Usage of the outdated aws-sdk-go v1.48.6

We run multiple EC2 instances with AL2023 with cloudtwatch agent.

We get from our security department a report about the usage of outdated packages on our hosts and this is aws-sdk-go v1.48.6

Quick analysis shows that this version is likely comes together with cloudwatch agent
We ca see in the source code a pinned version reference :
https://github.com/aws/amazon-cloudwatch-agent/blob/main/go.mod#L106

Any chance this could be migrated to the latest version of SDK v1 (though it is deprecated too now)?

This issue was marked stale due to lack of activity.

Maybe someone from aws would at lest take a look at this?

Going through a similar issue now for SOC 2 audit preparation and this is being flagged by a Wiz security scan.

The technology AWS SDK for Go (v1) version 1.48.6 associated with the library github.com/aws/aws-sdk-go found in /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent has been End-of-Life since 2025-07-31.

End-of-Life versions of technologies have no further official support by the vendor and thus no security patches. Furthermore, newly discovered vulnerabilities are not reported. Thus, such technologies pose a threat that is both unknown and will not be fixed.

Navigation Menu

Repository navigation

Usage of the outdated aws-sdk-go v1.48.6 #2090

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Usage of the outdated aws-sdk-go v1.48.6 #2090

Description

Activity

github-actions commented on Jul 17, 2026

maslakov commented on Jul 17, 2026

ohmydds commented on Jul 30, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions