aws / aws/bedrock-agentcore-starter-toolkit
[BUG] Configure command ignores --execution-role for CodeBuild and launch always attempts role creation despite existing configuration
- Dominant language
- Python
- Stars
- 508
- Forks
- 155
- Avg merge
- 8h 50m
- Merged PRs (30d)
- 4
Description
**Describe the bug**
The agentcore configure command with --execution-role parameter only populates the AWS execution role but ignores the CodeBuild execution role configuration. Subsequently, agentcore launch always attempts to create a new CodeBuild execution role, even when an existing role is provided in the configuration file. This causes deployment failures in environments with restricted IAM role creation permissions.
**To Reproduce**
Steps to reproduce the behavior:
1. Install AgentCore toolkit:
```bash
pip install bedrock-agentcore-starter-toolkit
```
2. Configure agent with existing execution role:
```bash
agentcore configure -e metadata_agent.py --execution-role arn:aws:iam:::role/
```
3. Observe that the generated .bedrock_agentcore.yaml only contains:
```yaml
aws:
execution_role: arn:aws:iam:::role/
```
But missing:
```yaml
codebuild:
execution_role: arn:aws:iam:::role/
```
4. Run launch command:
```bash
agentcore launch
```
5. See error during CodeBuild preparation phase when toolkit attempts to create IAM role
**Expected behavior**
1. The `agentcore configure --execution-role` command should automatically populate both `aws.execution_role` AND `codebuild.execution_role` with the provided role ARN
2. The `agentcore launch` command should respect existing CodeBuild execution roles from configuration and not attempt to create new ones
3. Users should be able to deploy agents using existing IAM roles without requiring role creation permissions
**Environment:**
- OS: Windows 10 (Version 10.0.19045.5965)
- Python version: 3.12.x
- Package version: Latest (bedrock-agentcore-starter-toolkit)
- Installation method: pip
- AWS CLI version: 2.x
- Docker version: 27.0.3
**Root Cause Analysis**
**File:** `src/bedrock_agentcore_starter_toolkit/operations/runtime/configure.py`
- Line ~100: The `configure_bedrock_agentcore()` function only creates AWS config but completely omits CodeBuild configuration
- Missing `codebuild=CodeBuildConfigSchema(execution_role=execution_role_arn)` in agent configuration
**File:** `src/bedrock_agentcore_starter_toolkit/operations/runtime/launch.py`
- Line ~285: The `_execute_codebuild_workflow()` function unconditionally calls:
```python
codebuild_execution_role = codebuild_service.create_codebuild_execution_role(...)
```
- No check for existing `agent_config.codebuild.execution_role` before attempting creation
**Proposed Fix**
**Configure Command Fix:**
```python
# In configure.py, add CodeBuild configuration
config = BedrockAgentCoreAgentSchema(
# ...existing config...
codebuild=CodeBuildConfigSchema(
project_name=None,
execution_role=execution_role_arn,
source_bucket=None,
auto_create_execution_role=not bool(execution_role_arn),
),
)
```
**Launch Command Fix:**
```python
# In launch.py, check for existing role
if agent_config.codebuild.execution_role:
codebuild_execution_role = agent_config.codebuild.execution_role
else:
codebuild_execution_role = codebuild_service.create_codebuild_execution_role(...)
```
**Additional context**
This bug significantly impacts enterprise users who:
- Have restricted IAM permissions (cannot create roles)
- Must use pre-approved, existing IAM roles for security compliance
- Want to use AgentCore in environments with strict IAM governance
Contributor guide
Research direction
Start in src/bedrock_agentcore_starter_toolkit/operations/runtime/configure.py at configure_bedrock_agentcore() and in launch.py at _execute_codebuild_workflow(). Trace how --execution-role is written to .bedrock_agentcore.yaml and how the CodeBuild role is selected during launch. Done means both configuration entries are populated and launch uses an existing CodeBuild role without attempting IAM role creation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- cli, cloud, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100