diff --git a/packages/@aws-cdk/aws-s3-deployment/lambda/src/requirements.txt b/packages/@aws-cdk/aws-s3-deployment/lambda/src/requirements.txt
index 4fca701665e3c..e6a67df80c224 100644
--- a/packages/@aws-cdk/aws-s3-deployment/lambda/src/requirements.txt
+++ b/packages/@aws-cdk/aws-s3-deployment/lambda/src/requirements.txt
@@ -1,2 +1,3 @@
 awscli==1.16.34
 
+urllib3>=1.26.19 # not directly required, pinned by Snyk to avoid a vulnerability