Separate local and remote evidence
sam build, sam local invoke, package creation, and Serverless configuration validation can run locally. They are valuable application tests, but they do not prove that Cloud Adapter supports deployment, function management, or invocation in a target environment.
Record each phase separately:
Capture the real call graph
Pin the CLI and plugin versions, then run a disposable project with SDK/CLI debug logging in an isolated environment. Inventory every AWS service and operation. Check each against the service catalog and document any API the tool calls before it reaches the function resource. Do not suppress denied or unsupported discovery calls simply to make the command continue. A skipped IAM, stack, or logs operation can produce a deployment that appears successful but cannot be operated or removed safely.Minimal compatibility fixture
Once the entire call graph is covered, use one small function with:- no production data;
- one explicit runtime and handler;
- one simple invocation payload;
- no custom resources;
- no broad IAM policy;
- a unique stack and artifact prefix;
- a documented cleanup owner.
SAM-specific cautions
sam localtests a local emulator path, not Cloud Adapter.- Managed S3 packaging can introduce a bucket and endpoint you did not configure explicitly.
- Guided deployment stores answers for future runs; review the resulting configuration before reuse.
- Container-image functions add ECR operations and image-platform constraints.
Serverless Framework cautions
- Plugins can add service calls that are absent from the base framework.
- Variable resolvers may call SSM, Secrets Manager, CloudFormation, or other APIs before deployment.
- Deployment buckets and pruning plugins can delete shared artifacts.
- Removal behavior depends on CloudFormation and target retention semantics.