feat: add policy engine and policy support#579
Open
jesseturner21 wants to merge 11 commits intoaws:mainfrom
Open
feat: add policy engine and policy support#579jesseturner21 wants to merge 11 commits intoaws:mainfrom
jesseturner21 wants to merge 11 commits intoaws:mainfrom
Conversation
jesseturner21
had a problem deploying
to
e2e-testing
GitHub Actions
Failure
Add Cedar authorization policy support to AgentCore CLI: - Schema: PolicyEngine and Policy schemas with Zod validation - TUI: Full add/remove wizards for policy engines and policies - Source methods: Cedar file, inline statement, or AI generation - Gateway selection for generation flow - Expandable text input for generation prompts - CLI: Non-interactive add/remove commands with all flags - agentcore add policy-engine --name <name> - agentcore add policy --name <name> --engine <engine> --source/--statement/--generate - agentcore remove policy-engine/policy --name <name> - Deploy: CDK construct integration, CloudFormation output parsing, deployed state tracking with composite engine/policy keys - Status: Policy engines and policies shown in status command and ResourceGraph TUI with correct deployment state diffing - Generation: StartPolicyGeneration + waiter integration with deployed engine ID and gateway ARN resolution - Validation: Schema validation for names, statements, validation modes Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…e collisions Policies are nested under engines, so the same policy name can exist in multiple engines. Switch getRemovable/remove/previewRemove to use an "engineName/policyName" composite key so the generic TUI remove flow can uniquely identify policies with a single string. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Regenerate lock file with npm@10 to resolve missing yaml@2.8.2 dependency entry that caused `npm ci` failures on Node 20.x and 22.x. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Merge duplicate imports in policy-generation.ts - Use dot notation instead of bracket notation in outputs test - Replace Array<T> with T[] in outputs.ts and useDeployFlow.ts - Add void operator for floating promises in AddPolicyFlow - Wrap async handlers with void for no-misused-promises - Escape quotes in JSX text in AddPolicyScreen - Fix prettier formatting across all changed files Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… policy Previously, passing multiple source flags (e.g. --statement + --source) was silently accepted with an implicit precedence order. Now the command returns a clear error if more than one is provided. Also fix pre-existing type errors in dev config tests by adding the required policyEngines field to test fixtures. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add interactive TUI support for removing policy engines and policies, including menu entries, selection screens, confirmation, and success states. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…h credentials The createManagedOAuthCredential method was only writing the client secret with an incorrect env var name. Now correctly writes both _CLIENT_ID and _CLIENT_SECRET suffixed env vars, matching the pattern used by CredentialPrimitive. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
jesseturner21
had a problem deploying
to
e2e-testing
GitHub Actions
Failure
Contributor
Author
📦 Package Tarballaws-agentcore-0.3.0-preview.6.0.tgz How to installnpm install https://github.com/jesseturner21/agentcore-cli/releases/download/pr-579-tarball/aws-agentcore-0.3.0-preview.6.0.tgz
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds full policy engine and policy primitive support to the AgentCore CLI, including schema definitions, CLI commands, TUI wizards, deploy pipeline integration, and removal flows.
Key changes:
PolicyEnginePrimitiveandPolicyPrimitivewith full add/remove lifecycleadd policy-engine,add policy(with--statement,--source,--generatemutually exclusive flags),remove policy-engine,remove policyPolicyEngineConfigurationwiring to associate policy engines with gatewaysRelated Issue
N/A
Documentation PR
Type of Change
Testing
How have you tested the change?
npm run test:unitandnpm run test:integnpm run typechecknpm run lintsrc/assets/, I rannpm run test:update-snapshotsand committed the updated snapshotsChecklist
Note: This PR depends on the corresponding agentcore-l3-cdk-constructs PR for the CDK PolicyEngine/Policy constructs.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.