From f0eb1a1a3435bcd2e367caf7724dec112c81704b Mon Sep 17 00:00:00 2001 From: Roy Osherove <575051+royosherove@users.noreply.github.com> Date: Sun, 16 Aug 2026 14:40:03 +0000 Subject: [PATCH] fix(lambda): restore masked strings in WebUIUserCreationFunction MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two literal *** artifacts leaked into the Lambda ZipFile in PR #83: Line 1599: Password=*** → Password=password, Line 1643: password = ***) → password = generate_password() These were sanitized display masks (from a tool that redacts what looks like secrets when rendering diffs) that got baked into the on-disk file during a splice operation. The Lambda failed at import with Runtime.UserCodeSyntaxError: unmatched ')' so the WebUIUserCreationResource never completed. Impact: stack kirocrew-7-233-stack got stuck in CREATE_IN_PROGRESS because CFN kept re-invoking the broken Lambda. Stack was manually deleted; no data lost. Verification: - python3 ast.parse on extracted ZipFile: OK (111 lines) - aws cloudformation validate-template: OK (38 params) - bash -n install.sh: OK --- deploy/cloudformation/template.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/deploy/cloudformation/template.yaml b/deploy/cloudformation/template.yaml index d8b1303..1b3f166 100644 --- a/deploy/cloudformation/template.yaml +++ b/deploy/cloudformation/template.yaml @@ -1596,7 +1596,7 @@ Resources: cognito.admin_set_user_password( UserPoolId=pool_id, Username=email, - Password=*** + Password=password, Permanent=True ) @@ -1640,7 +1640,7 @@ Resources: if old_email and old_email != email: delete_user_safely(cognito, pool_id, old_email) - password = ***) + password = generate_password() create_or_reset_user(cognito, pool_id, email, password) write_secret(sm, secret_arn, email, password)