Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

fix(cdk): carry AgentSessionRole IAM5 suppressions onto model-policy overflow

Open
  • Is something wrong?
#916 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
aws, typescript
Domain
infrastructure, testing

Research direction

Start in cdk/src/main and the synthesis entry points in cdk/src/synthesis/assembly and cdk/src/synthesis/profiles; run the supplied overflow reproduction with extraCount set to 7 and 8. Trace the generated AgentSessionRole overflow policies and the existing suppression, then add the boundary regression for both network topologies. Done means ordinary models remain clean, overflow annotations are present without changing permissions, resource-budget checks still pass, and the focused regression plus normal build succeed.

Written by the indexing model from the issue text.

Description

bug infra-cdk

Large bedrockModels overrides can move already documented Bedrock permissions onto AgentSessionRole/Role/OverflowPolicy1, where the AwsSolutions-IAM5 suppression applied during construction does not follow CDK's later policy split. The result is an error-level cdk-nag finding that blocks CLI synthesis even though the resource count remains within the 490-resource budget.

This is the separate follow-up identified in the review of PR #912, under the broader capacity work in #852. It is separate from the three-AZ budget coverage fix.

Verified structurally on PR #912 at 8720df284c5ed8116870455faa7e65d774d0a3c9, with unchanged dependencies, two-zone auto-pin, global inference profiles, and managed Blueprint provisioning:

Extra model IDs beyond the four shipped defaults Application resources Error-level IAM5 annotations
7 490 2
8 490 3

The reproduction uses literal synthetic IDs anthropic.claude-census-extra-0 through anthropic.claude-census-extra-6 or -7. These are policy-size fixtures; they do not claim model availability. The threshold depends on serialized IAM size and model-ID lengths, so eleven models is not a general model-count limit.

To reproduce from the PR worktree, run the following in cdk/, changing extraCount to 8 for the second case:

CDK_CONTEXT_JSON='{"aws:cdk:bundling-stacks":[]}' \
  mise exec -- node -r ts-node/register/transpile-only <<'NODE'
const fs = require('node:fs');
const os = require('node:os');
const path = require('node:path');
const { buildApp } = require('./src/main');
const { DEFAULT_BEDROCK_MODEL_IDS } = require('./src/handlers/shared/bedrock-model-constants');
const { inspectAssembly } = require('./src/synthesis/assembly');
const { FIXTURE, STRUCTURAL_CONTEXT, synthesisProfiles } = require('./src/synthesis/profiles');

(async () => {
  const extraCount = 7;
  const profile = synthesisProfiles('managed').find(p =>
    p.name === 'lambda-microvm-gw1-reg1-vault1-managed-email-fork');
  const outdir = fs.mkdtempSync(path.join(os.tmpdir(), 'abca-model-overflow-'));
  const app = await buildApp({
    account: FIXTURE.account,
    region: FIXTURE.region,
    describeAzs: async () => [...FIXTURE.zones],
    resolveCallerAccount: async () => FIXTURE.account,
    appProps: {
      outdir,
      autoSynth: false,
      postCliContext: STRUCTURAL_CONTEXT,
      context: {
        ...profile.context,
        bedrockModels: [...DEFAULT_BEDROCK_MODEL_IDS,
          ...Array.from({ length: extraCount }, (_, i) => `anthropic.claude-census-extra-${i}`)],
      },
    },
  });
  app.synth();
  const census = inspectAssembly(outdir);
  console.log(census.templates.map(({ file, resources }) => ({ file, resources })));
  console.log(census.errors);
})().catch(error => { console.error(error); process.exitCode = 1; });
NODE

The missing annotations are on /backgroundagent-dev/AgentSessionRole/Role/OverflowPolicy1/Resource, for bedrock:InvokeModel* and the cross-region foundation-model ARN resources.

Acceptance criteria:

  • Apply evidence-backed suppression to the specific CDK-generated SessionRole overflow policies before cdk-nag checks them, including future OverflowPolicy<N> children.
  • Preserve the emitted IAM permissions: explicit model/inference-profile ARNs, tenant-scoped S3 paths, and DynamoDB leading-key conditions. Do not broaden grants or suppress unrelated roles.
  • Add a boundary regression with a policy-size fixture that forces overflow and checks error-level annotations on both network topologies.
  • Keep the resource budget enforced, and verify the ordinary model set remains clean.
  • Run the focused regression and the normal build.
Dominant language
TypeScript
Stars
158
Forks
49
Avg merge
3d 23h
Merged PRs (30d)
21

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from aws-samples/sample-autonomous-cloud-coding-agents

All issues in aws-samples/sample-autonomous-cloud-coding-agents

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.