Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Vault × lambda-microvm fail-fast is obsolete after #854 — remove it and budget the pair instead

Open
  • Is something wrong?
#857 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Active
Tech stack
aws, typescript
Domain
cloud, infrastructure, testing

Research direction

Read cdk/src/stacks/agent.ts around line 373 and cdk/test/stacks/agent.test.ts around line 1745, then inspect the resource-budget matrix introduced by #854. Done means the obsolete guard and throw assertion are removed, vault is covered across compute type and tool-gateway combinations within the budget, the #831 limitations bullet is dropped, and a live MicroVM deploy is considered.

Written by the indexing model from the issue text.

Description

bug infra-cdk P2 v1

AgentStack refuses enableLinearIdentityVault together with compute_type=lambda-microvm. That guard was correct when it was written and is not any more: #854 reclaimed 30 resources, so the combination now fits comfortably under the quota. The guard therefore rejects a deployable configuration, and its error message quotes a resource count that is no longer true.

Current behaviour

cdk/src/stacks/agent.ts:373:

if (linearIdentityVaultEnabled && computeType === 'lambda-microvm') {
  throw new Error(
    'enableLinearIdentityVault cannot be combined with '
    + 'compute_type=lambda-microvm: the two together exceed '
    + "CloudFormation's 500-resource limit for this stack (505). ...",
  );
}

It exists so the operator gets both flag names instead of CDK's TooManyResourcesInStack per-type census, which gives no hint that two context flags are the cause. That reasoning still holds — only the arithmetic has changed.

Measured

Synthesized counts (Template.fromStack + 1 for AWS::CDK::Metadata), hard quota 500:

configuration before #854 now
vault + MicroVM 505 — refused 476
vault + MicroVM + tool gateway — 483

Both are inside the 490 budget that #854 introduced.

Why no test caught this

The covering test asserts the throw, at cdk/test/stacks/agent.test.ts:1745:

)).toThrow(
  /enableLinearIdentityVault cannot be combined with .../
);

It passes for exactly as long as the guard exists, so it pins the guard rather than the headroom. It could not have gone red when the room appeared. A guard whose covering test cannot observe the condition it guards is the general shape worth avoiding here.

Proposed change

  1. Delete the guard and the toThrow test.
  2. Add enableLinearIdentityVault as a dimension to the resource-budget matrix introduced by #854 in cdk/test/stacks/agent.test.ts, so vault × compute_type × tool-gateway is measured against the budget. That is the difference between permitting the combination and guarding it, and it is what would have caught this drift.
  3. Drop the corresponding bullet from #831's limitations section.

Notes

The guard is on the #831 branch (feat/809-linear-identity-vault-pr), not on main, so this is a follow-up rather than a defect in a released path — it should land after #831 merges, or be folded into it.

The counts above are from synth, not a live MicroVM deploy. Worth a live deploy on the MicroVM substrate before removing the guard, since the whole point of removing it is to make that path reachable.

Dominant language
TypeScript
Stars
158
Forks
49
Avg merge
3d 7h
Merged PRs (30d)
17

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from aws-samples/sample-autonomous-cloud-coding-agents

All issues in aws-samples/sample-autonomous-cloud-coding-agents

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.