cdk-local 0.9.0 → 0.10.0

package/README.md

@@ -108,6 +108,8 @@ Use this for fast iteration on Lambda code, API routing checks, and container ta
 
 Once your stack is deployed to AWS (via the AWS CDK CLI or any other tool), pass `--from-cfn-stack <StackName>` and cdk-local reads the deployed CloudFormation stack to inject real ARNs, Secrets values, and IAM credentials (resolved from your current AWS profile) into the local execution.
 
+For Lambda (`invoke`, `start-api`), this also recovers env-var values that CloudFormation resolved at deploy time but `ListStackResources` does not expose — e.g. `SIBLING_ARN: Fn::GetAtt <OtherFunction>.Arn`. cdk-local reads the deployed function's own resolved `Environment.Variables` (via `lambda:GetFunctionConfiguration`) and fills those keys, so a Lambda that calls a sibling Lambda by ARN runs locally without a manual `--env-vars` entry. (These values enter the local container env in plaintext; Lambda env vars are a non-secret property, so this exposes nothing the deployed function doesn't already surface to any caller with `lambda:GetFunctionConfiguration`.)
+
 #### HTTP APIs & Function URLs — `start-api` (the headline use case)
 
 A local API talking to real AWS — point a frontend at it for end-to-end debugging, including real Cognito JWT verification.

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { i as createLocalStartApiCommand, r as createLocalRunTaskCommand, t as createLocalStartServiceCommand, u as createLocalInvokeCommand } from "./local-start-service-Rit5YxNR.js";
+import { i as createLocalStartApiCommand, r as createLocalRunTaskCommand, t as createLocalStartServiceCommand, u as createLocalInvokeCommand } from "./local-start-service-BbOWJ2dK.js";
 import { Command } from "commander";
 
 //#region src/cli/index.ts
 const program = new Command();
-program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.9.0");
+program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.10.0");
 program.addCommand(createLocalInvokeCommand());
 program.addCommand(createLocalStartApiCommand());
 program.addCommand(createLocalRunTaskCommand());

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","names":[],"sources":["../src/cli/index.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { Command } from 'commander';\nimport { createLocalInvokeCommand } from './commands/local-invoke.js';\nimport { createLocalStartApiCommand } from './commands/local-start-api.js';\nimport { createLocalRunTaskCommand } from './commands/local-run-task.js';\nimport { createLocalStartServiceCommand } from './commands/local-start-service.js';\n\ndeclare const __CDK_LOCAL_VERSION__: string;\n\nconst program = new Command();\nprogram\n  .name('cdkl')\n  .description('Run AWS CDK stacks locally with Docker.')\n  .version(__CDK_LOCAL_VERSION__);\n\nprogram.addCommand(createLocalInvokeCommand());\nprogram.addCommand(createLocalStartApiCommand());\nprogram.addCommand(createLocalRunTaskCommand());\nprogram.addCommand(createLocalStartServiceCommand());\n\nvoid program.parseAsync(process.argv);\n"],"mappings":";;;;;AAUA,MAAM,UAAU,IAAI,SAAS;AAC7B,QACG,KAAK,OAAO,CACZ,YAAY,0CAA0C,CACtD,gBAA8B;AAEjC,QAAQ,WAAW,0BAA0B,CAAC;AAC9C,QAAQ,WAAW,4BAA4B,CAAC;AAChD,QAAQ,WAAW,2BAA2B,CAAC;AAC/C,QAAQ,WAAW,gCAAgC,CAAC;AAE/C,QAAQ,WAAW,QAAQ,KAAK"}
+{"version":3,"file":"cli.js","names":[],"sources":["../src/cli/index.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { Command } from 'commander';\nimport { createLocalInvokeCommand } from './commands/local-invoke.js';\nimport { createLocalStartApiCommand } from './commands/local-start-api.js';\nimport { createLocalRunTaskCommand } from './commands/local-run-task.js';\nimport { createLocalStartServiceCommand } from './commands/local-start-service.js';\n\ndeclare const __CDK_LOCAL_VERSION__: string;\n\nconst program = new Command();\nprogram\n  .name('cdkl')\n  .description('Run AWS CDK stacks locally with Docker.')\n  .version(__CDK_LOCAL_VERSION__);\n\nprogram.addCommand(createLocalInvokeCommand());\nprogram.addCommand(createLocalStartApiCommand());\nprogram.addCommand(createLocalRunTaskCommand());\nprogram.addCommand(createLocalStartServiceCommand());\n\nvoid program.parseAsync(process.argv);\n"],"mappings":";;;;;AAUA,MAAM,UAAU,IAAI,SAAS;AAC7B,QACG,KAAK,OAAO,CACZ,YAAY,0CAA0C,CACtD,iBAA8B;AAEjC,QAAQ,WAAW,0BAA0B,CAAC;AAC9C,QAAQ,WAAW,4BAA4B,CAAC;AAChD,QAAQ,WAAW,2BAA2B,CAAC;AAC/C,QAAQ,WAAW,gCAAgC,CAAC;AAE/C,QAAQ,WAAW,QAAQ,KAAK"}

package/dist/index.d.ts

@@ -43,6 +43,7 @@ interface LocalStateProvider {
   readonly label: string;
   load(stackName: string, synthRegion: string | undefined): Promise<LocalStateRecord | undefined>;
   buildCrossStackResolver(consumerRegion: string): Promise<CrossStackResolver | undefined>;
+  resolveDeployedFunctionEnv?(functionPhysicalId: string): Promise<Record<string, string> | undefined>;
   dispose(): void;
 }
 //#endregion
@@ -114,10 +115,13 @@ declare class CfnLocalStateProvider implements LocalStateProvider {
   private readonly cfnStackName;
   private readonly region;
   private client;
+  private lambdaClient;
   private readonly clientOptions;
   private disposed;
   constructor(opts: CfnLocalStateProviderOptions);
   private getClient;
+  private getLambdaClient;
+  resolveDeployedFunctionEnv(functionPhysicalId: string): Promise<Record<string, string> | undefined>;
   load(_stackName: string, _synthRegion: string | undefined): Promise<LocalStateRecord | undefined>;
   buildCrossStackResolver(_consumerRegion: string): Promise<CrossStackResolver | undefined>;
   dispose(): void;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/local/state-resolver.ts","../src/local/local-state-provider.ts","../src/cli/commands/local-state-source.ts","../src/local/embed-config.ts","../src/cli/commands/local-invoke.ts","../src/cli/commands/local-start-api.ts","../src/cli/commands/local-run-task.ts","../src/cli/commands/local-start-service.ts","../src/local/cfn-local-state-provider.ts","../src/local/intrinsic-utils.ts","../src/local/intrinsic-lambda-arn.ts","../src/local/parameter-mapping.ts","../src/local/api-gateway-response.ts","../src/local/docker-inspect.ts"],"mappings":";;;;UAuLiB,aAAA;EAEf,UAAA;EAGA,YAAA;EAGA,UAAA,EAAY,MAAA;EAcZ,kBAAA,GAAqB,MAAA;EAGrB,UAAA,GAAa,MAAA;EAGb,YAAA;EAGA,QAAA,GAAW,MAAA;EAmBX,cAAA;EAMA,mBAAA;EAyBA,aAAA;AAAA;;;UCxIe,gBAAA;EACf,SAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;AAAA;AAAA,UAqBe,kBAAA;EAOf,aAAA,CAAc,UAAA,WAAqB,OAAA;EAQnC,qBAAA,CACE,aAAA,UACA,cAAA,UACA,UAAA,WACC,OAAA;AAAA;AAAA,UAGY,mBAAA;EAEf,SAAA,EAAW,MAAA,SAAe,aAAA;EAE1B,gBAAA,GAAmB,gBAAA;EAOnB,kBAAA,GAAqB,kBAAA;EAOrB,cAAA;AAAA;;;UCrJe,gBAAA;EAQf,SAAA,EAAW,MAAA,SAAe,aAAA;EAO1B,OAAA,EAAS,MAAA;EAOT,MAAA;AAAA;AAAA,UAsBe,kBAAA;EAAA,SAMN,KAAA;EAQT,IAAA,CAAK,SAAA,UAAmB,WAAA,uBAAkC,OAAA,CAAQ,gBAAA;EAalE,uBAAA,CAAwB,cAAA,WAAyB,OAAA,CAAQ,kBAAA;EAKzD,OAAA;AAAA;;;UC9Ee,uBAAA;EAOf,YAAA;EAEA,MAAA;EAEA,OAAA;EAMA,WAAA;EAAA,CAEC,GAAA;AAAA;AAAA,KAQS,yBAAA,IAA6B,OAAA,EAAS,uBAAA,KAA4B,kBAAA;AAAA,KAUlE,mBAAA,GAAsB,MAAA,SAAe,yBAAA;AAAA,iBAUjC,mBAAA,CAAoB,YAAA,oBAAgC,SAAA;AAAA,iBAapD,gBAAA,CAAiB,IAAA,EAAM,IAAA,CAAK,uBAAA;AAAA,iBAgB5B,gBAAA,CACd,OAAA,EAAS,IAAA,CAAK,uBAAA,6BACd,WAAA;AAAA,cAqBW,qBAAA,SAA8B,KAAA;cAC7B,OAAA;AAAA;AAAA,iBAkBE,wCAAA,CACd,OAAA,EAAS,IAAA,CAAK,uBAAA,mBACd,gBAAA;AAAA,iBAiCc,wBAAA,CACd,OAAA,EAAS,uBAAA,EACT,SAAA,UACA,WAAA,sBACA,mBAAA,GAAsB,mBAAA,GACrB,kBAAA;;;UCtLc,mBAAA;EAMf,OAAA;EAOA,UAAA;EAMA,WAAA;EAOA,kBAAA;EAMA,gBAAA;EAMA,SAAA;AAAA;;;UC8Ee,+BAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBA22BA,wBAAA,CAAyB,IAAA,GAAM,+BAAA,GAAuC,OAAA;;;UCzvBrE,iCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBA47FA,0BAAA,CAA2B,IAAA,GAAM,iCAAA,GAAyC,OAAA;;;UCxlGzE,gCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAseA,yBAAA,CAA0B,IAAA,GAAM,gCAAA,GAAwC,OAAA;;;UC5evE,qCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAipBA,8BAAA,CACd,IAAA,GAAM,qCAAA,GACL,OAAA;;;UC/qBc,4BAAA;EAOf,YAAA;EAKA,MAAA;EAiBA,OAAA;AAAA;AAAA,cAGW,qBAAA,YAAiC,kBAAA;EAAA,SAG5B,KAAA;EAAA,iBACC,YAAA;EAAA,iBACA,MAAA;EAAA,QAKT,MAAA;EAAA,iBACS,aAAA;EAAA,QAQT,QAAA;cAEI,IAAA,EAAM,4BAAA;EAAA,QAOV,SAAA;EA+BK,IAAA,CACX,UAAA,UACA,YAAA,uBACC,OAAA,CAAQ,gBAAA;EA4DE,uBAAA,CACX,eAAA,WACC,OAAA,CAAQ,kBAAA;EAiEJ,OAAA,CAAA;AAAA;;;iBC1RO,gBAAA,CAAiB,KAAA;;;KCmCrB,uBAAA;EACN,IAAA;EAAkB,SAAA;AAAA;EAClB,IAAA;EAAqB,MAAA;AAAA;AAAA,iBAuBX,yBAAA,CAA0B,KAAA,YAAiB,uBAAA;;;UCpB1C,uBAAA;EAEf,OAAA,EAAS,QAAA,CAAS,MAAA;EAElB,WAAA,EAAa,QAAA,CAAS,MAAA;EAEtB,cAAA,EAAgB,QAAA,CAAS,MAAA;EAEzB,WAAA;EAEA,IAAA;EAEA,OAAA,EAAS,QAAA,CAAS,MAAA;EAElB,cAAA,EAAgB,QAAA,CAAS,MAAA;EAoBzB,UAAA,GAAa,QAAA,CAAS,MAAA;AAAA;AAAA,KASZ,wBAAA;EACN,IAAA;EAAY,QAAA,EAAU,MAAA;AAAA;EACtB,IAAA;EAAe,MAAA;AAAA;AAAA,iBAQL,mCAAA,CACd,UAAA,EAAY,QAAA,CAAS,MAAA,oBACrB,GAAA,EAAK,uBAAA,GACJ,wBAAA;AAAA,iBAkCa,0BAAA,CAA2B,KAAA,UAAe,GAAA,EAAK,uBAAA;;;UCnH9C,sBAAA;EACf,UAAA;EAMA,OAAA,EAAS,MAAA;EAET,OAAA;EAEA,IAAA,EAAM,MAAA;AAAA;AAAA,iBAgBQ,uBAAA,CACd,OAAA,WACA,OAAA,gBACC,sBAAA;;;iBChCmB,qBAAA,CACpB,WAAA,UACA,WAAA,WACC,OAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/local/state-resolver.ts","../src/local/local-state-provider.ts","../src/cli/commands/local-state-source.ts","../src/local/embed-config.ts","../src/cli/commands/local-invoke.ts","../src/cli/commands/local-start-api.ts","../src/cli/commands/local-run-task.ts","../src/cli/commands/local-start-service.ts","../src/local/cfn-local-state-provider.ts","../src/local/intrinsic-utils.ts","../src/local/intrinsic-lambda-arn.ts","../src/local/parameter-mapping.ts","../src/local/api-gateway-response.ts","../src/local/docker-inspect.ts"],"mappings":";;;;UAuLiB,aAAA;EAEf,UAAA;EAGA,YAAA;EAGA,UAAA,EAAY,MAAA;EAcZ,kBAAA,GAAqB,MAAA;EAGrB,UAAA,GAAa,MAAA;EAGb,YAAA;EAGA,QAAA,GAAW,MAAA;EAmBX,cAAA;EAMA,mBAAA;EAyBA,aAAA;AAAA;;;UCxIe,gBAAA;EACf,SAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;AAAA;AAAA,UAqBe,kBAAA;EAOf,aAAA,CAAc,UAAA,WAAqB,OAAA;EAQnC,qBAAA,CACE,aAAA,UACA,cAAA,UACA,UAAA,WACC,OAAA;AAAA;AAAA,UAGY,mBAAA;EAEf,SAAA,EAAW,MAAA,SAAe,aAAA;EAE1B,gBAAA,GAAmB,gBAAA;EAOnB,kBAAA,GAAqB,kBAAA;EAOrB,cAAA;AAAA;;;UCrJe,gBAAA;EAWf,SAAA,EAAW,MAAA,SAAe,aAAA;EAO1B,OAAA,EAAS,MAAA;EAOT,MAAA;AAAA;AAAA,UAsBe,kBAAA;EAAA,SAMN,KAAA;EAQT,IAAA,CAAK,SAAA,UAAmB,WAAA,uBAAkC,OAAA,CAAQ,gBAAA;EAalE,uBAAA,CAAwB,cAAA,WAAyB,OAAA,CAAQ,kBAAA;EA4BzD,0BAAA,EACE,kBAAA,WACC,OAAA,CAAQ,MAAA;EAKX,OAAA;AAAA;;;UC/Ge,uBAAA;EAOf,YAAA;EAEA,MAAA;EAEA,OAAA;EAMA,WAAA;EAAA,CAEC,GAAA;AAAA;AAAA,KAQS,yBAAA,IAA6B,OAAA,EAAS,uBAAA,KAA4B,kBAAA;AAAA,KAUlE,mBAAA,GAAsB,MAAA,SAAe,yBAAA;AAAA,iBAUjC,mBAAA,CAAoB,YAAA,oBAAgC,SAAA;AAAA,iBAapD,gBAAA,CAAiB,IAAA,EAAM,IAAA,CAAK,uBAAA;AAAA,iBAgB5B,gBAAA,CACd,OAAA,EAAS,IAAA,CAAK,uBAAA,6BACd,WAAA;AAAA,cAqBW,qBAAA,SAA8B,KAAA;cAC7B,OAAA;AAAA;AAAA,iBAkBE,wCAAA,CACd,OAAA,EAAS,IAAA,CAAK,uBAAA,mBACd,gBAAA;AAAA,iBAiCc,wBAAA,CACd,OAAA,EAAS,uBAAA,EACT,SAAA,UACA,WAAA,sBACA,mBAAA,GAAsB,mBAAA,GACrB,kBAAA;;;UCtLc,mBAAA;EAMf,OAAA;EAOA,UAAA;EAMA,WAAA;EAOA,kBAAA;EAMA,gBAAA;EAMA,SAAA;AAAA;;;UC+Ee,+BAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAg4BA,wBAAA,CAAyB,IAAA,GAAM,+BAAA,GAAuC,OAAA;;;UC9wBrE,iCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBA4+FA,0BAAA,CAA2B,IAAA,GAAM,iCAAA,GAAyC,OAAA;;;UCzoGzE,gCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAseA,yBAAA,CAA0B,IAAA,GAAM,gCAAA,GAAwC,OAAA;;;UC5evE,qCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAipBA,8BAAA,CACd,IAAA,GAAM,qCAAA,GACL,OAAA;;;UCzqBc,4BAAA;EAOf,YAAA;EAKA,MAAA;EAiBA,OAAA;AAAA;AAAA,cAGW,qBAAA,YAAiC,kBAAA;EAAA,SAG5B,KAAA;EAAA,iBACC,YAAA;EAAA,iBACA,MAAA;EAAA,QAKT,MAAA;EAAA,QAKA,YAAA;EAAA,iBACS,aAAA;EAAA,QAQT,QAAA;cAEI,IAAA,EAAM,4BAAA;EAAA,QAOV,SAAA;EAAA,QAmBA,eAAA;EAyBK,0BAAA,CACX,kBAAA,WACC,OAAA,CAAQ,MAAA;EAmCE,IAAA,CACX,UAAA,UACA,YAAA,uBACC,OAAA,CAAQ,gBAAA;EA4DE,uBAAA,CACX,eAAA,WACC,OAAA,CAAQ,kBAAA;EAiEJ,OAAA,CAAA;AAAA;;;iBCvVO,gBAAA,CAAiB,KAAA;;;KCmCrB,uBAAA;EACN,IAAA;EAAkB,SAAA;AAAA;EAClB,IAAA;EAAqB,MAAA;AAAA;AAAA,iBAuBX,yBAAA,CAA0B,KAAA,YAAiB,uBAAA;;;UCpB1C,uBAAA;EAEf,OAAA,EAAS,QAAA,CAAS,MAAA;EAElB,WAAA,EAAa,QAAA,CAAS,MAAA;EAEtB,cAAA,EAAgB,QAAA,CAAS,MAAA;EAEzB,WAAA;EAEA,IAAA;EAEA,OAAA,EAAS,QAAA,CAAS,MAAA;EAElB,cAAA,EAAgB,QAAA,CAAS,MAAA;EAoBzB,UAAA,GAAa,QAAA,CAAS,MAAA;AAAA;AAAA,KASZ,wBAAA;EACN,IAAA;EAAY,QAAA,EAAU,MAAA;AAAA;EACtB,IAAA;EAAe,MAAA;AAAA;AAAA,iBAQL,mCAAA,CACd,UAAA,EAAY,QAAA,CAAS,MAAA,oBACrB,GAAA,EAAK,uBAAA,GACJ,wBAAA;AAAA,iBAkCa,0BAAA,CAA2B,KAAA,UAAe,GAAA,EAAK,uBAAA;;;UCnH9C,sBAAA;EACf,UAAA;EAMA,OAAA,EAAS,MAAA;EAET,OAAA;EAEA,IAAA,EAAM,MAAA;AAAA;AAAA,iBAgBQ,uBAAA,CACd,OAAA,WACA,OAAA,gBACC,sBAAA;;;iBChCmB,qBAAA,CACpB,WAAA,UACA,WAAA,WACC,OAAA"}

package/dist/index.js

@@ -1,3 +1,3 @@
-import { _ as CfnLocalStateProvider, a as resolveSelectionExpression, c as pickRefLogicalId, d as LocalStateSourceError, f as createLocalStateProvider, g as resolveCfnStackName, h as resolveCfnRegion, i as createLocalStartApiCommand, l as resolveLambdaArnIntrinsic, m as rejectExplicitCfnStackWithMultipleStacks, n as getContainerNetworkIp, o as resolveServiceIntegrationParameters, p as isCfnFlagPresent, r as createLocalRunTaskCommand, s as translateLambdaResponse, t as createLocalStartServiceCommand, u as createLocalInvokeCommand } from "./local-start-service-Rit5YxNR.js";
+import { _ as CfnLocalStateProvider, a as resolveSelectionExpression, c as pickRefLogicalId, d as LocalStateSourceError, f as createLocalStateProvider, g as resolveCfnStackName, h as resolveCfnRegion, i as createLocalStartApiCommand, l as resolveLambdaArnIntrinsic, m as rejectExplicitCfnStackWithMultipleStacks, n as getContainerNetworkIp, o as resolveServiceIntegrationParameters, p as isCfnFlagPresent, r as createLocalRunTaskCommand, s as translateLambdaResponse, t as createLocalStartServiceCommand, u as createLocalInvokeCommand } from "./local-start-service-BbOWJ2dK.js";
 
 export { CfnLocalStateProvider, LocalStateSourceError, createLocalInvokeCommand, createLocalRunTaskCommand, createLocalStartApiCommand, createLocalStartServiceCommand, createLocalStateProvider, getContainerNetworkIp, isCfnFlagPresent, pickRefLogicalId, rejectExplicitCfnStackWithMultipleStacks, resolveCfnRegion, resolveCfnStackName, resolveLambdaArnIntrinsic, resolveSelectionExpression, resolveServiceIntegrationParameters, translateLambdaResponse };

package/dist/{local-start-service-Rit5YxNR.js → local-start-service-BbOWJ2dK.js}

@@ -8,6 +8,7 @@ import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk
 import { AssetManifestArtifact } from "@aws-cdk/cloud-assembly-api";
 import { CdkAppMultiContext, NonInteractiveIoHost, Toolkit } from "@aws-cdk/toolkit-lib";
 import { CloudFormationClient, DescribeStacksCommand, ListExportsCommand, ListStackResourcesCommand } from "@aws-sdk/client-cloudformation";
+import { GetFunctionConfigurationCommand, LambdaClient } from "@aws-sdk/client-lambda";
 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -531,13 +532,18 @@ function resolveCdkPathToLogicalIds(input, index) {
 *     map built from `ListStackResources.StackResourceSummaries[]` (one
 *     entry per `(LogicalResourceId, PhysicalResourceId, ResourceType)`
 *     tuple).
-*   - `Fn::GetAtt: [<LogicalId>, <Attr>]` → **warn-and-drop**. CFn's
-*     `ListStackResources` does NOT return per-attribute values
-*     and the v1 policy (issue #606 recommendation (a)) is to surface
-*     a per-key warn instead of pulling in the full provisioning layer
-*     to call provider-specific describe APIs (e.g. `GetQueueAttributes`
-*     for SQS, `GetFunction` for Lambda). Users override the affected
-*     env var via `--env-vars` if the value is critical.
+*   - `Fn::GetAtt: [<LogicalId>, <Attr>]` → not resolvable from
+*     `ListStackResources` (which returns physical IDs only, no
+*     per-attribute values). For a Lambda function's OWN env vars this
+*     gap is closed by {@link CfnLocalStateProvider.resolveDeployedFunctionEnv}:
+*     because `--from-cfn-stack` means the consumer function is itself
+*     deployed, CloudFormation already resolved every intrinsic (incl.
+*     `Fn::GetAtt <Sibling>.Arn`) into the function's
+*     `Environment.Variables` at deploy time, so the env-substitution
+*     layer reads the concrete value back via
+*     `lambda:GetFunctionConfiguration`. Intrinsic values that are NOT a
+*     consumer-Lambda env var (e.g. an ECS container env entry) still
+*     warn-and-drop and can be overridden via `--env-vars`.
 *   - `Fn::ImportValue: <exportName>` → resolved via `ListExports`
 *     (paginated). Same-region only — CFn exports are region-scoped.
 *   - `Fn::GetStackOutput` → rejected with a clear pointer that the
@@ -574,6 +580,7 @@ var CfnLocalStateProvider = class {
 	cfnStackName;
 	region;
 	client;
+	lambdaClient;
 	clientOptions;
 	disposed = false;
 	constructor(opts) {
@@ -590,6 +597,37 @@ var CfnLocalStateProvider = class {
 		});
 		return this.client;
 	}
+	getLambdaClient() {
+		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
+		if (!this.lambdaClient) this.lambdaClient = new LambdaClient({
+			region: this.region,
+			...this.clientOptions.profile !== void 0 && { profile: this.clientOptions.profile }
+		});
+		return this.lambdaClient;
+	}
+	/**
+	* Read a deployed Lambda function's already-resolved
+	* `Environment.Variables` via `lambda:GetFunctionConfiguration`. See
+	* {@link LocalStateProvider.resolveDeployedFunctionEnv} for why this
+	* closes the `Fn::GetAtt`/`Fn::Sub`/cross-stack gap for a consumer
+	* function's own env vars.
+	*
+	* Best-effort: on any expected miss (function not found, access
+	* denied, throttling) logs a warn and returns `undefined` so the
+	* caller falls back to warn-and-drop on the affected keys. Never
+	* throws out of the substitution pass.
+	*/
+	async resolveDeployedFunctionEnv(functionPhysicalId) {
+		if (this.disposed) throw new Error("CfnLocalStateProvider used after dispose()");
+		const logger = getLogger();
+		const client = this.getLambdaClient();
+		try {
+			return (await client.send(new GetFunctionConfigurationCommand({ FunctionName: functionPhysicalId }))).Environment?.Variables ?? {};
+		} catch (err) {
+			logger.warn(`${this.label}: GetFunctionConfiguration(${functionPhysicalId}) failed: ${formatAwsErrorForWarn(err)}. Intrinsic-valued env vars that need the deployed value will warn-and-drop (grant lambda:GetFunctionConfiguration or override via --env-vars).`);
+			return;
+		}
+	}
 	/**
 	* Load the deployed CFn stack's resources + outputs and return them
 	* as a synthetic `LocalStateRecord` (matching the shape the existing
@@ -675,6 +713,10 @@ var CfnLocalStateProvider = class {
 			this.client.destroy();
 			this.client = void 0;
 		}
+		if (this.lambdaClient) {
+			this.lambdaClient.destroy();
+			this.lambdaClient = void 0;
+		}
 	}
 };
 /**
@@ -2597,6 +2639,52 @@ async function substituteEnvVarsFromStateAsync(templateEnv, contextOrResources)
 		audit
 	};
 }
+/**
+* Last-resort fill for env keys that static substitution could not
+* resolve, using the consumer resource's already-deployed environment.
+*
+* When a Lambda / container is bound to a deployed CloudFormation stack
+* (`--from-cfn-stack`), the consumer itself is deployed, so CloudFormation
+* already resolved every intrinsic (`Fn::GetAtt`, `Fn::Sub`,
+* `Fn::ImportValue`, cross-stack `Ref`) into its concrete deployed env
+* value. `ListStackResources` does not return per-attribute values, so
+* the static substituter drops those keys — but the deployed env carries
+* the answer. The provider fetches the deployed env (e.g.
+* `lambda:GetFunctionConfiguration`) and this helper splices it in for
+* the keys that remained unresolved.
+*
+* Precedence: only keys in `unresolved` are touched — statically resolved
+* keys and literal keys are left exactly as the substituter produced
+* them, and a `--env-vars` override still wins downstream. Keys absent
+* from `deployedEnv` stay unresolved so the caller's warn-and-drop fires.
+*
+* Pure: returns new arrays / a new env map, never mutates the inputs.
+*/
+function applyDeployedEnvFallback(resolvedEnv, unresolved, deployedEnv) {
+	if (!deployedEnv) return {
+		env: resolvedEnv,
+		filled: [],
+		stillUnresolved: [...unresolved]
+	};
+	const env = { ...resolvedEnv };
+	const filled = [];
+	const stillUnresolved = [];
+	for (const item of unresolved) {
+		const deployedValue = deployedEnv[item.key];
+		if (deployedValue !== void 0) {
+			env[item.key] = deployedValue;
+			filled.push(item.key);
+		} else stillUnresolved.push({
+			key: item.key,
+			reason: item.reason
+		});
+	}
+	return {
+		env,
+		filled,
+		stillUnresolved
+	};
+}
 
 //#endregion
 //#region src/local/ecs-task-resolver.ts
@@ -5152,10 +5240,28 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 				}
 				const { env, audit } = await substituteEnvVarsFromStateAsync(templateEnv, subContext);
 				templateEnv = env;
-				stateAudit = audit;
 				const label = stateProvider.label;
 				for (const key of audit.resolvedKeys) logger.debug(`${label}: substituted env var ${key}`);
-				for (const { key, reason } of audit.unresolved) logger.warn(`${label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
+				let unresolved = audit.unresolved;
+				const resolvedKeys = [...audit.resolvedKeys];
+				if (unresolved.length > 0 && stateProvider.resolveDeployedFunctionEnv) {
+					const physicalId = loaded.resources[lambda.logicalId]?.physicalId;
+					if (physicalId) {
+						const deployedEnv = await stateProvider.resolveDeployedFunctionEnv(physicalId);
+						const fb = applyDeployedEnvFallback(templateEnv, unresolved, deployedEnv);
+						templateEnv = fb.env;
+						unresolved = fb.stillUnresolved;
+						for (const key of fb.filled) {
+							resolvedKeys.push(key);
+							logger.debug(`${label}: filled env var ${key} from deployed function config`);
+						}
+					}
+				}
+				stateAudit = {
+					resolvedKeys,
+					unresolved
+				};
+				for (const { key, reason } of unresolved) logger.warn(`${label}: could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
 			}
 		} finally {
 			stateProvider.dispose();
@@ -14878,9 +14984,24 @@ async function buildContainerSpec(args) {
 		if (stateBundle.pseudoParameters) context.pseudoParameters = stateBundle.pseudoParameters;
 		const { env, audit } = substituteEnvVarsFromState(templateEnv, context);
 		templateEnv = env;
-		stateAudit = audit;
 		for (const key of audit.resolvedKeys) getLogger().debug(`Lambda ${logicalId}: state source substituted env var ${key}`);
-		for (const { key, reason } of audit.unresolved) getLogger().warn(`Lambda ${logicalId}: state source could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
+		let unresolved = audit.unresolved;
+		const resolvedKeys = [...audit.resolvedKeys];
+		const deployedEnv = stateBundle.deployedEnvByLambda?.get(logicalId);
+		if (unresolved.length > 0 && deployedEnv) {
+			const fb = applyDeployedEnvFallback(templateEnv, unresolved, deployedEnv);
+			templateEnv = fb.env;
+			unresolved = fb.stillUnresolved;
+			for (const key of fb.filled) {
+				resolvedKeys.push(key);
+				getLogger().debug(`Lambda ${logicalId}: filled env var ${key} from deployed function config`);
+			}
+		}
+		stateAudit = {
+			resolvedKeys,
+			unresolved
+		};
+		for (const { key, reason } of unresolved) getLogger().warn(`Lambda ${logicalId}: state source could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
 	}
 	const lambdaCdkPath = readCdkPathOrUndefined(lambda.resource);
 	const envResult = resolveEnvVars(logicalId, lambdaCdkPath, templateEnv, overrides);
@@ -15656,6 +15777,19 @@ async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options,
 				const pseudo = await resolvePseudoParametersForStartApi(loaded.region, options);
 				if (pseudo) bundle.pseudoParameters = pseudo;
 			}
+			if (provider.resolveDeployedFunctionEnv) {
+				const deployedEnvByLambda = /* @__PURE__ */ new Map();
+				for (const logicalId of lambdaIds) {
+					const resource = stack.template.Resources?.[logicalId];
+					if (!resource || resource.Type !== "AWS::Lambda::Function") continue;
+					if (!envHasIntrinsicValue(getTemplateEnv(resource))) continue;
+					const physicalId = loaded.resources[logicalId]?.physicalId;
+					if (!physicalId) continue;
+					const deployedEnv = await provider.resolveDeployedFunctionEnv(physicalId);
+					if (deployedEnv) deployedEnvByLambda.set(logicalId, deployedEnv);
+				}
+				if (deployedEnvByLambda.size > 0) bundle.deployedEnvByLambda = deployedEnvByLambda;
+			}
 			out.set(stackName, bundle);
 			logger.debug(`${provider.label}: loaded state for ${stackName} (${loaded.region})`);
 		} finally {
@@ -18305,4 +18439,4 @@ function createLocalStartServiceCommand(opts = {}) {
 
 //#endregion
 export { CfnLocalStateProvider as _, resolveSelectionExpression as a, pickRefLogicalId as c, LocalStateSourceError as d, createLocalStateProvider as f, resolveCfnStackName as g, resolveCfnRegion as h, createLocalStartApiCommand as i, resolveLambdaArnIntrinsic as l, rejectExplicitCfnStackWithMultipleStacks as m, getContainerNetworkIp as n, resolveServiceIntegrationParameters as o, isCfnFlagPresent as p, createLocalRunTaskCommand as r, translateLambdaResponse as s, createLocalStartServiceCommand as t, createLocalInvokeCommand as u };
-//# sourceMappingURL=local-start-service-Rit5YxNR.js.map
+//# sourceMappingURL=local-start-service-BbOWJ2dK.js.map