aws / aws/bedrock-agentcore-starter-toolkit
[BUG] v0.2.5: _attach_inline_policy receives dict instead of JSON string for PolicyDocument
- Dominant language
- Python
- Stars
- 508
- Forks
- 155
- Avg merge
- 8h 50m
- Merged PRs (30d)
- 4
Description
## Bug Description
In `v0.2.5`, the `_attach_inline_policy` function in `create_role.py` receives a `dict` for `policy_document`, but the IAM API expects a JSON `string`.
## Error Message
```
Parameter validation failed:
Invalid type for parameter PolicyDocument, value: {...}, type: , valid types:
```
## Steps to Reproduce
1. Run `agentcore deploy` for a new agent
2. The deployment fails when creating the execution role's inline policy
## Root Cause
In `operations/runtime/create_role.py` line 163:
```python
_attach_inline_policy(
iam_client=iam,
role_name=role_name,
policy_name=policy_name,
policy_document=execution_policy, # ← This is a dict, but should be json.dumps(execution_policy)
logger=logger,
)
```
The `_attach_inline_policy` function (line 295) expects `policy_document: str`, but `execution_policy` is a `dict` returned by `validate_rendered_policy()`.
## Suggested Fix
```python
policy_document=json.dumps(execution_policy),
```
## Environment
- OS: macOS (Darwin 24.6.0)
- Python: 3.13
- bedrock-agentcore-starter-toolkit: 0.2.5
- AWS Region: ap-northeast-1
Contributor guide
Research direction
Start in operations/runtime/create_role.py at the _attach_inline_policy call around line 163, then inspect the function around line 295 and validate_rendered_policy's output. Confirm that the IAM request receives PolicyDocument as a JSON string, then run agentcore deploy for a new agent to verify the execution role's inline policy is created successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100