permission defined: .github/workflows/lock-issue-pr-with-message.yml:1
- Warn: no topLevel permission defined: .github/workflows/pr-build.yml:1
- Warn: no topLevel permission defined: .github/workflows/pr-labeler.yml:1
- Warn: no topLevel permission defined: .github/workflows/pr-linter-exemption-labeler.yml:1
- Warn: no topLevel permission defined: .github/workflows/pr-linter-review-trigger.yml:1
- Warn: no topLevel permission defined: .github/workflows/pr-linter.yml:1
- Warn: no topLevel permission defined: .github/workflows/project-prioritization-added-on.yml:1
- Warn: no topLevel permission defined: .github/workflows/project-prioritization-assignment.yml:1
- Warn: no topLevel permission defined: .github/workflows/project-prioritization-bug.yml:1
- Warn: no topLevel permission defined: .github/workflows/project-prioritization-needs-attention.yml:1
- Warn: no topLevel permission defined: .github/workflows/project-prioritization-r2-assignment.yml:1
- Warn: no topLevel permission defined: .github/workflows/project-prioritization-r5-assignment.yml:1
- Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/repo-metrics-monthly.yml:9
- Warn: no topLevel permission defined: .github/workflows/request-cli-integ-test.yml:1
- Warn: no topLevel permission defined: .github/workflows/security-guardian.yml:1
- Warn: no topLevel permission defined: .github/workflows/spec-update.yml:1
- Warn: no topLevel permission defined: .github/workflows/sync-from-upstream.yml:1
- Warn: no topLevel permission defined: .github/workflows/update-contributors.yml:1
- Warn: no topLevel permission defined: .github/workflows/update-metadata-regions.yml:1
- Warn: no topLevel permission defined: .github/workflows/yarn-upgrade-need-manual-work.yml:1
- Warn: no topLevel permission defined: .github/workflows/yarn-upgrade.yml:1
Reason
binaries present in source code
Details
- Warn: binary detected: packages/@aws-cdk-testing/framework-integ/test/aws-s3-assets/test/integ.assets.directory.lit.js.snapshot/asset.6b84b87243a4a01c592d78e1fd3855c4bfef39328cd0a450cc97e81717fea2a2/sample-jar-asset.jar:1
- Warn: binary detected: packages/@aws-cdk-testing/framework-integ/test/aws-s3-assets/test/integ.assets.refs.lit.js.snapshot/asset.6b84b87243a4a01c592d78e1fd3855c4bfef39328cd0a450cc97e81717fea2a2/sample-jar-asset.jar:1
- Warn: binary detected: packages/@aws-cdk-testing/framework-integ/test/aws-s3-assets/test/sample-asset-directory/sample-jar-asset.jar:1
- Warn: binary detected: packages/@aws-cdk/aws-gamelift-alpha/test/integ.alias.js.snapshot/asset.b95e4173bc399a8f686a4951aa26e01de1ed1e9d981ee1a7f18a15512dbdcb37/TestApplicationServer:1
- Warn: binary detected: packages/@aws-cdk/aws-gamelift-alpha/test/integ.build-fleet.js.snapshot/asset.b9a6ac85861c7bf3d745d9866a46a450a1b14afa77e28d2c2767e74ce4e37c03/TestApplicationServer:1
- Warn: binary detected: packages/@aws-cdk/aws-gamelift-alpha/test/integ.build.js.snapshot/asset.b95e4173bc399a8f686a4951aa26e01de1ed1e9d981ee1a7f18a15512dbdcb37/TestApplicationServer:1
- Warn: binary detected: packages/@aws-cdk/aws-gamelift-alpha/test/integ.game-session-queue.js.snapshot/asset.b95e4173bc399a8f686a4951aa26e01de1ed1e9d981ee1a7f18a15512dbdcb37/TestApplicationServer:1
- Warn: binary detected: packages/@aws-cdk/aws-gamelift-alpha/test/integ.queued-matchmaking-configuration.js.snapshot/asset.b95e4173bc399a8f686a4951aa26e01de1ed1e9d981ee1a7f18a15512dbdcb37/TestApplicationServer:1
- Warn: binary detected: packages/@aws-cdk/aws-gamelift-alpha/test/my-game-build/TestApplicationServer:1
- Warn: binary detected: packages/@aws-cdk/aws-glue-alpha/test/integ.job-scalaspark-etl.js.snapshot/asset.e305655b966b957f91fcec580e3f8703573eb6b69528c5d52190d72579c91602.jar:1
- Warn: binary detected: packages/@aws-cdk/aws-glue-alpha/test/integ.job-scalaspark-flex-etl.js.snapshot/asset.e305655b966b957f91fcec580e3f8703573eb6b69528c5d52190d72579c91602.jar:1
- Warn: binary detected: packages/@aws-cdk/aws-glue-alpha/test/integ.job-scalaspark-streaming.js.snapshot/asset.e305655b966b957f91fcec580e3f8703573eb6b69528c5d52190d72579c91602.jar:1
- Warn: binary detected: packages/@aws-cdk/aws-glue-alpha/test/integ.job-scalasparkflex-etl.js.snapshot/asset.e305655b966b957f91fcec580e3f8703573eb6b69528c5d52190d72579c91602.jar:1
- Warn: binary detected: packages/@aws-cdk/aws-glue-alpha/test/job-jar/helloworld.jar:1
- Warn: binary detected: packages/@aws-cdk/aws-kinesisanalytics-flink-alpha/test/code-asset/WordCount.jar:1
- Warn: binary detected: packages/@aws-cdk/aws-kinesisanalytics-flink-alpha/test/integ.application-code-from-bucket.lit.js.snapshot/asset.8be9e0b5f53d41e9a3b1d51c9572c65f24f8170a7188d0ed57fb7d571de4d577/WordCount.jar:1
- Warn: binary detected: packages/@aws-cdk/aws-kinesisanalytics-flink-alpha/test/integ.application.lit.js.snapshot/asset.8be9e0b5f53d41e9a3b1d51c9572c65f24f8170a7188d0ed57fb7d571de4d577/WordCount.jar:1
- Warn: binary detected: packages/@aws-cdk/aws-kinesisanalytics-flink-alpha/test/integ.vpc-application.js.snapshot/asset.8be9e0b5f53d41e9a3b1d51c9572c65f24f8170a7188d0ed57fb7d571de4d577/WordCount.jar:1
- Warn: binary detected: packages/aws-cdk-lib/aws-s3-assets/test/sample-asset-directory/sample-jar-asset.jar:1
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/analytics-metadata-updater.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/analytics-metadata-updater.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/analytics-metadata-updater.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/analytics-metadata-updater.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/auto-approve.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/auto-approve.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/check-lfs.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/check-lfs.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/close-stale-issues.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/close-stale-issues.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/close-stale-prs.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/close-stale-prs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codecov-collect.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/codecov-collect.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codecov-collect.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/codecov-collect.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codecov-collect.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/codecov-collect.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codecov-upload.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/codecov-upload.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codecov-upload.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/codecov-upload.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/codecov-upload.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/codecov-upload.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/enum-auto-updater.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/enum-auto-updater.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/enum-auto-updater.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/enum-auto-updater.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/enum-static-mapping-updater.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/enum-static-mapping-updater.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/enum-static-mapping-updater.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/enum-static-mapping-updater.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/github-merit-badger.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/github-merit-badger.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/handle-stale-discussions.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/handle-stale-discussions.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-label-assign.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/issue-label-assign.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-label-assign.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/issue-label-assign.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-label-assign.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/issue-label-assign.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/issue-regression-labeler.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/issue-regression-labeler.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-reprioritization.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/issue-reprioritization.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-reprioritization.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/issue-reprioritization.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lambda-runtime-tests.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/lambda-runtime-tests.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lambda-runtime-tests.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/lambda-runtime-tests.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/lock-issue-pr-with-message.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/lock-issue-pr-with-message.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr-build.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/pr-build.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr-build.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/pr-build.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr-build.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/pr-build.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr-build.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/pr-build.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr-build.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/pr-build.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr-build.yml:81: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/pr-build.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr-labeler.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/pr-labeler.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr-linter-exemption-labeler.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/pr-linter-exemption-labeler.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr-linter-review-trigger.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/pr-linter-review-trigger.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr-linter.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/pr-linter.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr-linter.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/pr-linter.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/project-prioritization-added-on.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/project-prioritization-added-on.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/project-prioritization-added-on.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/project-prioritization-added-on.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/project-prioritization-assignment.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/project-prioritization-assignment.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/project-prioritization-assignment.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/project-prioritization-assignment.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/project-prioritization-bug.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/project-prioritization-bug.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/project-prioritization-bug.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/project-prioritization-bug.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/project-prioritization-needs-attention.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/project-prioritization-needs-attention.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/project-prioritization-needs-attention.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/project-prioritization-needs-attention.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/project-prioritization-r2-assignment.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/project-prioritization-r2-assignment.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/project-prioritization-r2-assignment.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/project-prioritization-r2-assignment.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/project-prioritization-r5-assignment.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/project-prioritization-r5-assignment.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/project-prioritization-r5-assignment.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/project-prioritization-r5-assignment.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/repo-metrics-monthly.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/repo-metrics-monthly.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/repo-metrics-monthly.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/repo-metrics-monthly.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/repo-metrics-monthly.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/repo-metrics-monthly.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/repo-metrics-monthly.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/repo-metrics-monthly.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/request-cli-integ-test.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/request-cli-integ-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/request-cli-integ-test.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/request-cli-integ-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/security-guardian.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/security-guardian.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spec-update.yml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/spec-update.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spec-update.yml:131: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/spec-update.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spec-update.yml:140: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/spec-update.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/spec-update.yml:146: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/spec-update.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spec-update.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/spec-update.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spec-update.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/spec-update.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spec-update.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/spec-update.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spec-update.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/spec-update.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spec-update.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/spec-update.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spec-update.yml:88: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/spec-update.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spec-update.yml:93: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/spec-update.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spec-update.yml:113: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/spec-update.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sync-from-upstream.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/sync-from-upstream.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sync-from-upstream.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/sync-from-upstream.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-contributors.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/update-contributors.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/update-contributors.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/update-contributors.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/update-contributors.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/update-contributors.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-metadata-regions.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/update-metadata-regions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-metadata-regions.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/update-metadata-regions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-metadata-regions.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/update-metadata-regions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-metadata-regions.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/update-metadata-regions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-metadata-regions.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/update-metadata-regions.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/update-metadata-regions.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/update-metadata-regions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/yarn-upgrade-need-manual-work.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade-need-manual-work.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/yarn-upgrade-need-manual-work.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade-need-manual-work.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/yarn-upgrade-need-manual-work.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade-need-manual-work.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/yarn-upgrade-need-manual-work.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade-need-manual-work.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/yarn-upgrade-need-manual-work.yml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade-need-manual-work.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/yarn-upgrade-need-manual-work.yml:86: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade-need-manual-work.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/yarn-upgrade-need-manual-work.yml:96: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade-need-manual-work.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/yarn-upgrade.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/yarn-upgrade.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/yarn-upgrade.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/yarn-upgrade.yml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/yarn-upgrade.yml:97: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/yarn-upgrade.yml:100: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/yarn-upgrade.yml:110: update your workflow using https://app.stepsecurity.io/secureworkflow/aws/aws-cdk/yarn-upgrade.yml/main?enable=pin
- Warn: containerImage not pinned by hash: .devcontainer/Dockerfile:1: pin your Docker image by updating jsii/superchain:1-bookworm-slim-node20 to jsii/superchain:1-bookworm-slim-node20@sha256:256db53c85778c35740d6204b402882943fdfe7158e59f008d8f56b5f7456022
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-batch/test/batchjob-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-batch/test/integ.ecs-job-definition.js.snapshot/asset.8b518243ecbfcfd08b4734069e7e74ff97b7889dfde0a60d16e7bdc96e6c593b/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-codebuild/test/demo-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-codebuild/test/integ.docker-asset.lit.js.snapshot/asset.73ee9c3cafd103104e2a42ee76961a90a2410d0dcad42110343c5fd85ad6db78/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/assets/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/node:20-alpine to public.ecr.aws/docker/library/node:20-alpine@sha256:34aa203f3b1e372609cbf76df2ee6641154cbae8bf930baccefdaa95b4b80a71
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-ecr-image-scan-action.js.snapshot/asset.27f275db75ac03bdc330dbcf7088081a073cf2e4126ccbf4d9b2726213619891/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/node:20-alpine to public.ecr.aws/docker/library/node:20-alpine@sha256:34aa203f3b1e372609cbf76df2ee6641154cbae8bf930baccefdaa95b4b80a71
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecr-assets/test/demo-image-dockerignore/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecr-assets/test/demo-image-secret/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecr-assets/test/demo-image-ssh/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecr-assets/test/demo-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecr-assets/test/integ.assets-docker.js.snapshot/asset.0a3355be12051c9984bf2b0b2bba4e6ea535968e5b6e7396449701732fe5ed14/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecr-assets/test/integ.assets-docker.js.snapshot/asset.394b24fcdc153a83b1fc400bf2e812ee67e3a5ffafdf977d531cfe2187d95f38/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecr-assets/test/integ.assets-docker.js.snapshot/asset.60dea2e16e94d1977b92fe03fa7085fea446233f1fe499702b69593438baa59f/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecr-assets/test/integ.assets-docker.js.snapshot/asset.615e365307bd4811880256cf541a7d05b5d4a752ee76ac03863a0a39631607a6/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecr-assets/test/integ.assets-docker.js.snapshot/asset.7937f4f8197a9feee726dbb5f91b41ff615930260bf8e300bf64d070886e3183/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecr-assets/test/integ.assets-docker.js.snapshot/asset.fa08370824fa0a7eab2c59a4f371fe7631019044d6c906b4268193120dc213b4/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecr-assets/test/integ.nested-stacks-docker.js.snapshot/asset.0a3355be12051c9984bf2b0b2bba4e6ea535968e5b6e7396449701732fe5ed14/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/demo-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.asset-image.js.snapshot/asset.0a3355be12051c9984bf2b0b2bba4e6ea535968e5b6e7396449701732fe5ed14/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.circuit-breaker-queue-processing-fargate-service.js.snapshot/asset.95cefedd43575452a70cdeeeceb0f1c5728fd58c9ff8e81e760c3dac33c46417/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-custom-cpu-scaling.js.snapshot/asset.8be39d348c20f7e58a373abbd1152069e18da130e51bf52c89bd82a38d0e51d7/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-grace-period.js.snapshot/asset.205c5d917605ee59cc93dc29526bc4f73b315ae613cdfbc52b8179f388041a03/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.11 to public.ecr.aws/lambda/python:3.11@sha256:a5196d38ac1edfec38e17da1002c80b62533773770edf391b6c70a239006ba2a
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-health-check.js.snapshot/asset.205c5d917605ee59cc93dc29526bc4f73b315ae613cdfbc52b8179f388041a03/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.11 to public.ecr.aws/lambda/python:3.11@sha256:a5196d38ac1edfec38e17da1002c80b62533773770edf391b6c70a239006ba2a
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-no-cpu-scaling.js.snapshot/asset.8be39d348c20f7e58a373abbd1152069e18da130e51bf52c89bd82a38d0e51d7/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-public.js.snapshot/asset.95cefedd43575452a70cdeeeceb0f1c5728fd58c9ff8e81e760c3dac33c46417/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-task-definition-with-cooldown.js.snapshot/asset.205c5d917605ee59cc93dc29526bc4f73b315ae613cdfbc52b8179f388041a03/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.11 to public.ecr.aws/lambda/python:3.11@sha256:a5196d38ac1edfec38e17da1002c80b62533773770edf391b6c70a239006ba2a
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-task-definition.js.snapshot/asset.95cefedd43575452a70cdeeeceb0f1c5728fd58c9ff8e81e760c3dac33c46417/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service.js.snapshot/asset.95cefedd43575452a70cdeeeceb0f1c5728fd58c9ff8e81e760c3dac33c46417/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.runtime-platform-application-load-balanced-fargate-service.js.snapshot/asset.0a3355be12051c9984bf2b0b2bba4e6ea535968e5b6e7396449701732fe5ed14/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.scheduled-fargate-task.js.snapshot/asset.0a3355be12051c9984bf2b0b2bba4e6ea535968e5b6e7396449701732fe5ed14/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/sqs-reader/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.11 to public.ecr.aws/lambda/python:3.11@sha256:a5196d38ac1edfec38e17da1002c80b62533773770edf391b6c70a239006ba2a
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.eks-service-account-sdk-call.js.snapshot/asset.027f028f56ccd09ca70c404bb25cae814956ca2956efb3bfd3d516f96b8b1e48/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/node:18-alpine3.18 to public.ecr.aws/docker/library/node:18-alpine3.18@sha256:8863523fed890ce945343aebf959daa56e6b089de1851074f4fe22fe86c04399
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-eks/test/sdk-call-integ-test-docker-app/app/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/node:18-alpine3.18 to public.ecr.aws/docker/library/node:18-alpine3.18@sha256:8863523fed890ce945343aebf959daa56e6b089de1851074f4fe22fe86c04399
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-events-targets/test/ecs/eventhandler-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-events-targets/test/ecs/image-simple/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/python:3.12 to public.ecr.aws/docker/library/python:3.12@sha256:77a36ff63e657d8ec7cd4e86e452f4cd23b6c92811696b0735226fbc0660a5b8
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-events-targets/test/ecs/integ.event-ec2-task.js.snapshot/asset.cb8db1ca45b29cf8a7db558e2cb31ac823252251ae003dc87318f485c6415d2b/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/python:3.12 to public.ecr.aws/docker/library/python:3.12@sha256:77a36ff63e657d8ec7cd4e86e452f4cd23b6c92811696b0735226fbc0660a5b8
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-events-targets/test/ecs/integ.event-fargate-task.js.snapshot/asset.7a4895bc694ae074467753dddb9a798e58f2f5eda62bcce5833d7d356b8a1da2/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/docker-arm64-handler/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:latest to public.ecr.aws/lambda/python:latest@sha256:8a7e192732832465cb613ab8bbcc8c7b8c926f781947cae2963bc97db507c2de
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/docker-lambda-handler/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/nodejs:18 to public.ecr.aws/lambda/nodejs:18@sha256:4a47ca49eb9864411ddc6bd360cdde03ad20f71a184388d961d5262445da97f7
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.lambda.docker-arm64.js.snapshot/asset.027b9b499ce9e488d4c3cfa41abdbdc6afe203989a5bd77258f471da03f3f040/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:latest to public.ecr.aws/lambda/python:latest@sha256:8a7e192732832465cb613ab8bbcc8c7b8c926f781947cae2963bc97db507c2de
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.lambda.docker.js.snapshot/asset.768d7b6c1d41b85135f498fe0cca69fea410be3c3322c69cf08690aaad29a610/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/nodejs:12 to public.ecr.aws/lambda/nodejs:12@sha256:0fe4eb7ea2af0c349142d7cda41ddaf7356e0d15452b55b7f4e5a3161178cc4f
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-s3-assets/test/alpine-markdown/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/alpine:latest to public.ecr.aws/docker/library/alpine:latest@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/batch/batchjob-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/python:3.13-alpine to public.ecr.aws/docker/library/python:3.13-alpine@sha256:610020b9ad8ee92798f1dbe18d5e928d47358db698969d12730f9686ce3a3191
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/batch/integ.run-batch-job.js.snapshot/asset.8b518243ecbfcfd08b4734069e7e74ff97b7889dfde0a60d16e7bdc96e6c593b/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/batch/integ.submit-job-queue-jsonpath.js.snapshot/asset.6b18aed490b9a0c682c4729d8e5955650709955e8275dcbe68d5defa39c43bda/Dockerfile:1: pin your Docker image by updating python:3.13-alpine to python:3.13-alpine@sha256:610020b9ad8ee92798f1dbe18d5e928d47358db698969d12730f9686ce3a3191
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/batch/integ.submit-job.js.snapshot/asset.8b518243ecbfcfd08b4734069e7e74ff97b7889dfde0a60d16e7bdc96e6c593b/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/ecs/eventhandler-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/python:3.12 to public.ecr.aws/docker/library/python:3.12@sha256:77a36ff63e657d8ec7cd4e86e452f4cd23b6c92811696b0735226fbc0660a5b8
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/ecs/integ.ec2-run-task-ref-definition.js.snapshot/asset.d87af9b5acc567118fa529d3d3b763098200a6446a5ca64aea987729efd52534/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/python:3.12 to public.ecr.aws/docker/library/python:3.12@sha256:77a36ff63e657d8ec7cd4e86e452f4cd23b6c92811696b0735226fbc0660a5b8
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/ecs/integ.ec2-run-task.js.snapshot/asset.d87af9b5acc567118fa529d3d3b763098200a6446a5ca64aea987729efd52534/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/python:3.12 to public.ecr.aws/docker/library/python:3.12@sha256:77a36ff63e657d8ec7cd4e86e452f4cd23b6c92811696b0735226fbc0660a5b8
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/ecs/integ.ec2-task.js.snapshot/asset.d87af9b5acc567118fa529d3d3b763098200a6446a5ca64aea987729efd52534/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/python:3.12 to public.ecr.aws/docker/library/python:3.12@sha256:77a36ff63e657d8ec7cd4e86e452f4cd23b6c92811696b0735226fbc0660a5b8
- Warn: containerImage not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/ecs/integ.fargate-task.js.snapshot/asset.d87af9b5acc567118fa529d3d3b763098200a6446a5ca64aea987729efd52534/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/python:3.12 to public.ecr.aws/docker/library/python:3.12@sha256:77a36ff63e657d8ec7cd4e86e452f4cd23b6c92811696b0735226fbc0660a5b8
- Warn: containerImage not pinned by hash: packages/@aws-cdk/app-staging-synthesizer-alpha/test/assets/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.10 to public.ecr.aws/lambda/python:3.10@sha256:e458dad26230801c4a7223be5837bd73529df4170eab538b80e9b7ab2cb8c676
- Warn: containerImage not pinned by hash: packages/@aws-cdk/app-staging-synthesizer-alpha/test/integ.synth-default-resources.js.snapshot/asset.16624c2a162b07c5cc0e2c59c484f638bac238ca558ccbdc2aa0e0535df3e622/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.10 to public.ecr.aws/lambda/python:3.10@sha256:e458dad26230801c4a7223be5837bd73529df4170eab538b80e9b7ab2cb8c676
- Warn: containerImage not pinned by hash: packages/@aws-cdk/app-staging-synthesizer-alpha/test/integ.synth-default-resources.js.snapshot/asset.68539effc3f7ad46fff9765606c2a01b7f7965833643ab37e62799f19a37f650/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.10 to public.ecr.aws/lambda/python:3.10@sha256:e458dad26230801c4a7223be5837bd73529df4170eab538b80e9b7ab2cb8c676
- Warn: containerImage not pinned by hash: packages/@aws-cdk/app-staging-synthesizer-alpha/test/integ.synth-default-resources.ts.snapshot/asset.16624c2a162b07c5cc0e2c59c484f638bac238ca558ccbdc2aa0e0535df3e622/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.10 to public.ecr.aws/lambda/python:3.10@sha256:e458dad26230801c4a7223be5837bd73529df4170eab538b80e9b7ab2cb8c676
- Warn: containerImage not pinned by hash: packages/@aws-cdk/app-staging-synthesizer-alpha/test/integ.synth-default-resources.ts.snapshot/asset.68539effc3f7ad46fff9765606c2a01b7f7965833643ab37e62799f19a37f650/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.10 to public.ecr.aws/lambda/python:3.10@sha256:e458dad26230801c4a7223be5837bd73529df4170eab538b80e9b7ab2cb8c676
- Warn: containerImage not pinned by hash: packages/@aws-cdk/aws-apprunner-alpha/test/docker.assets/Dockerfile:2: pin your Docker image by updating public.ecr.aws/aws-containers/hello-app-runner:latest to public.ecr.aws/aws-containers/hello-app-runner:latest@sha256:241db9b79e1ddc65bab9f3a01a4e5e29b2da9c552f3a21740d466749dbae1b4b
- Warn: containerImage not pinned by hash: packages/@aws-cdk/aws-apprunner-alpha/test/integ.service-ecr.js.snapshot/asset.77284835684772d19c95f4f5a37e7618d5f9efc40db9321d44ac039db457b967.assets/Dockerfile:2: pin your Docker image by updating public.ecr.aws/aws-containers/hello-app-runner:latest to public.ecr.aws/aws-containers/hello-app-runner:latest@sha256:241db9b79e1ddc65bab9f3a01a4e5e29b2da9c552f3a21740d466749dbae1b4b
- Warn: containerImage not pinned by hash: packages/@aws-cdk/aws-lambda-go-alpha/lib/Dockerfile:4
- Warn: containerImage not pinned by hash: packages/@aws-cdk/aws-lambda-python-alpha/lib/Dockerfile:4
- Warn: containerImage not pinned by hash: packages/@aws-cdk/aws-lambda-python-alpha/test/lambda-handler-custom-build/Dockerfile:1: pin your Docker image by updating public.ecr.aws/sam/build-python3.7 to public.ecr.aws/sam/build-python3.7@sha256:66a882903ad0e3647ea10d6a4f96cdf821536d695473efe9904438773b70c67f
- Warn: containerImage not pinned by hash: packages/@aws-cdk/aws-sagemaker-alpha/test/integ.endpoint-config.js.snapshot/asset.442a71de95281cb26bd41da567c79060206108b97bdde93cb4ce5f213f50013a/Dockerfile:1: pin your Docker image by updating python:3 to python:3@sha256:28f60ab75da2183870846130cead1f6af30162148d3238348f78f89cf6160b5d
- Warn: containerImage not pinned by hash: packages/@aws-cdk/aws-sagemaker-alpha/test/integ.endpoint.alarms.js.snapshot/asset.442a71de95281cb26bd41da567c79060206108b97bdde93cb4ce5f213f50013a/Dockerfile:1: pin your Docker image by updating python:3 to python:3@sha256:28f60ab75da2183870846130cead1f6af30162148d3238348f78f89cf6160b5d
- Warn: containerImage not pinned by hash: packages/@aws-cdk/aws-sagemaker-alpha/test/integ.endpoint.js.snapshot/asset.442a71de95281cb26bd41da567c79060206108b97bdde93cb4ce5f213f50013a/Dockerfile:1: pin your Docker image by updating python:3 to python:3@sha256:28f60ab75da2183870846130cead1f6af30162148d3238348f78f89cf6160b5d
- Warn: containerImage not pinned by hash: packages/@aws-cdk/aws-sagemaker-alpha/test/integ.model.js.snapshot/asset.98e27853307092de1d03c86e89a5ead7aab9f8ea8f6722e4f113f04f34a329fd/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/python:3 to public.ecr.aws/docker/library/python:3@sha256:28f60ab75da2183870846130cead1f6af30162148d3238348f78f89cf6160b5d
- Warn: containerImage not pinned by hash: packages/@aws-cdk/aws-sagemaker-alpha/test/test-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/python:3 to public.ecr.aws/docker/library/python:3@sha256:28f60ab75da2183870846130cead1f6af30162148d3238348f78f89cf6160b5d
- Warn: containerImage not pinned by hash: packages/@aws-cdk/custom-resource-handlers/test/aws-s3-deployment/bucket-deployment-handler/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:latest to public.ecr.aws/lambda/python:latest@sha256:8a7e192732832465cb613ab8bbcc8c7b8c926f781947cae2963bc97db507c2de
- Warn: containerImage not pinned by hash: packages/@aws-cdk/custom-resource-handlers/test/aws-s3-deployment/bucket-deployment-handler/Dockerfile.debug:1: pin your Docker image by updating public.ecr.aws/lambda/python:latest to public.ecr.aws/lambda/python:latest@sha256:8a7e192732832465cb613ab8bbcc8c7b8c926f781947cae2963bc97db507c2de
- Warn: containerImage not pinned by hash: packages/@aws-cdk/custom-resource-handlers/test/aws-s3-deployment/bucket-deployment-handler/Dockerfile_large:1: pin your Docker image by updating public.ecr.aws/lambda/python:latest to public.ecr.aws/lambda/python:latest@sha256:8a7e192732832465cb613ab8bbcc8c7b8c926f781947cae2963bc97db507c2de
- Warn: containerImage not pinned by hash: packages/@aws-cdk/custom-resource-handlers/test/aws-s3/notifications-resource-handler/Dockerfile:2: pin your Docker image by updating public.ecr.aws/lambda/python:3.11 to public.ecr.aws/lambda/python:3.11@sha256:a5196d38ac1edfec38e17da1002c80b62533773770edf391b6c70a239006ba2a
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-batch/test/batchjob-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-cloudformation/test/asset-docker-fixture/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/alpine:latest to public.ecr.aws/docker/library/alpine:latest@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-codebuild/test/demo-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-ecr-assets/test/allow-listed-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-ecr-assets/test/demo-image-custom-docker-file/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-ecr-assets/test/demo-image-custom-docker-file/Dockerfile.Custom:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-ecr-assets/test/demo-image-secret/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-ecr-assets/test/demo-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-ecr-assets/test/dockerignore-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-ecs-patterns/test/demo-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-ecs-patterns/test/sqs-reader/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-ecs/test/demo-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-events-targets/test/ecs/eventhandler-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-lambda-nodejs/lib/Dockerfile:4
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-lambda/test/docker-arm64-handler/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:latest to public.ecr.aws/lambda/python:latest@sha256:8a7e192732832465cb613ab8bbcc8c7b8c926f781947cae2963bc97db507c2de
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-lambda/test/docker-build-lambda/Dockerfile:1: pin your Docker image by updating public.ecr.aws/amazonlinux/amazonlinux:latest to public.ecr.aws/amazonlinux/amazonlinux:latest@sha256:575eeb3622d0a6d8628ed063ed2572d7e75a584b679a3b013a7fd1da4ba19545
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-lambda/test/docker-lambda-handler/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/nodejs:18 to public.ecr.aws/lambda/nodejs:18@sha256:4a47ca49eb9864411ddc6bd360cdde03ad20f71a184388d961d5262445da97f7
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-s3-assets/test/alpine-markdown/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/alpine:latest to public.ecr.aws/docker/library/alpine:latest@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-stepfunctions-tasks/test/batch/batchjob-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/lambda/python:3.6 to public.ecr.aws/lambda/python:3.6@sha256:bae58c5ea51776403c3b76bda7178bca25dc1f3f4696cf76230e5a0250958480
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/aws-stepfunctions-tasks/test/ecs/eventhandler-image/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/python:3.12 to public.ecr.aws/docker/library/python:3.12@sha256:77a36ff63e657d8ec7cd4e86e452f4cd23b6c92811696b0735226fbc0660a5b8
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/cx-api/test/fixtures/asset-manifest/docker-asset/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/ubuntu:latest to public.ecr.aws/docker/library/ubuntu:latest@sha256:e356c061e8d56c58b708d0907925a9bd54cc8f467f05bfa3d714d1d0a4883d97
- Warn: containerImage not pinned by hash: packages/aws-cdk-lib/cx-api/test/fixtures/assets/docker-asset/Dockerfile:1: pin your Docker image by updating public.ecr.aws/docker/library/ubuntu:latest to public.ecr.aws/docker/library/ubuntu:latest@sha256:e356c061e8d56c58b708d0907925a9bd54cc8f467f05bfa3d714d1d0a4883d97
- Warn: pipCommand not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.circuit-breaker-queue-processing-fargate-service.js.snapshot/asset.95cefedd43575452a70cdeeeceb0f1c5728fd58c9ff8e81e760c3dac33c46417/Dockerfile:3
- Warn: pipCommand not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-custom-cpu-scaling.js.snapshot/asset.8be39d348c20f7e58a373abbd1152069e18da130e51bf52c89bd82a38d0e51d7/Dockerfile:3
- Warn: pipCommand not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-grace-period.js.snapshot/asset.205c5d917605ee59cc93dc29526bc4f73b315ae613cdfbc52b8179f388041a03/Dockerfile:3
- Warn: pipCommand not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-health-check.js.snapshot/asset.205c5d917605ee59cc93dc29526bc4f73b315ae613cdfbc52b8179f388041a03/Dockerfile:3
- Warn: pipCommand not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-no-cpu-scaling.js.snapshot/asset.8be39d348c20f7e58a373abbd1152069e18da130e51bf52c89bd82a38d0e51d7/Dockerfile:3
- Warn: pipCommand not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-public.js.snapshot/asset.95cefedd43575452a70cdeeeceb0f1c5728fd58c9ff8e81e760c3dac33c46417/Dockerfile:3
- Warn: pipCommand not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-task-definition-with-cooldown.js.snapshot/asset.205c5d917605ee59cc93dc29526bc4f73b315ae613cdfbc52b8179f388041a03/Dockerfile:3
- Warn: pipCommand not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service-task-definition.js.snapshot/asset.95cefedd43575452a70cdeeeceb0f1c5728fd58c9ff8e81e760c3dac33c46417/Dockerfile:3
- Warn: pipCommand not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.queue-processing-fargate-service.js.snapshot/asset.95cefedd43575452a70cdeeeceb0f1c5728fd58c9ff8e81e760c3dac33c46417/Dockerfile:3
- Warn: pipCommand not pinned by hash: packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/sqs-reader/Dockerfile:3
- Warn: pipCommand not pinned by hash: packages/@aws-cdk/aws-lambda-python-alpha/lib/Dockerfile:26-47
- Warn: pipCommand not pinned by hash: packages/@aws-cdk/aws-lambda-python-alpha/lib/Dockerfile:26-47
- Warn: pipCommand not pinned by hash: packages/@aws-cdk/custom-resource-handlers/test/aws-s3-deployment/bucket-deployment-handler/Dockerfile:7
- Warn: pipCommand not pinned by hash: packages/@aws-cdk/custom-resource-handlers/test/aws-s3-deployment/bucket-deployment-handler/Dockerfile.debug:4
- Warn: pipCommand not pinned by hash: packages/@aws-cdk/custom-resource-handlers/test/aws-s3-deployment/bucket-deployment-handler/Dockerfile_large:7
- Warn: pipCommand not pinned by hash: packages/@aws-cdk/custom-resource-handlers/test/aws-s3/notifications-resource-handler/Dockerfile:7
- Warn: pipCommand not pinned by hash: packages/aws-cdk-lib/aws-ecs-patterns/test/sqs-reader/Dockerfile:3
- Warn: npmCommand not pinned by hash: packages/aws-cdk-lib/aws-lambda-nodejs/lib/Dockerfile:7
- Warn: npmCommand not pinned by hash: packages/aws-cdk-lib/aws-lambda-nodejs/lib/Dockerfile:10
- Warn: npmCommand not pinned by hash: packages/aws-cdk-lib/aws-lambda-nodejs/lib/Dockerfile:13
- Warn: npmCommand not pinned by hash: packages/aws-cdk-lib/aws-lambda-nodejs/lib/Dockerfile:16
- Warn: npmCommand not pinned by hash: packages/aws-cdk-lib/aws-lambda-nodejs/lib/Dockerfile:22
- Warn: npmCommand not pinned by hash: packages/aws-cdk-lib/aws-appsync/test/verify.integ.graphql-iam.sh:9
- Warn: npmCommand not pinned by hash: scripts/update-dependencies.sh:56
- Warn: npmCommand not pinned by hash: scripts/update-dependencies.sh:63
- Warn: npmCommand not pinned by hash: scripts/update-dependencies.sh:63
- Warn: npmCommand not pinned by hash: .github/workflows/spec-update.yml:43
- Warn: npmCommand not pinned by hash: .github/workflows/yarn-upgrade-need-manual-work.yml:49
- Warn: npmCommand not pinned by hash: .github/workflows/yarn-upgrade.yml:41
- Info: 0 out of 73 GitHub-owned GitHubAction dependencies pinned
- Info: 2 out of 26 third-party GitHubAction dependencies pinned
- Info: 0 out of 93 containerImage dependencies pinned
- Info: 0 out of 17 pipCommand dependencies pinned
- Info: 2 out of 14 npmCommand dependencies pinned
Reason
15 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx
- Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6
- Warn: Project is vulnerable to: GHSA-jchw-25xp-jwwc
- Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
- Warn: Project is vulnerable to: GHSA-9hjg-9r4m-mvj7
- Warn: Project is vulnerable to: GHSA-9wx4-h78v-vm56
- Warn: Project is vulnerable to: GHSA-pq67-6m6q-mj2v
- Warn: Project is vulnerable to: GHSA-34jh-p97f-mpxf
- Warn: Project is vulnerable to: GHSA-48p4-8xcf-vxj5
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99
- Warn: Project is vulnerable to: GHSA-h5c3-5r3r-rr8q
- Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38
- Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc
Score
4.8
/10
Last Scanned on 2025-07-14
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More