.github/workflows/safety.yml

@@ -1,7 +1,7 @@
 name: safety - Python Dependency Check
 
 on:
-  pull_request:
+  pull_request_target:
     branches:
       - main
   push:
@@ -54,9 +54,11 @@ jobs:
         if: steps.cached-poetry-no-dev-dependencies.outputs.cache-hit != 'true'
         run: poetry install --only main --no-root
       #----------------------------------------------
-      # Run Safety check
+      # Run Safety scan
       #----------------------------------------------
-      - name: Safety check
+      - name: Safety scan
+        env:
+          API_KEY: ${{secrets.SAFETY_API_KEY}}
         run: |
           poetry run pip install safety
-          poetry run safety check
+          poetry run safety --key "$API_KEY" --stage cicd scan

CHANGELOG.md

@@ -3,6 +3,18 @@
 ## Table of Contents<!-- omit in toc -->
 
 - [Introduction](#introduction)
+- [2025-03-20](#2025-03-20)
+- [2025-03-04](#2025-03-04)
+- [2025-02-13](#2025-02-13)
+- [2025-02-04](#2025-02-04)
+- [2025-01-21](#2025-01-21)
+- [2025-01-08](#2025-01-08)
+- [2024-09-18](#2024-09-18)
+- [2024-08-22](#2024-08-22)
+- [2024-07-17](#2024-07-17)
+- [2024-06-24](#2024-06-24)
+- [2024-05-03](#2024-05-03)
+- [2024-04-15](#2024-04-15)
 - [2024-02-12](#2024-02-12)
 - [2024-02-09](#2024-02-09)
 - [2024-01-29](#2024-01-29)
@@ -51,6 +63,87 @@
 All notable changes to this project will be documented in this file.
 
 ---
+
+## 2025-03-20
+
+### Added<!-- omit in toc -->
+
+- Added [SRA Amazon GuardDuty Malware Protection for S3](aws_sra_examples/solutions/guardduty/guardduty_malware_protection_for_s3) solution for GenAI deep-dive Bedrock capability two security controls.
+
+## 2025-03-04
+
+### Updated<!-- omit in toc -->
+
+- Updated [Security Lake Organization](aws_sra_examples/solutions/security_lake/security_lake_org) solution with resource management service-linked role.
+
+## 2025-02-13
+
+### Added<!-- omit in toc -->
+
+- Added [SRA Bedrock Guardrails Solution](aws_sra_examples/solutions/genai/bedrock_guardrails) solution to deploy the sra-bedrock-org solution for GenAI deep-dive Bedrock capability one security controls.
+
+## 2025-02-04
+
+### Added<!-- omit in toc -->
+
+- Added [Bedrock](aws_sra_examples/solutions/genai/bedrock_org) solution to deploy the sra-bedrock-org solution for GenAI deep-dive Bedrock capability one security controls.
+
+### Updated<!-- omit in toc -->
+
+- Updated [EC2 Default EBS Encryption](aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption) solution with STS environment variable to enable enforcement in opt-in regions.
+
+## 2025-01-21
+
+### Updated<!-- omit in toc -->
+
+- Updated [Config Management Account](aws_sra_examples/solutions/config/config_management_account) solution to use service-linked role for AWS Config.
+
+## 2025-01-08
+
+### Updated<!-- omit in toc -->
+
+- Updated [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites) staging util script to fix lambda layer deploy when using solution_directory.
+
+## 2024-09-18
+
+### Added<!-- omit in toc -->
+
+- Added [Security Lake Organization](aws_sra_examples/solutions/security_lake/security_lake_org) solution to configure Security Lake in AWS Organizations.
+
+### Changed<!-- omit in toc -->
+
+- Updated [Inspector](https://github.com/aws-samples/aws-security-reference-architecture-examples/tree/main/aws_sra_examples/solutions/inspector/inspector_org) solution to allow creation of AWSServiceRoleForAmazonInspector2Agentless SLR.
+- Updated documentation for [EC2 Default EBS Encryption](aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption) solution.
+
+## 2024-08-22
+
+### Added<!-- omit in toc -->
+
+- Added [Patch Manager](aws_sra_examples/solutions/patch_mgmt/patch_mgmt_org) solution to streamline the patch management process across multiple AWS accounts and regions in AWS Organizations.
+
+## 2024-07-17
+
+### Fixed<!-- omit in toc -->
+
+- Fixed [Terraform edition](aws_sra_examples/terraform) Workspace creation on suspended accounts.
+- Fixed [Firewall Manager](https://github.com/aws-samples/aws-security-reference-architecture-examples/tree/main/aws_sra_examples/solutions/firewall_manager/firewall_manager_org) solution deployment issue (invalid operation error).
+- Fixed [GuardDuty terraform](aws_sra_examples/terraform/solutions/guard_duty) module installation failure.
+
+## 2024-06-24
+
+### Changed<!-- omit in toc -->
+
+- Updated [GuardDuty Organization](aws_sra_examples/solutions/guardduty/guardduty_org) solution to support Opt-in regions.
+
+## 2024-05-03
+
+- Updated [GuardDuty Organization](aws_sra_examples/solutions/guardduty/guardduty_org) solution to add Runtime Monitoring protection.
+- Updated [GuardDuty Organization](aws_sra_examples/solutions/guardduty/guardduty_org) solution default setting to deploy in all enabled regions.
+
+## 2024-04-15
+
+- Updated [Common CFCT Setup](aws_sra_examples/solutions/common/common_cfct_setup) solution to download the latest CfCT template.
+
 ## 2024-02-12
 
 - Added [AMI Bakery](aws_sra_examples/solutions/ami_bakery/ami_bakery_org) solution for AMI image management.
@@ -130,7 +223,7 @@ Updated [Firewall Manager](https://github.com/aws-samples/aws-security-reference
 
 ### Changed<!-- omit in toc -->
 
-- Updated [CfCT template](aws_sra_examples/solutions/common/common_cfct_setup/templates/customizations-for-aws-control-tower.template) to resolve issue #137.
+- Updated [CfCT template](aws_sra_examples/solutions/common/common_cfct_setup/templates/) to resolve issue #137.
 
 ## 2023-05-05
 
@@ -160,7 +253,7 @@ Updated [Firewall Manager](https://github.com/aws-samples/aws-security-reference
 
 ### Changed<!-- omit in toc -->
 
-- Updated the [customizations-for-aws-control-tower.template](aws_sra_examples/solutions/common/common_cfct_setup/templates/customizations-for-aws-control-tower.template) to the latest version v2.5.0 and added Checkov suppressions.
+- Updated the [customizations-for-aws-control-tower.template](aws_sra_examples/solutions/common/common_cfct_setup/templates/) to the latest version v2.5.0 and added Checkov suppressions.
 
 ## 2022-07-29
 
@@ -187,7 +280,7 @@ Updated [Firewall Manager](https://github.com/aws-samples/aws-security-reference
 
 - Added Checkov Lambda Function suppressions for CKV_AWS_115 (Reserved Concurrent Executions) and CKV_AWS_117 (Run within a VPC) to all solution templates with Lambda Function configurations.
 - Updated Lambda python files to fix mypy finding for log_level to always be a string value.
-- Updated the [customizations-for-aws-control-tower.template](aws_sra_examples/solutions/common/common_cfct_setup/templates/customizations-for-aws-control-tower.template) to the latest version v2.4.0 and added Checkov suppressions.
+- Updated the [customizations-for-aws-control-tower.template](aws_sra_examples/solutions/common/common_cfct_setup/templates/) to the latest version v2.4.0 and added Checkov suppressions.
 - Updated pyproject.toml dependencies to the latest versions.
 - Updated [Macie](aws_sra_examples/solutions/macie/macie_org) solution to increase retries and handle API errors when creating existing members.
 - Updated [EC2 Default EBS Encryption](aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption) to include default string value for the pExcludeEC2DefaultEBSEncryptionTags parameter.