In this video we are looking at the CodeCatalyst Action Development Kit (ADK) - a tool that is going to help developers to build custom CodeCatalyst CI/CD Wo...

Beginner’s guide to setting up a dbt dev environment using AWS CodeCatalyst Free Tier, Redshift as target, and VS Code as IDE—based on ryanback-AWS repost article.

2023年4月にGAとなった「CodeCatalyst」を触ってみたので、それについてお話ししようと思います。

著者：佐藤 将(著)　個人出版　2026/1/2(金)配信

A weekly newsletter about Terraform ecosystem (posts, tools, tips&tricks, open-source) with humble opinions by Anton Babenko.

はじめにJapanAWSJrChampionsAdventCalendar日目の投稿です個人的にCodeCatalystが推しサービスでしてJrChampions同士で

Serverless Platform を作る時に、実装の改善をすばやく回したり自動化を進めたりすることはプロダクトのアジリティを高める上で非常に重要になります。 このセッションでは Amazon CodeCatalyst を例として使用してどのようにPlatform team と Stream …

本記事は、CodeCatalyst の Packages 機能を利用しようとしている方向けの記事になります。 具体的には、「CodeCatalyst の Packages 機能の概要を知りたい方」「ローカルパッケージを Amazon CodeCatalyst のパッケージリポジトリに追加してみたい方」向けの記事です。 こんにちは！エンタープライズクラウド部クラウドコンサルティング課の日高です。 もし私のことを少しでも知りたいと思っていただけるなら、私の後輩が書いてくれた以下のブログを覗いてみてください。 sabawaku.serverworks.co.jp 本ブログでは、「CodeCataly…

As Matt already wrote in his project introduction post we have been using Amazon CodeCatalyst to...

本記事は、CodeCatalyst の Packages 機能を利用しようとしている方向けの記事になります。 具体的には、「CodeCatalyst の Packages 機能の概要を知りたい方」「ローカルパッケージを Amazon CodeCatalyst のパッケージリポジトリに追加してみたい方」向けの記事です。 こんにちは！エンタープライズクラウド部クラウドコンサルティング課の日高です。 もし私のことを少しでも知りたいと思っていただけるなら、私の後輩が書いてくれた以下のブログを覗いてみてください。 sabawaku.serverworks.co.jp 本ブログでは、「CodeCataly…

Build a Flutter Web application with an AppSync backend, powered by AWS Amplify

The entire AWS News Blog team is fully focused on writing posts to announce the new services and features during our annual customer conference in Las Vegas, AWS re:Invent! And while we prepare conten...

After careful consideration, we’re announcing availability changes for a select group of AWS services and features. These changes fall into three lifecycle categories: Services and Capabilities moving to Maintenance Services moving to maintenance will no longer be accessible to new customers starting Nov 7, 2025. Current customers can continue using the service or feature while exploring alternative solutions. Amazon Cloud Directory Amazon CodeCatalyst Amazon CodeGuru Reviewer Amazon Fraud Detector Amazon Glacier Amazon S3 Object Lambda Amazon Workspaces Web Access Client for PCoIP (STXHD) AWS Application Discovery Service AWS HealthOmics - Variant and Annotation Store AWS IoT SiteWise Edge Data Processing Pack AWS IoT SiteWise Monitor AWS Mainframe Modernization Service AWS Migration Hub AWS Snowball Edge Compute Optimized AWS Snowball Edge Storage Optimized AWS Systems Manager - Change Manager AWS Systems Manager - Incident Manager AWS Thinkbox Deadline 10 .NET Modernization Tools Services Entering Sunset The following services are entering sunset, and we are announcing the date upon which we will end operations and support of the service. Customers using these services should click on the links below to understand the sunset timeline (typically 12 months), and begin planning migration to alternatives as recommended in the updated service web pages and documentation. Amazon FinSpace Amazon Lookout for Equipment AWS IoT Greengrass v1 AWS Proton Services Reaching End of Support The following services have reached end of support and are no longer available as of October 7, 2025. AWS Mainframe Modernization App Testing For customers affected by these changes, we've prepared comprehensive migration guides and our support teams are ready to assist with your transition. Visit AWS Product Lifecycle Page to learn more. or contact AWS Support.

Amazon Web Servicesは、統合開発環境のAmazon CodeCatalystに統合された生成AI「Amazon Q Developer」の新機能として、アプリケーションに最適なブループリントを提案してくれる機能が正式に追加...

There is a high-severity attack on Amazon CodeCatalyst blueprints that exploits an open-source framework for building them. This vulnerability has been reported by Amazon Web Services. This flaw affects the @amazon-codecatalyst/blueprints.blueprint npm package and can lead to the execution of arbitrary commands in environments operating blueprint resynthesis.  The Amazon CodeCatalyst blueprints serve as template documents for creating software development projects that can be reused. npm package that is affected provides the framework that blueprint authors use to construct these templates and is part of the open-source project AWS CodeCatalyst Blueprints.  During blueprint resynthesis, a vulnerability occurs in the process of determining which files an existing project may modify based on its .ownership-file, which is used to determine whether blueprints can modify them. Versions 0.3.155 and earlier handled the owner field of an entry containing a [local] merge strategy without adequate validation, which left it vulnerable to shell command interpretation.  A repository user with access to commit permissions could potentially use shell metacharacters to alter the affected field. In the context of resynthesis, those characters could be interpreted as commands by the operating system, allowing arbitrary commands to be executed in the resynthesis environment. The executed commands could consequently expose all privileges or credentials available in that environment.  Amazon has rated CVE-2026-85012 as 8.5 on the CVSS 4.0 scale, indicating that it is a high-severity vulnerability. Under CWE-78, which describes improper neutralization of special elements in operating system commands, this vulnerability has been classified as high severity. Amazon CodeCatalyst service deployments that utilize vulnerable versions of the blueprint framework are affected by this issue as opposed to the CodeCatalyst service itself.  As stated by Amazon, CodeCatalyst's resynthesis process operates in a separate environment with unique credentials for each project. Additionally, the service performs server-side validation to block merge strategy commands unless they conform to a restricted allowlist, including older blueprint versions.  AWS Releases Fix for CVE-2026-85012 It has been reported that Amazon has corrected this vulnerability in version 0.3.156 of @amazon-codecatalyst/blueprints.blueprint, which reverts to shell-based command interpretation and executes the relevant command directly in place of shell-based command interpretation. In addition, the patched release restricts accepted values to an allowlisted command format, closing the injection path identified in CVE-2026-85012.  Shell metacharacters are prevented from being interpreted during blueprint resynthesis as additional commands, closing the injection path identified in CVE-2026-85012. There are versions of the package 0.3.155 and earlier that are affected, so Amazon recommends upgrading to version 0.3.156, with forked and derivative implementations also requiring the appropriate security updates. There is no need for Amazon CodeCatalyst customers to respond to this vulnerability on the service-side.  Resynthesis jobs within the service are conducted in isolated environments assigned to specific projects, using scoped credentials. Server-side checks are also applied by AWS to reject [local] merge strategy commands that do not conform to the approved format. In addition, these protections apply when blueprints are published using versions of the framework prior to version 0.3.156.  The primary remediation concern is those projects or development environments that directly utilize the affected open-source framework following the implementation of the package-level fix. This updates the dependency, therefore removing the vulnerable shell execution behavior, and resolving the underlying issue of command injection described in CWE-78. By removing shell interpretation and enforcing an allowlisted command format, version 0.3.156 resolves the underlying command injection issue. Users who are currently using version 0.3.156 should take the necessary steps to update their SDK.