AWS Security ChangesHomeSearch

AWS serverless-application-model documentation change

Service: serverless-application-model · 2026-05-19 · Documentation low

File: serverless-application-model/latest/developerguide/sam-specification-intrinsic-functions.md

Summary

Updated documentation for AWS::LanguageExtensions transform with CLI support details and usage guidance

Security assessment

Change provides technical documentation for new template processing capabilities. No evidence of security vulnerability remediation or security feature introduction.

Diff

diff --git a/serverless-application-model/latest/developerguide/sam-specification-intrinsic-functions.md b/serverless-application-model/latest/developerguide/sam-specification-intrinsic-functions.md
index c4eaed578..2791a3902 100644
--- a//serverless-application-model/latest/developerguide/sam-specification-intrinsic-functions.md
+++ b//serverless-application-model/latest/developerguide/sam-specification-intrinsic-functions.md
@@ -9 +9,3 @@
-Intrinsic functions are built-in functions that enable you to assign values to properties that are only available at runtime. AWS SAM has limited support for certain intrinsic function properties, so it is unable to resolve some intrinsic functions. Consequently, we recommend adding the `AWS::LanguageExtensions` transform to resolve this. The `AWS::LanguageExtensions` is a macro hosted by CloudFormation that lets you use intrinsic functions and other functionalities that are by default not included in CloudFormation.
+Intrinsic functions are built-in functions that enable you to assign values to properties that are only available at runtime. `AWS::LanguageExtensions` is a macro hosted by CloudFormation that extends the set of intrinsic functions and template constructs available to you, including `Fn::ForEach`, `Fn::Length`, `Fn::ToJsonString`, and `Fn::FindInMap` with `DefaultValue`. The AWS SAM CLI now supports these language extension constructs locally — it expands them during `sam build`, `sam package`, `sam deploy`, `sam sync`, `sam validate`, and the `sam local` commands so the AWS SAM transform can process them, while CloudFormation processes the same `AWS::LanguageExtensions` transform server-side at deploy time.
+
+To use language extensions in a AWS SAM template, list `AWS::LanguageExtensions` in the `Transform` section _before_ `AWS::Serverless-2016-10-31`:
@@ -17,5 +19 @@ Intrinsic functions are built-in functions that enable you to assign values to p
-###### Note
-
-If you use intrinsic functions in CodeUri property, AWS SAM will not be able to correctly parse the values. Consider using `AWS::LanguageExtensions` transform instead.
-
-For more information, refer to [Properties section of AWS::Serverless::Function](./sam-resource-function.html#sam-resource-function-properties).
+For details about how the AWS SAM CLI handles language extensions, including using intrinsic functions in `CodeUri` and other packageable properties, see [CloudFormation language extensions support](./sam-specification-language-extensions.html).
@@ -33 +31 @@ API Gateway extensions
-Example applications
+Language extensions support