(bedrockagentcore): Policy fails with an engine from PolicyEngine.fromPolicyEngineAttributes
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 76/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
Research direction
Find the Policy constructor and inspect the unconditional addDependency call on this.policyEngine.node.defaultChild. Compare how PolicyEngine.fromPolicyEngineAttributes represents imported engines, then check nearby tests for policies using imported engines. Done means the reproduction synthesizes without throwing while dependency handling for non-imported engines still works.
Written by the indexing model from the issue text.
Description
Describe the bug
Policy fails at synth when its policyEngine comes from PolicyEngine.fromPolicyEngineAttributes. The constructor calls addDependency(this.policyEngine.node.defaultChild) unconditionally, and an imported engine has no default child.
Regression Issue
- Select this option if this issue appears to be a regression.
Last Known Working CDK Library Version
No response
Expected Behavior
A policy can be added to an imported policy engine, e.g. one owned by another stack.
Current Behavior
TypeError: Cannot read properties of undefined (reading 'Symbol(@aws-cdk/core.DependableTrait)')
Reproduction Steps
const engine = agentcore.PolicyEngine.fromPolicyEngineAttributes(stack, 'Engine', {
policyEngineArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:policy-engine/example-abc123',
});
new agentcore.Policy(stack, 'Policy', {
policyEngine: engine,
policyName: 'example',
statement: agentcore.PolicyStatement.fromCedar('permit(principal, action, resource);'),
});
Possible Solution
Only add the dependency when the engine has a default child. Workaround today: add an empty child named Default to the imported engine. Possibly related: #38327.
Additional Information/Context
No response
AWS CDK Library version (aws-cdk-lib)
2.276.0
AWS CDK CLI version
n/a
Node.js Version
24
OS
n/a
Language
TypeScript
Language Version
No response
Other information
No response
- Dominant language
- TypeScript
- Stars
- 13k
- Forks
- 4.7k
- Avg merge
- 4d 3h
- Merged PRs (30d)
- 98
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from aws/aws-cdk
-
needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
aws/aws-cdk#39693 · 1 comment ·
Maintainers usually reply within 1 day
-
aws-cdk-lib needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
(stepfunctions-tasks): EmrCreateCluster rejects JsonPath values for ebsRootVolumeSize, ebsRootVolumeIops, ebsRootVolumeThroughput and releaseLabelPossibly taken @haeganm claimed this 7 days ago. Open@aws-cdk/aws-stepfunctions-tasks bug effort/medium p2 potential-regression
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
aws/aws-cdk#39646 · 1 comment ·
Maintainers usually reply within 1 day
-
RDS: Add missing instance-engine versionPossibly taken @daanvzijl claimed this 7 days ago. Open@aws-cdk/aws-rds feature-request p2
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
aws/aws-cdk#39639 · 1 comment ·
Maintainers usually reply within 1 day
-
(synthetics): auto delete underlying resources handler returns a misspelled PhysicalResourceId on CreatePossibly taken @blacksoxx claimed this 7 days ago. Open@aws-cdk/aws-synthetics bug effort/small p2
Difficulty 1/5 Under an hour Newbie friendliness 87/100
aws/aws-cdk#39629 · 2 comments ·
Maintainers usually reply within 1 day
Similar issues
-
grep and find tools search inside VCS directories (.git, .svn, .hg, .jj)Possibly taken @acmerfight claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
earendil-works/pi#12084 ·
Maintainers usually reply within 1 day
-
comp/desktop P3 type/feature
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
NousResearch/hermes-agent#154285 ·
Maintainers usually reply within 1 day
-
agent-reported bug from-app needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
nightly-labs/openbot#8154 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
jdx/mise-action#730 ·
Maintainers usually reply within 1 day
-
area:cards enhancement hand-tail ready-for-agent
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
fil-donadoni/tolaria#9275 ·
Maintainers usually reply within 1 day