aws-samples · rjjaegeraws · Feb 27, 2025 · Feb 27, 2025 · Feb 27, 2025
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -29,7 +29,7 @@ jobs:
             ${{ runner.OS }}-
       - name: Install Node.js modules
         run: |
-          npm install -g pnpm@8.9.0
+          npm install -g pnpm@10.4.1
           pnpm recursive install --frozen-lockfile
       - name: Build all workspaces
         run: |

diff --git a/.github/workflows/lint-prettier.yml b/.github/workflows/lint-prettier.yml
@@ -28,7 +28,7 @@ jobs:
             ${{ runner.OS }}-
       - name: Install Node.js modules
         run: |
-          npm install -g pnpm@8.9.0
+          npm install -g pnpm@10.4.1
           pnpm install --frozen-lockfile
       - name: Analyze TypeScript files
         run: |
@@ -53,7 +53,7 @@ jobs:
             ${{ runner.OS }}-
       - name: Install Node.js modules
         run: |
-          npm install -g pnpm@8.9.0
+          npm install -g pnpm@10.4.1
           pnpm install --frozen-lockfile
       - name: Analyze TypeScript files
         run: |

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
           node-version: 18
       - name: Install pnpm
         run: |
-          npm install -g pnpm@8.9.0
+          npm install -g pnpm@10.4.1
       - name: Generate Changelog
         id: changelog
         env:
@@ -160,7 +160,7 @@ jobs:
           node-version: 18
       - name: Install pnpm
         run: |
-          npm install -g pnpm@8.9.0
+          npm install -g pnpm@10.4.1
       - name: Build SEA-Config-Schema project
         id: build
         env:
@@ -200,7 +200,7 @@ jobs:
           node-version: 18
       - name: Install pnpm
         run: |
-          npm install -g pnpm@8.9.0
+          npm install -g pnpm@10.4.1
       - name: Build SEA-GUI project
         id: build
         env:

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/reference-artifacts/Add-ons/opensiem/lambdas/common/package.json b/reference-artifacts/Add-ons/opensiem/lambdas/common/package.json
@@ -4,7 +4,7 @@
   "private": true,
   "main": "dist/index.js",
   "scripts": {
-    "build": "npx esbuild --minify --bundle --platform=node --target=node18 --outfile=./dist/index.js src/index.ts",
+    "build": "npx esbuild --minify --bundle --platform=node --target=node22 --outfile=./dist/index.js src/index.ts",
     "watch": "tsc -w",
     "test": "jest",
     "cdk": "cdk"

diff --git a/reference-artifacts/Add-ons/opensiem/lambdas/siem-config/package.json b/reference-artifacts/Add-ons/opensiem/lambdas/siem-config/package.json
@@ -4,7 +4,7 @@
   "private": true,
   "main": "dist/index.js",
   "scripts": {
-    "build": "npx esbuild --minify --bundle --platform=node --target=node18 --outfile=./dist/index.js src/index.ts",
+    "build": "npx esbuild --minify --bundle --platform=node --target=node22 --outfile=./dist/index.js src/index.ts",
     "watch": "tsc -w",
     "test": "jest",
     "cdk": "cdk"

diff --git a/reference-artifacts/Add-ons/opensiem/lambdas/siem-geoip/package.json b/reference-artifacts/Add-ons/opensiem/lambdas/siem-geoip/package.json
@@ -4,7 +4,7 @@
   "private": true,
   "main": "dist/index.js",
   "scripts": {
-    "build": "npx esbuild --minify --bundle --platform=node --target=node18 --outfile=./dist/index.js src/index.ts",
+    "build": "npx esbuild --minify --bundle --platform=node --target=node22 --outfile=./dist/index.js src/index.ts",
     "watch": "tsc -w",
     "test": "jest",
     "cdk": "cdk"

diff --git a/reference-artifacts/Add-ons/opensiem/lib/opensearch-siem-stack.ts b/reference-artifacts/Add-ons/opensiem/lib/opensearch-siem-stack.ts
@@ -398,7 +398,7 @@ export class OpenSearchSiemStack extends Stack {
       );
 
       const geoIpDownloader = new lambda.Function(scope, 'GeoIpDownloaderLambda', {
-        runtime: lambda.Runtime.NODEJS_18_X,
+        runtime: lambda.Runtime.NODEJS_LATEST,
         role: lambdaRole,
         code: lambda.Code.fromAsset('lambdas/siem-geoip/dist'),
         handler: 'index.geoIpDownloader',

diff --git a/reference-artifacts/Add-ons/opensiem/lib/siem-configure.ts b/reference-artifacts/Add-ons/opensiem/lib/siem-configure.ts
@@ -87,7 +87,7 @@ export class OpenSearchSiemConfigure extends Construct {
     });
 
     return new lambda.Function(stack, `ConfigureLambda`, {
-      runtime: lambda.Runtime.NODEJS_18_X,
+      runtime: lambda.Runtime.NODEJS_LATEST,
       code: lambda.Code.fromAsset('lambdas/siem-config/dist'),
       role: lambdaRole,
       handler: 'index.handler',

diff --git a/reference-artifacts/Add-ons/opensiem/lib/siem-geoip-download.ts b/reference-artifacts/Add-ons/opensiem/lib/siem-geoip-download.ts
@@ -69,7 +69,7 @@ export class OpenSearchSiemGeoIpInit extends Construct {
     );
 
     return new lambda.Function(stack, `GeoIpInitLambda`, {
-      runtime: lambda.Runtime.NODEJS_18_X,
+      runtime: lambda.Runtime.NODEJS_LATEST,
       code: lambda.Code.fromAsset('lambdas/siem-geoip/dist'),
       role,
       handler: 'index.geoIpInit',

diff --git a/reference-artifacts/SAMPLE_CONFIGS/config.SSM-Patching-example.json b/reference-artifacts/SAMPLE_CONFIGS/config.SSM-Patching-example.json
@@ -771,7 +771,7 @@
           "resource-types": [
             "AWS::EC2::Instance"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "remediation-action": "Attach-IAM-Instance-Profile",
           "remediation": true,
           "remediation-params": {
@@ -785,7 +785,7 @@
           "resource-types": [
             "AWS::IAM::Role"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "parameters": {
             "AWSManagedPolicies": "AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess, CloudWatchAgentServerPolicy",
             "CustomerManagedPolicies": "${SEA::EC2InstaceProfilePermissions}",
@@ -980,7 +980,7 @@
           "resource-types": [
             "AWS::IAM::Role"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "parameters": {
             "RoleNames": "EC2-Default-SSM-AD-Role, ${ACCELERATOR_PREFIX_ND}-RDGW-Role, ${ACCELERATOR_PREFIX_ND}-Rsyslog-Role",
             "QSConfigID": "*** REPLACE AFTER QUICK SETUP ***",

diff --git a/reference-artifacts/SAMPLE_CONFIGS/config.example.json b/reference-artifacts/SAMPLE_CONFIGS/config.example.json
@@ -766,7 +766,7 @@
           "resource-types": [
             "AWS::EC2::Instance"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "remediation-action": "Attach-IAM-Instance-Profile",
           "remediation": true,
           "remediation-params": {
@@ -780,7 +780,7 @@
           "resource-types": [
             "AWS::IAM::Role"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "parameters": {
             "AWSManagedPolicies": "AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess, CloudWatchAgentServerPolicy",
             "CustomerManagedPolicies": "${SEA::EC2InstaceProfilePermissions}",

diff --git a/reference-artifacts/SAMPLE_CONFIGS/config.lite-CTNFW-example.json b/reference-artifacts/SAMPLE_CONFIGS/config.lite-CTNFW-example.json
@@ -778,7 +778,7 @@
           "resource-types": [
             "AWS::EC2::Instance"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "remediation-action": "Attach-IAM-Instance-Profile",
           "remediation": true,
           "remediation-params": {
@@ -792,7 +792,7 @@
           "resource-types": [
             "AWS::IAM::Role"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "parameters": {
             "AWSManagedPolicies": "AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess, CloudWatchAgentServerPolicy",
             "CustomerManagedPolicies": "${SEA::EC2InstaceProfilePermissions}",

diff --git a/reference-artifacts/SAMPLE_CONFIGS/config.lite-GWLB-example.json b/reference-artifacts/SAMPLE_CONFIGS/config.lite-GWLB-example.json
@@ -766,7 +766,7 @@
           "resource-types": [
             "AWS::EC2::Instance"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "remediation-action": "Attach-IAM-Instance-Profile",
           "remediation": true,
           "remediation-params": {
@@ -780,7 +780,7 @@
           "resource-types": [
             "AWS::IAM::Role"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "parameters": {
             "AWSManagedPolicies": "AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess, CloudWatchAgentServerPolicy",
             "CustomerManagedPolicies": "${SEA::EC2InstaceProfilePermissions}",

diff --git a/reference-artifacts/SAMPLE_CONFIGS/config.lite-NFW-example.json b/reference-artifacts/SAMPLE_CONFIGS/config.lite-NFW-example.json
@@ -761,7 +761,7 @@
           "resource-types": [
             "AWS::EC2::Instance"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "remediation-action": "Attach-IAM-Instance-Profile",
           "remediation": true,
           "remediation-params": {
@@ -775,7 +775,7 @@
           "resource-types": [
             "AWS::IAM::Role"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "parameters": {
             "AWSManagedPolicies": "AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess, CloudWatchAgentServerPolicy",
             "CustomerManagedPolicies": "${SEA::EC2InstaceProfilePermissions}",

diff --git a/reference-artifacts/SAMPLE_CONFIGS/config.lite-VPN-example.json b/reference-artifacts/SAMPLE_CONFIGS/config.lite-VPN-example.json
@@ -766,7 +766,7 @@
           "resource-types": [
             "AWS::EC2::Instance"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "remediation-action": "Attach-IAM-Instance-Profile",
           "remediation": true,
           "remediation-params": {
@@ -780,7 +780,7 @@
           "resource-types": [
             "AWS::IAM::Role"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "parameters": {
             "AWSManagedPolicies": "AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess, CloudWatchAgentServerPolicy",
             "CustomerManagedPolicies": "${SEA::EC2InstaceProfilePermissions}",

diff --git a/reference-artifacts/SAMPLE_CONFIGS/config.lite-VPN-multi-region-ca-west-1-example.json b/reference-artifacts/SAMPLE_CONFIGS/config.lite-VPN-multi-region-ca-west-1-example.json
@@ -778,7 +778,7 @@
           "resource-types": [
             "AWS::EC2::Instance"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "remediation-action": "Attach-IAM-Instance-Profile",
           "remediation": true,
           "remediation-params": {
@@ -792,7 +792,7 @@
           "resource-types": [
             "AWS::IAM::Role"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "parameters": {
             "AWSManagedPolicies": "AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess, CloudWatchAgentServerPolicy",
             "CustomerManagedPolicies": "${SEA::EC2InstaceProfilePermissions}",

diff --git a/...-artifacts/SAMPLE_CONFIGS/config.lite-VPN-multi-region-ca-west-1-tgw-peering-example.json b/...-artifacts/SAMPLE_CONFIGS/config.lite-VPN-multi-region-ca-west-1-tgw-peering-example.json
@@ -778,7 +778,7 @@
           "resource-types": [
             "AWS::EC2::Instance"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "remediation-action": "Attach-IAM-Instance-Profile",
           "remediation": true,
           "remediation-params": {
@@ -792,7 +792,7 @@
           "resource-types": [
             "AWS::IAM::Role"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "parameters": {
             "AWSManagedPolicies": "AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess, CloudWatchAgentServerPolicy",
             "CustomerManagedPolicies": "${SEA::EC2InstaceProfilePermissions}",

diff --git a/reference-artifacts/SAMPLE_CONFIGS/config.multi-region-example.json b/reference-artifacts/SAMPLE_CONFIGS/config.multi-region-example.json
@@ -771,7 +771,7 @@
           "resource-types": [
             "AWS::EC2::Instance"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "remediation-action": "Attach-IAM-Instance-Profile",
           "remediation": true,
           "remediation-params": {
@@ -785,7 +785,7 @@
           "resource-types": [
             "AWS::IAM::Role"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "parameters": {
             "AWSManagedPolicies": "AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess, CloudWatchAgentServerPolicy",
             "CustomerManagedPolicies": "${SEA::EC2InstaceProfilePermissions}",

diff --git a/reference-artifacts/SAMPLE_CONFIGS/config.test-example.json b/reference-artifacts/SAMPLE_CONFIGS/config.test-example.json
@@ -826,7 +826,7 @@
           "resource-types": [
             "AWS::EC2::Instance"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "remediation-action": "Attach-IAM-Instance-Profile",
           "remediation": true,
           "remediation-params": {
@@ -840,7 +840,7 @@
           "resource-types": [
             "AWS::IAM::Role"
           ],
-          "runtime": "nodejs18.x",
+          "runtime": "nodejs22.x",
           "parameters": {
             "AWSManagedPolicies": "AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess, CloudWatchAgentServerPolicy",
             "CustomerManagedPolicies": "${SEA::EC2InstaceProfilePermissions}",

diff --git a/src/core/runtime/package.json b/src/core/runtime/package.json
@@ -4,7 +4,7 @@
   "private": true,
   "main": "dist/index.js",
   "scripts": {
-    "build": "pnpx esbuild --minify --bundle --platform=node --target=node18 --outfile=./dist/index.js src/index.ts",
+    "build": "pnpx esbuild --minify --bundle --platform=node --target=node22 --outfile=./dist/index.js src/index.ts",
     "test": "pnpx jest",
     "lint:typecheck": "pnpx tsc --noEmit",
     "lint:eslint": "pnpx eslint '{cdk,lib,src}/**/*.{js,ts}'"

diff --git a/src/deployments/cdk/package.json b/src/deployments/cdk/package.json
@@ -95,7 +95,8 @@
     "proxy-agent": "6.4.0",
     "semver": "7.5.4",
     "tempy": "1.0.1",
-    "uuid": "9.0.1"
+    "uuid": "9.0.1",
+    "yaml": "1.10.2"
   },
   "devDependencies": {
     "@aws-accelerator/cdk-plugin-assume-role": "workspace:*",

diff --git a/src/deployments/cdk/src/common/alb-ip-forwarding.ts b/src/deployments/cdk/src/common/alb-ip-forwarding.ts
@@ -57,7 +57,7 @@ export class AlbIpForwarding extends Construct {
     const lambdaCode = lambda.Code.fromAsset(lambdaDir);
 
     const dnsFWLambda = new lambda.Function(this, `${prefix}dnsFWLambda`, {
-      runtime: lambda.Runtime.NODEJS_18_X,
+      runtime: lambda.Runtime.NODEJS_LATEST,
       memorySize: 512,
       code: lambdaCode,
       handler: 'index.albIpMonitor',
@@ -81,7 +81,7 @@ export class AlbIpForwarding extends Construct {
     );
 
     const lambdaDnsRecordMonitor = new lambda.Function(this, `${prefix}ddbDnsRecordMonitor`, {
-      runtime: lambda.Runtime.NODEJS_18_X,
+      runtime: lambda.Runtime.NODEJS_LATEST,
       memorySize: 512,
       handler: 'index.albTargetRecordMonitor',
       code: lambdaCode,

diff --git a/src/deployments/cdk/src/deployments/alb/step-1.ts b/src/deployments/cdk/src/deployments/alb/step-1.ts
@@ -457,7 +457,7 @@ export function getLambdaFunctionArn(
   const artifactsFilePath = fs.readFileSync(path.join(__dirname, 'artifacts', fileName));
   const elbLambdaFunction = new lambda.Function(scope, `ElbLambdaFunction${albName}${targetName}`, {
     // Inline code is only allowed for Node.js version 12
-    runtime: lambda.Runtime.NODEJS_18_X,
+    runtime: lambda.Runtime.NODEJS_LATEST,
     code: lambda.Code.fromInline(artifactsFilePath.toString()),
     handler: 'index.handler',
     role,

diff --git a/src/deployments/cdk/src/deployments/central-services/central-logging-s3/step-1.ts b/src/deployments/cdk/src/deployments/central-services/central-logging-s3/step-1.ts
@@ -200,7 +200,7 @@ async function cwlSettingsInLogArchive(props: {
   const lambdaCode = lambda.Code.fromAsset(lambdaDir);
 
   const firhosePrefixProcessingLambda = new lambda.Function(scope, `FirehosePrefixProcessingLambda`, {
-    runtime: lambda.Runtime.NODEJS_18_X,
+    runtime: lambda.Runtime.NODEJS_LATEST,
     code: lambdaCode,
     handler: 'index.firehoseCustomPrefix',
     memorySize: 2048,

diff --git a/src/deployments/cdk/src/deployments/metadata-collection/index.ts b/src/deployments/cdk/src/deployments/metadata-collection/index.ts
@@ -178,7 +178,7 @@ export function createMetadataService(props: MetadataServiceProps) {
   );
 
   const metadataLambda = new lambda.Function(masterAccountStack, `MetadataLambda`, {
-    runtime: lambda.Runtime.NODEJS_18_X,
+    runtime: lambda.Runtime.NODEJS_LATEST,
     code: lambdaCode,
     role: lambdaRole,
     handler: 'index.metadataCollection',

diff --git a/src/deployments/cdk/src/deployments/ou-validation-events/create-organization.ts b/src/deployments/cdk/src/deployments/ou-validation-events/create-organization.ts
@@ -30,7 +30,7 @@ export async function createOrganizationalUnit(input: CreateOrganizationalUnitEv
   const { scope, lambdaCode, acceleratorPipelineRole, acceleratorPrefix, ignoredOus, organizationAdminRole } = input;
 
   const orgChangeFunc = new lambda.Function(scope, 'organizationChanges', {
-    runtime: lambda.Runtime.NODEJS_18_X,
+    runtime: lambda.Runtime.NODEJS_LATEST,
     handler: 'index.ouValidationEvents.createOrganizationalUnit',
     code: lambdaCode,
     role: acceleratorPipelineRole,

diff --git a/src/deployments/cdk/src/deployments/ou-validation-events/policy-changes.ts b/src/deployments/cdk/src/deployments/ou-validation-events/policy-changes.ts
@@ -53,7 +53,7 @@ export async function changePolicy(input: PolicyChangeEventProps) {
   } = input;
 
   const policyChangeFunc = new lambda.Function(scope, 'policyChanges', {
-    runtime: lambda.Runtime.NODEJS_18_X,
+    runtime: lambda.Runtime.NODEJS_LATEST,
     handler: 'index.ouValidationEvents.changePolicy',
     code: lambdaCode,
     role: acceleratorPipelineRole,

diff --git a/src/deployments/cdk/src/deployments/ou-validation-events/remove-account.ts b/src/deployments/cdk/src/deployments/ou-validation-events/remove-account.ts
@@ -43,7 +43,7 @@ export async function removeAccount(input: RemoveAccountProps) {
   } = input;
 
   const removeAccountFunc = new lambda.Function(scope, 'removeAccountFromOrganization', {
-    runtime: lambda.Runtime.NODEJS_18_X,
+    runtime: lambda.Runtime.NODEJS_LATEST,
     handler: 'index.ouValidationEvents.removeAccount',
     code: lambdaCode,
     role: acceleratorPipelineRole,

diff --git a/src/deployments/cdk/src/deployments/ou-validation-events/step-1.ts b/src/deployments/cdk/src/deployments/ou-validation-events/step-1.ts
@@ -157,7 +157,7 @@ async function moveAccount(input: MoveAccountProps) {
   } = input;
   const acceleratorStateMachineArn = `arn:aws:states:${defaultRegion}:${scope.accountId}:stateMachine:${acceleratorStateMachineName}`;
   const moveAccountFunc = new lambda.Function(scope, 'moveAccountToOrganization', {
-    runtime: lambda.Runtime.NODEJS_18_X,
+    runtime: lambda.Runtime.NODEJS_LATEST,
     handler: 'index.ouValidationEvents.moveAccount',
     code: lambdaCode,
     role: acceleratorPipelineRole,