The platform rule is zero npm in cartridge Lambdas. That is easy to hear as “there is no third-party code here”, which is not true — and pretending otherwise makes the rule harder to apply, because the first person who needs a library concludes the rule cannot mean what it says.
What the rule actually removes is the install:
| What is avoided | Why it matters |
|---|---|
| A transitive tree | Five deliberate files instead of a dependency graph. Installing the Cognito library alone would pull in dozens of packages nobody chose or read. |
| An install step | Nothing resolves a version at build time, so nothing can resolve differently tomorrow. |
| Postinstall scripts | The most common supply-chain attack route. Absent, because nothing installs. |
| Lockfile drift | There is no lockfile, because there is nothing to lock. |
What it gives in exchange is a fingerprint per file. The trade is that we update them by hand. On an authentication library, that is the right way round.
| Library | Version | Size | Used for |
|---|---|---|---|
| amazon-cognito-identity-js | 6.3.12 | 113 KB | Console sign-in |
| qrcode-generator | 1.4.4 | 57 KB | The QR code when you enrol an authenticator app |
| Font Awesome Free | 6.5.1 | 500 KB | Icons, everywhere |
| pdf.js (+ worker) | 4.6.82 | 1.7 MB | Showing a PDF next to its extracted data |
Each sits in a vendor/ folder with a record of its version, licence, source and SHA-256 fingerprint.
Those records are tested against the files on every build — a provenance note that has
drifted from its file is worse than none, because it is believed.
| What | Why it is not brought in-house |
|---|---|
| Google Fonts (Inter) | Fonts, not executable code. Self-hosting is possible and is a fair future change. |
| Cognito advanced-security script | An AWS service endpoint, not a package. There is nothing to copy. |
Amazon's own SDK — 17 clients. This is by far the largest dependency on the platform and the one nobody pins: it arrives with the Node 20 runtime, and changes when AWS updates it. That is an accepted trade rather than an oversight — bringing it in-house would mean shipping megabytes into every function and owning its security updates. It is named here so it is a decision on the record, not an omission.
Until recently the Console fetched its sign-in library from a public CDN every time somebody loaded the page. Four things follow from that, and none are hypothetical.
The authentication library executes on the origin that holds the Cognito session. Whoever controls those bytes controls sign-in. A republished or tampered artifact has the user's credentials — and this is the most common supply-chain shape there is, not an exotic one.
If that CDN had an outage, nobody could sign in — because the thing that performs sign-in came from the CDN.
@6.3.12 in a URL asks a third party for something it says is 6.3.12. A fingerprint in
our own repository is the bytes themselves.
Our Font Awesome Pro kit is locked to paycargo.com. Loaded from any other domain it does not
error — it renders with no icons at all, which is the worst way for a dependency to fail. The
platform forbids it by name for that reason.
Six steps. The first is the one that is easy to get wrong.
.min.js on
jsDelivr is jsDelivr's own output, so the unminified original was taken instead — 36 KB larger and
actually verifiable.
vendor/ folder beside the code that loads it.An automated check fails the build if anything a browser loads reaches for a third-party CDN — cartridge screens, the Console, and the shared SDK alike. It covers jsDelivr, unpkg, cdnjs, esm.sh, Skypack and the domain-locked Font Awesome kit.
The Console fetches no executable third-party code at load time. One cartridge (this one) still does, and is recorded as a known exception rather than quietly tolerated.
Every vendored file can be verified against its record:
The engineering detail — exact paths, full fingerprints and the per-file records — is in
docs/dependencies.md in the repository.