aws-lambda-to-cloud-run-migration

No evidence of embedded malware or sabotage behavior is present in this SAM template fragment itself; it defines standard AWS resources for an API-to-DynamoDB/SNS workflow. The standout risk is hardcoding a sensitive CLIENT_SECRET directly in Lambda environment variables, which materially increases credential leakage risk. The configured INTERNAL_API_URL with provided credentials suggests the Lambda may perform authenticated outbound enrichment calls, but the actual behavior cannot be confirmed without the handler code.