Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Feature Request] Support configuring a custom IAM permissions boundary for generated roles

Abierto
  • ¿Algo no está bien?
#2,246 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
52/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
aws, typescript
Área
cloud, infrastructure

Línea de trabajo

Comienza rastreando el punto de entrada generado bin/cdk.ts a través de la plantilla de CLI y del flujo de materialización de cdk/ utilizado por agentcore deploy. Comprueba cómo se sintetizan los roles de harness y runtime, y verifica después que un boundary configurado llegue a todos los roles generados o creados por L3, que esté ausente de forma predeterminada y que sobreviva a la regeneración y al despliegue.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement
Description

Please add first-class support for attaching a custom IAM permissions boundary to every IAM role that AgentCore generates during agentcore deploy.

Many enterprise and partner AWS accounts enforce an organization-managed permissions boundary on all IAM principals. A common form of this guardrail is an explicit Deny on iam:CreateRole unless the new role attaches a specific policy as its own permissions boundary.

In such accounts, agentcore deploy fails at role creation. Example error when deploying a project with a single harness:

User: arn:aws:sts::<acct>:assumed-role/cdk-hnb659fds-cfn-exec-role-<acct>-<region>/AWSCloudFormation
is not authorized to perform: iam:CreateRole
on resource: arn:aws:iam::<acct>:role/<project>_<harness>
with an explicit deny in a permissions boundary: arn:aws:iam::<acct>:policy/<OrgBoundaryPolicy>
(Status Code: 403; HandlerErrorCode: UnauthorizedTaggingOperation)

The generated roles have no PermissionsBoundary property, so CloudFormation's iam:CreateRole call is denied and the whole stack rolls back. There is currently no supported configuration (CLI flag, aws-targets.json field, env var, or agentcore.json field) to inject a boundary.

I confirmed the root cause is the "must attach boundary on create" rule (creating a probe role with the boundary succeeds; without it 403s). I patched the generated bin/cdk.ts to apply an App-wide boundary via the CDK IAM aspect:

import * as iam from 'aws-cdk-lib/aws-iam';

iam.PermissionsBoundary.of(app).apply(
  iam.ManagedPolicy.fromManagedPolicyArn(
    app,
    'OrgPermissionsBoundary',
    'arn:aws:iam::<acct>:policy/<OrgBoundaryPolicy>'
  )
);

This makes the deploy succeed (stack reaches CREATE_COMPLETE), but it is not viable long-term because agentcore deploy re-materializes the cdk/ directory from CLI templates and overwrites the patch. I must deploy via raw cdk deploy instead, which leaves AgentCore's local state (.cli/deployed-state.json) out of sync.

Acceptance Criteria
  • When configured, every generated IAM role (harness/runtime execution roles, and any L3-created roles) is synthesized with the specified PermissionsBoundary.
  • Works through the standard agentcore deploy flow with no manual edits to generated cdk/ files.
  • Survives cdk/ regeneration/materialization.
  • No boundary is applied when the setting is absent (backward compatible).
Additional Context
  • @aws/agentcore CLI: 0.28.1
  • CDK (bundled): 2.1126.0
  • Node.js: 22.x
  • Deploy target: single-harness project, PYTHON runtime, region <region>
Lenguaje dominante
TypeScript
Estrellas
291
Forks
96
Merge medio
20 h 50 min
PR fusionados (30 d)
214

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de aws/agentcore-cli

Todos los issues de aws/agentcore-cli

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.