awslabs / awslabs/agentcore-samples

01-tutorials Bug: Policy Engine tutorial fails with "AuthorizerConfiguration is required for CUSTOM_JWT authorizer type"

Open
#953 0 comments 0 reactions 1 assignee Claimed by @akshseh View on GitHub
01-tutorials bug
Dominant language
Python
Stars
3.4k
Forks
1.3k
Avg merge
1d 22h
Merged PRs (30d)
30

Description

**In which component is this bug present?**

- [ ] 01-AgentCore-runtime
- [ ] 02-AgentCore-gateway
- [ ] 03-AgentCore-identity
- [ ] 04-AgentCore-memory
- [ ] 05-AgentCore-tools
- [ ] 06-AgentCore-observability
- [ ] 07-AgentCore-evaluations
- [X] 08-AgentCore-policy

If you are reporting multiple bugs, please create a separate issue for each. For documentation improvements, use the documentation improvement issue type.

**Bug Description**
A clear and concise description of the bug.
```
## Description
The Fine-Grained Access Control tutorial (`01-tutorials/08-AgentCore-policy/03-Fine-Grained-Access-Control/policy_for_agentcore_tutorial.ipynb`) fails when attempting to attach a policy engine to a gateway that uses CUSTOM_JWT authorization.

## Steps to Reproduce
1. Run the Policy Engine Fine-Grained Access Control tutorial
2. Execute the cell that calls `attach_policy_engine_to_gateway(mode="ENFORCE")`
3. Observe the ValidationException error

## Expected Behavior
The policy engine should attach successfully to the gateway.

## Actual Behavior
The operation fails with:
ValidationException: AuthorizerConfiguration is required for CUSTOM_JWT authorizer type

## Root Cause
The `attach_policy_engine_to_gateway()` function uses a cached `gateway_config` variable that doesn't include the `authorizerConfiguration` field, even though the gateway in AWS has it. When calling `update_gateway()` with `authorizerType="CUSTOM_JWT"`, AWS requires the `authorizerConfiguration` parameter.

## Environment
- AWS Region: us-east-1
- Tutorial: 01-tutorials/08-AgentCore-policy/03-Fine-Grained-Access-Control/

## Proposed Solution
Fetch live gateway state from AWS using `get_gateway()` instead of using cached config, and include `authorizerConfiguration` in the update call when present.

```

**Screenshots**
If applicable, add screenshots to help explain your problem.
```
Please provide screenshots here.
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.