Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

feat(orchestration): scope workflow model admission to the deployed geography

Open
  • Is something wrong?
#846 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
aws, typescript
Domain
cloud, infrastructure

Research direction

Start in cdk/src/handlers/shared/workflows.ts with WORKFLOW_MODEL_ALLOWLIST and disallowedWorkflowModel, then inspect how the stack injects ANTHROPIC_MODEL and ANTHROPIC_DEFAULT_HAIKU_MODEL. Trace the deployed geography plumbing and choose how admission receives it; done means a workflow using a model from another geography is rejected before execution while valid models remain admitted.

Written by the indexing model from the issue text.

Description

enhancement infra-cdk orchestration v1
Component

CDK / infrastructure (cdk/src/handlers/shared/workflows.ts)

Describe the feature

Scope WORKFLOW_MODEL_ALLOWLIST to the geography the deployment actually grants, instead of admitting all seven.

// cdk/src/handlers/shared/workflows.ts
export const WORKFLOW_MODEL_ALLOWLIST: readonly string[] = DEFAULT_BEDROCK_MODEL_IDS.flatMap(
  (bare) => [bare, ...BEDROCK_GEO_REGIONS.map((geo) => `${geo}.${bare}`)],
);

Every geography is admitted regardless of which one the stack was deployed with, so a workflow pinning eu.anthropic.claude-opus-5 on a global deployment passes admission and then fails at turn 0 with AccessDenied — the IAM grant is scoped to one geography's profile ARNs, resolved at synth.

Use case

This is the same failure class the surrounding work exists to eliminate: a model that cannot work is accepted silently and surfaces as an unattributed turn-0 failure rather than a rejection at submit time. repo onboard --model already rejects a wrong-geography value by reading the stack's BedrockGeoRegion output; workflow admission does not.

Proposed solution

The allowlist is a module-level constant in a runtime handler, so the deployed geography is not available where it is currently built. Two shapes:

  1. Deliver the resolved geography to the admission handler as an environment variable (the stack already injects ANTHROPIC_MODEL and ANTHROPIC_DEFAULT_HAIKU_MODEL the same way) and narrow the list at module load.
  2. Fold it into the context-sourced list the file's own comment anticipates ("A future Phase 4 will source this from the repo Blueprint"), which would carry the geography with it.

Not urgent: no shipped workflow pins a model today, so the list is currently unreachable in practice — disallowedWorkflowModel returns null for every shipped descriptor. It becomes reachable the moment one does.

Other information

Raised during review of #806 and deliberately kept out of it — that PR closes the CLI-side and doctor-side instances of this class, and widening it into the runtime admission path needs the geography plumbing above rather than a one-line change.

Dominant language
TypeScript
Stars
158
Forks
49
Avg merge
3d 7h
Merged PRs (30d)
17

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from aws-samples/sample-autonomous-cloud-coding-agents

All issues in aws-samples/sample-autonomous-cloud-coding-agents

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.