feat(bedrockagentcore): add manageDeliveryResourcePolicy opt-out for runtime observability - #38372
Open
sanyamk23 wants to merge 7 commits into
Open
Conversation
github-actions
Bot
added
beginning-contributor
Contributor
aws-cdk-automation
previously requested changes
Jul 22, 2026
Author
|
Exemption Request: The PR already includes README changes in |
aws-cdk-automation
added
the
pr-linter/exemption-requested
aws-cdk-automation
temporarily deployed
to
automation
July 22, 2026 17:38 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
aws-cdk-automation
dismissed
their stale review
July 22, 2026 17:40
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
This was referenced Jul 23, 2026
sanyamk23
force-pushed
the
fix/bedrockagentcore-manage-delivery-resource-policy
branch
from
July 31, 2026 16:08
ddff793 to
f095c09
Compare
sanyamk23
force-pushed
the
fix/bedrockagentcore-manage-delivery-resource-policy
branch
from
August 2, 2026 20:09
f095c09 to
3fc1cd1
Compare
abidhasan-aws
temporarily deployed
to
automation
August 7, 2026 11:09 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Author
|
CI all green. Build workflow is action_required — needs a manual approve on the Actions tab. Note: mergify flagged a conflict with #38332, I'll rebase once that merges. |
Author
|
I added an opt-out flag for manageDeliveryResourcePolicy in Bedrock Agent Core so users can control resource policies manually. Let me know if you have questions. |
sanyamk23
force-pushed
the
fix/bedrockagentcore-manage-delivery-resource-policy
branch
from
August 17, 2026 12:19
30497e0 to
528faac
Compare
sanyamk23
force-pushed
the
fix/bedrockagentcore-manage-delivery-resource-policy
branch
from
August 17, 2026 13:39
528faac to
40b5b82
Compare
sanyamk23
force-pushed
the
fix/bedrockagentcore-manage-delivery-resource-policy
branch
from
August 17, 2026 19:50
40b5b82 to
359d334
Compare
…ross-repo PRs When the GitHub API returns a 404 for the list reviews endpoint (which can happen for cross-repo PRs from forks or when the PROJEN_GITHUB_TOKEN lacks access to the source repository), treat it as no existing reviews rather than crashing the entire validate-pr job. Previously, the 404 error would propagate up to run().catch() in index.ts, causing the process to exit with code 1 and failing the workflow.
…RemovalPolicy works The BrowserCustom construct creates a CfnBrowserCustom plus a ServiceRole child, so CDK never auto-assigns the Cfn resource as the default child. This made Resource.applyRemovalPolicy() throw CannotApplyRemovalPolicy when called on the L2. Explicitly set node.defaultChild to the CfnBrowserCustom, matching how other L2 resources behave. Part of aws#38327.
… removal policy Adds a BrowserWithRemovalPolicy construct to the browser integ test that calls applyRemovalPolicy(DESTROY) on the L2, and regenerates the snapshot to cover the default-child fix from the parent commit. Part of aws#38327.
…runtime observability When deploying many AgentCore Runtime constructs per account/Region, the per-stack AWS::Logs::ResourcePolicy and AWS::XRay::ResourcePolicy created by the observability delivery consume account-level quota slots (CloudWatch Logs: 10, X-Ray: lower). This adds a `manageDeliveryResourcePolicy` prop (defaults to true) that skips resource policy creation while still provisioning delivery sources, destinations, and deliveries. For same-account /aws/vendedlogs/ delivery, the log-delivery service-linked role provides write access without an explicit policy. Closes aws#38342. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
… for runtime observability Adds the manageDeliveryResourcePolicy prop to the Runtime properties table and observability section, with an example showing how to opt out of resource policy creation when deploying many runtimes per account/Region.
…faces under exactOptionalPropertyTypes `ICluster` and `ITaskDefinition` declare several members optional (`?:`), but the concrete classes exposed them through getters typed `T | undefined`. Under TypeScript's `exactOptionalPropertyTypes`, a member typed `T | undefined` is not assignable to an optional `?: T`, so consumers who enable the flag get TS2420 errors and type-checking `aws-cdk-lib` fails for them outright. The library does not build with the flag, so the break is invisible to its own compile. Affected members: - `TaskDefinition.executionRole` (inherited by Ec2/External/Fargate task definitions), and - `Cluster.defaultCloudMapNamespace`, `Cluster.autoscalingGroup`, `Cluster.executeCommandConfiguration`. Convert each getter to a `public readonly x?: T` field. `executionRole` and `defaultCloudMapNamespace` are populated after construction (by `obtainExecutionRole` and `addDefaultCloudMapNamespace`), so they are set through a module-private helper that assigns through a `Writeable` cast; the live view is preserved. `autoscalingGroup` and `executeCommandConfiguration` are only set in the constructor, so they use a direct guarded `readonly` assignment. The fields stay `readonly`, so the jsii assembly is unchanged (the properties remain optional and immutable) and `yarn compat` passes with no new entry. The internal `ImportedCluster` is updated the same way so the module is fully clean. Add behavior tests (undefined by default, populated from props, and the live population via `obtainExecutionRole` / `addDefaultCloudMapNamespace`) and a package-local guard that type-checks the package's concrete classes against their interfaces under the flag, asserting the package stays clean. Refs aws#37996
Merging main brought in addExistingDefaultCloudMapNamespace (aws#36812), which reads and writes the private _defaultCloudMapNamespace backing field that this branch replaces with a readonly defaultCloudMapNamespace field written through setDefaultCloudMapNamespace. The two sides touched different hunks so git merged them without conflict, but the new method no longer compiled (TS2551) and the build failed at jsii. Route the new method through the field and its helper.
sanyamk23
force-pushed
the
fix/bedrockagentcore-manage-delivery-resource-policy
branch
from
August 17, 2026 19:57
359d334 to
2a78844
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue # (if applicable)
Closes #38342.
When deploying many AgentCore Runtime constructs per account/Region, the per-stack AWS::Logs::ResourcePolicy and AWS::XRay::ResourcePolicy created by the observability delivery consume account-level quota slots (CloudWatch Logs: 10, X-Ray: lower). This adds a manageDeliveryResourcePolicy prop (defaults to true) that skips resource policy creation while still provisioning delivery sources, destinations, and deliveries. For same-account /aws/vendedlogs/ delivery, the log-delivery service-linked role provides write access without an explicit policy.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license and that I've followed the contributing guidelines.