awslabs / awslabs/agentcore-samples

[02-use-cases] Add securing-coding-agents sample with Cedar policies

Open
#1,587 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
3.4k
Forks
1.3k
Avg merge
1d 22h
Merged PRs (30d)
30

Description

**Feature Request**

**Description**
Add a use case sample demonstrating how to secure AI coding agents with Cedar policies on AgentCore Gateway. This fills a gap in the existing samples — the current 02-policy feature tutorial focuses on ABAC with JWT claims for insurance underwriting, but there's no sample showing the coding agent security pattern (path-based file access, command blocklists, tool-level restrictions).

**Motivation**
Every team building AI coding assistants (with Strands, LangGraph, etc.) needs guardrails to prevent agents from:

Accessing files outside the workspace (/etc/passwd, SSH keys)
Running dangerous shell commands (rm -rf /, sudo)
Using unauthorized tools (code execution, HTTP, external APIs)
This is one of the most common questions from teams adopting AgentCore for coding agents.

**Proposed Solution**
A complete sample under 02-use-cases/securing-coding-agents/ that demonstrates:

Cedar policies using context.input conditions (path patterns, command strings)
Forbid-first patterns layered with explicit permit allowlists
Per-target Lambda functions (file, shell, restricted)
18 scenarios (8 ALLOW / 10 DENY) verifying policy enforcement
CloudWatch Logs integration for policy decision auditing
Security documentation for production adaptation
Strands agent demo via MCP

**Implementation**
Ready — PR will follow immediately after this issue is created.

Contributor guide

Open the contributing guide

Research direction

Start by comparing the existing 02-policy feature tutorial with the proposed 02-use-cases/securing-coding-agents/ sample. Define the sample around AgentCore Gateway, Cedar policies, per-target Lambda functions, CloudWatch Logs, and the Strands MCP demo. Done means 18 scenarios pass with 8 ALLOW and 10 DENY decisions, with production security guidance included.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cloud, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.