aws-toolkit

.changes/next-release/tenant-id-local-invoke.json

@@ -0,0 +1,4 @@
+{
+    "type": "Feature",
+    "description": "Add conditional Tenant ID field to Local Invoke panel for multi-tenant Lambda functions. The field appears when SAM template contains TenancyConfig and passes the value to SAM CLI as --tenant-id argument."
+}

.changes/next-release/tenant-id-remote-invoke.json

@@ -0,0 +1,4 @@
+{
+    "type": "Feature",
+    "description": "Add conditional Tenant ID field to Remote Invoke panel for multi-tenant Lambda functions. The field appears when function has TenancyConfig and passes the value to AWS Lambda Invoke API."
+}

.github/workflows/release.yml

@@ -58,8 +58,10 @@ jobs:
             - name: vsix
               run: |
                   npm run createRelease -w packages/toolkit -w packages/amazonq  # Generate CHANGELOG.md
+                  npm run -w packages/sagemaker-ssh-kiro package  # Must be built before toolkit (toolkit embeds it)
                   npm run -w packages/toolkit package -- --feature "$FEAT_NAME"
                   npm run -w packages/amazonq package -- --feature "$FEAT_NAME"
+                  rm -f sagemaker-ssh-kiro-*.vsix  # Remove standalone VSIX; it's already embedded inside toolkit VSIX
             - uses: actions/upload-artifact@v4
               with:
                   name: artifacts

.github/workflows/semgrep.yml

@@ -0,0 +1,26 @@
+on:
+  workflow_dispatch: {}
+  pull_request: {}
+  push:
+    branches:
+    - main
+    - master
+    paths:
+    - .github/workflows/semgrep.yml
+  schedule:
+  # random HH:MM to avoid a load spike on GitHub Actions at 00:00
+  - cron: 1 21 * * *
+name: Semgrep
+jobs:
+  semgrep:
+    name: semgrep/ci
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+    container:
+      image: semgrep/semgrep
+    steps:
+    - uses: actions/checkout@v4
+    - run: semgrep ci

.gitignore

@@ -47,6 +47,7 @@ packages/toolkit/package.nls.json
 packages/toolkit/resources
 packages/amazonq/package.nls.json
 packages/amazonq/resources
+packages/sagemaker-ssh-kiro/resources
 
 # Icons
 packages/*/resources/fonts/aws-toolkit-icons.woff

Dockerfile

@@ -18,7 +18,12 @@ ENV CXX="g++-4.9" CC="gcc-4.9" DISPLAY=:99.0
 
 WORKDIR /code
 
-# See https://github.com/npm/npm/issues/3497 for --unsafe-perm arg 
+# Create non-root user for security
+RUN useradd -m -s /bin/bash appuser && chown -R appuser:appuser /code
+
+USER appuser
+
+# See https://github.com/npm/npm/issues/3497 for --unsafe-perm arg
 # See http://elementalselenium.com/tips/38-headless for running headless
 # Here we use option 2, but you might be able to do option 1 in code build. exe is Xvfb not xvfb.
-CMD npm install --unsafe-perm && npm run vscode:prepublish && xvfb-run npm test --silent
+CMD npm install && npm run vscode:prepublish && xvfb-run npm test --silent

README.md

@@ -30,7 +30,7 @@ AWS Toolkit is a [VS Code extension](https://marketplace.visualstudio.com/itemde
 -   Connect VSCode to your EC2 instances
 -   Connect to your [CodeCatalyst](https://codecatalyst.aws/) Dev Environments
 -   Debug your Lambda functions using [SAM CLI](https://github.com/aws/aws-sam-cli)
--   Check and autocomplete code in SAM/CFN (CloudFormation) `template.yaml` files
+-   Author, validate, and deploy CloudFormation templates with the [CloudFormation Language Server](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/ide-extension.html)
 -   `Open Terminal` on your EC2 instances or ECS tasks
 -   `Search Log Group` on your CloudWatch logs
 -   Browse your AWS resources
@@ -42,6 +42,7 @@ AWS Toolkit is a [VS Code extension](https://marketplace.visualstudio.com/itemde
 -   Quick Start Guides for...
     -   [Amazon Q](https://marketplace.visualstudio.com/itemdetails?itemName=AmazonWebServices.amazon-q-vscode)
     -   [AWS Toolkit](https://marketplace.visualstudio.com/itemdetails?itemName=AmazonWebServices.aws-toolkit-vscode)
+        -   [AWS CloudFormation Language Server](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/ide-extension.html)
 -   [FAQ / Troubleshooting](./docs/faq-credentials.md)
 -   [User Guide](https://docs.aws.amazon.com/console/toolkit-for-vscode/welcome)
 -   General info about [AWS SDKs and Tools](https://docs.aws.amazon.com/sdkref/latest/guide/overview.html)

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Use this section to tell people about which versions of your project are
+currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.1.x   | :white_check_mark: |
+| 5.0.x   | :x:                |
+| 4.0.x   | :white_check_mark: |
+| < 4.0   | :x:                |
+
+## Reporting a Vulnerability
+
+Use this section to tell people how to report a vulnerability.
+
+Tell them where to go, how often they can expect to get an update on a
+reported vulnerability, what to expect if the vulnerability is accepted or
+declined, etc.

aws-toolkit-vscode.code-workspace

@@ -12,6 +12,9 @@
         {
             "path": "packages/amazonq",
         },
+        {
+            "path": "packages/sagemaker-ssh-kiro",
+        },
     ],
     "settings": {
         "typescript.tsdk": "node_modules/typescript/lib",

buildspec/packageTestVsix.yml

@@ -27,7 +27,9 @@ phases:
             - export HOME=/home/codebuild-user
             # Generate CHANGELOG.md
             - npm run createRelease -w packages/toolkit -w packages/amazonq
+            - npm run package -w packages/sagemaker-ssh-kiro # Must be built before toolkit (toolkit embeds it)
             - npm run package -w packages/toolkit -w packages/amazonq
+            - rm -f sagemaker-ssh-kiro-*.vsix # Remove standalone VSIX; it's already embedded inside toolkit VSIX
 
 artifacts:
     files: