aws / aws/bedrock-agentcore-starter-toolkit

[BUG] Configure command ignores --execution-role for CodeBuild and launch always attempts role creation despite existing configuration

Open
#148 1 comment 0 reactions 0 assignees View on GitHub
bug runtime
Dominant language
Python
Stars
508
Forks
155
Avg merge
8h 50m
Merged PRs (30d)
4

Description

**Describe the bug**
The agentcore configure command with --execution-role parameter only populates the AWS execution role but ignores the CodeBuild execution role configuration. Subsequently, agentcore launch always attempts to create a new CodeBuild execution role, even when an existing role is provided in the configuration file. This causes deployment failures in environments with restricted IAM role creation permissions.

**To Reproduce**
Steps to reproduce the behavior:

1. Install AgentCore toolkit:
```bash
pip install bedrock-agentcore-starter-toolkit
```
2. Configure agent with existing execution role:
```bash
agentcore configure -e metadata_agent.py --execution-role arn:aws:iam:::role/
```
3. Observe that the generated .bedrock_agentcore.yaml only contains:
```yaml
aws:
execution_role: arn:aws:iam:::role/
```
But missing:
```yaml
codebuild:
execution_role: arn:aws:iam:::role/
```
4. Run launch command:
```bash
agentcore launch
```
5. See error during CodeBuild preparation phase when toolkit attempts to create IAM role

**Expected behavior**

1. The `agentcore configure --execution-role` command should automatically populate both `aws.execution_role` AND `codebuild.execution_role` with the provided role ARN
2. The `agentcore launch` command should respect existing CodeBuild execution roles from configuration and not attempt to create new ones
3. Users should be able to deploy agents using existing IAM roles without requiring role creation permissions

**Environment:**
- OS: Windows 10 (Version 10.0.19045.5965)
- Python version: 3.12.x
- Package version: Latest (bedrock-agentcore-starter-toolkit)
- Installation method: pip
- AWS CLI version: 2.x
- Docker version: 27.0.3

**Root Cause Analysis**

**File:** `src/bedrock_agentcore_starter_toolkit/operations/runtime/configure.py`
- Line ~100: The `configure_bedrock_agentcore()` function only creates AWS config but completely omits CodeBuild configuration
- Missing `codebuild=CodeBuildConfigSchema(execution_role=execution_role_arn)` in agent configuration

**File:** `src/bedrock_agentcore_starter_toolkit/operations/runtime/launch.py`
- Line ~285: The `_execute_codebuild_workflow()` function unconditionally calls:
```python
codebuild_execution_role = codebuild_service.create_codebuild_execution_role(...)
```
- No check for existing `agent_config.codebuild.execution_role` before attempting creation

**Proposed Fix**

**Configure Command Fix:**
```python
# In configure.py, add CodeBuild configuration
config = BedrockAgentCoreAgentSchema(
# ...existing config...
codebuild=CodeBuildConfigSchema(
project_name=None,
execution_role=execution_role_arn,
source_bucket=None,
auto_create_execution_role=not bool(execution_role_arn),
),
)
```

**Launch Command Fix:**
```python
# In launch.py, check for existing role
if agent_config.codebuild.execution_role:
codebuild_execution_role = agent_config.codebuild.execution_role
else:
codebuild_execution_role = codebuild_service.create_codebuild_execution_role(...)
```

**Additional context**

This bug significantly impacts enterprise users who:
- Have restricted IAM permissions (cannot create roles)
- Must use pre-approved, existing IAM roles for security compliance
- Want to use AgentCore in environments with strict IAM governance

Contributor guide

Open the contributing guide

Research direction

Start in src/bedrock_agentcore_starter_toolkit/operations/runtime/configure.py at configure_bedrock_agentcore() and in launch.py at _execute_codebuild_workflow(). Trace how --execution-role is written to .bedrock_agentcore.yaml and how the CodeBuild role is selected during launch. Done means both configuration entries are populated and launch uses an existing CodeBuild role without attempting IAM role creation.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cli, cloud, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.