awslabs / awslabs/agentcore-samples
[02-use-cases] Add securing-coding-agents sample with Cedar policies
- Dominant language
- Python
- Stars
- 3.4k
- Forks
- 1.3k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 30
Description
**Feature Request**
**Description**
Add a use case sample demonstrating how to secure AI coding agents with Cedar policies on AgentCore Gateway. This fills a gap in the existing samples — the current 02-policy feature tutorial focuses on ABAC with JWT claims for insurance underwriting, but there's no sample showing the coding agent security pattern (path-based file access, command blocklists, tool-level restrictions).
**Motivation**
Every team building AI coding assistants (with Strands, LangGraph, etc.) needs guardrails to prevent agents from:
Accessing files outside the workspace (/etc/passwd, SSH keys)
Running dangerous shell commands (rm -rf /, sudo)
Using unauthorized tools (code execution, HTTP, external APIs)
This is one of the most common questions from teams adopting AgentCore for coding agents.
**Proposed Solution**
A complete sample under 02-use-cases/securing-coding-agents/ that demonstrates:
Cedar policies using context.input conditions (path patterns, command strings)
Forbid-first patterns layered with explicit permit allowlists
Per-target Lambda functions (file, shell, restricted)
18 scenarios (8 ALLOW / 10 DENY) verifying policy enforcement
CloudWatch Logs integration for policy decision auditing
Security documentation for production adaptation
Strands agent demo via MCP
**Implementation**
Ready — PR will follow immediately after this issue is created.
Contributor guide
Research direction
Start by comparing the existing 02-policy feature tutorial with the proposed 02-use-cases/securing-coding-agents/ sample. Define the sample around AgentCore Gateway, Cedar policies, per-target Lambda functions, CloudWatch Logs, and the Strands MCP demo. Done means 18 scenarios pass with 8 ALLOW and 10 DENY decisions, with production security guidance included.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100