awslabs / awslabs/agentcore-samples
06-workshops - [Bug] 07-Temporal Policies: insufficient_scope error caused by GATEWAY_URL env var leaking from prior lab
- Dominant language
- Python
- Stars
- 3.4k
- Forks
- 1.3k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 30
Description
**In which component is this bug present?**
- [ ] 01-AgentCore-runtime
- [ ] 02-AgentCore-gateway
- [ ] 03-AgentCore-identity
- [ ] 04-AgentCore-memory
- [ ] 05-AgentCore-tools
- [ ] 06-AgentCore-observability
- [x] 07-AgentCore-E2E
**Bug Description**
Symptom: "insufficient_scope - The request requires higher privileges than provided by the access token."
Cause: The `GATEWAY_URL` environment variable was set to the FGAC gateway (`fgac-gateway-fasdbyyeeo`) from the previous lab exercise. The backend code checks env vars first (`if (process.env.GATEWAY_URL) return ...`), overriding the correct URL in `setup_config.json`. The FGAC gateway requires specific OAuth scopes that the temporal policies Cognito client doesn't have.
**Suggested Fix**
Either:
1. Workshop instructions should explicitly say to `unset GATEWAY_URL` before starting the temporal policies lab
2. Or the backend should not use `GATEWAY_URL` env var as override, and always read from `setup_config.json`
Contributor guide
Assessment
This issue has not been assessed yet.