for CloudFormation deploy, need .lock file

FYI: local deploy works without it
so never noticed that this was out of date