awslabs / awslabs/agentcore-samples

06-workshops - [Bug] 07-Temporal Policies: insufficient_scope error caused by GATEWAY_URL env var leaking from prior lab

Open
#2,022 0 comments 0 reactions 1 assignee Claimed by @akshseh View on GitHub
06-workshops bug
Dominant language
Python
Stars
3.4k
Forks
1.3k
Avg merge
1d 22h
Merged PRs (30d)
30

Description

**In which component is this bug present?**

- [ ] 01-AgentCore-runtime
- [ ] 02-AgentCore-gateway
- [ ] 03-AgentCore-identity
- [ ] 04-AgentCore-memory
- [ ] 05-AgentCore-tools
- [ ] 06-AgentCore-observability
- [x] 07-AgentCore-E2E

**Bug Description**

Symptom: "insufficient_scope - The request requires higher privileges than provided by the access token."

Cause: The `GATEWAY_URL` environment variable was set to the FGAC gateway (`fgac-gateway-fasdbyyeeo`) from the previous lab exercise. The backend code checks env vars first (`if (process.env.GATEWAY_URL) return ...`), overriding the correct URL in `setup_config.json`. The FGAC gateway requires specific OAuth scopes that the temporal policies Cognito client doesn't have.

**Suggested Fix**
Either:
1. Workshop instructions should explicitly say to `unset GATEWAY_URL` before starting the temporal policies lab
2. Or the backend should not use `GATEWAY_URL` env var as override, and always read from `setup_config.json`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.