Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

project build: skip STS GetCallerIdentity when every deployment target already has an account

Abierto
  • ¿Algo no está bien?
#1,993 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
68/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Tranquilo
Stack tecnológico
aws, typescript
Área
build-system, cli

Línea de trabajo

Comienza en lib/schemas/io/config-io.ts de la biblioteca construct y reproduce el caso de AWS_PROFILE con cuentas explícitas en aws-targets.json. Comprueba resolveRegionFallback() en el mismo método, revisa después el pin en src/assets/cdk/package.json y ejecuta scripts/sync-template-cdk.mjs junto con src/assets/tests/cdk-schema-compat.test.ts. Se considera terminado cuando los targets completamente poblados no activan STS durante la compilación.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug P3

agentcore project build is meant to be fully offline: it runs cdk synth only, and every stack's environment comes from agentcore/aws-targets.json. It currently isn't, when AWS_PROFILE is set.

Found by @aidandaly24 in review of #1970 (comment):

Non-blocking and fine as a follow-up: synthesis succeeds without credentials, but AWS_PROFILE currently causes the pinned ConfigIO.readAWSDeploymentTargets() to call STS even when every target already has an account. I confirmed this by redirecting STS locally. The build still succeeded, but made six GetCallerIdentity attempts and inherited the retry latency. Could we avoid that fallback when account values are already present so build is fully offline?

Cause

In @aws/[email protected], lib/schemas/io/config-io.ts:

// Only resolve account for targets that don't already have one saved
if (process.env.AWS_PROFILE) {
  const account = await detectAwsAccount();   // <-- STS GetCallerIdentity
  if (account) {
    targets = targets.map(t => (t.account ? t : { ...t, account }));
  }
}

The t.account ? t : ... guard is applied to the result. The STS call itself is gated only on AWS_PROFILE being set, so it fires even when it cannot change anything. detectAwsAccount() swallows failures, which is why the build still succeeds — but the SDK's default retry policy is paid first (the six attempts Aidan measured).

Suggested fix

Hoist the guard so the call is skipped when it would be a no-op:

if (process.env.AWS_PROFILE && targets.some(t => !t.account)) {
  ...
}

Worth reviewing resolveRegionFallback() in the same method too — it reads shared config files rather than calling a service, so it's cheap, but it runs unconditionally for the same reason.

Notes

  • The fix lives in the construct library (@aws/agentcore-cdk), not this CLI. Landing it here is then a version bump of the exact pin in src/assets/cdk/package.json (currently 0.1.0-alpha.45), which scripts/sync-template-cdk.mjs and src/assets/__tests__/cdk-schema-compat.test.ts cover.
  • No CLI-side workaround is needed in the meantime: build still succeeds, it's latency plus an unnecessary credential dependency.
  • Repro: set AWS_PROFILE, fill in aws-targets.json with explicit account values, blackhole sts.*.amazonaws.com, then run agentcore project build.

cc @notgitika

Lenguaje dominante
TypeScript
Estrellas
291
Forks
96
Merge medio
17 h 29 min
PR fusionados (30 d)
193

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de aws/agentcore-cli

Todos los issues de aws/agentcore-cli

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.