Add claude-agent-sdk patterns to Terraform by kaleko · Pull Request #58 · awslabs/fullstack-solution-template-for-agentcore

kaleko · 2026-03-11T19:45:39Z

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

…iable

github-actions · 2026-03-11T19:50:04Z

Latest scan for commit: ec33efd | Updated: 2026-03-12 14:22:27 UTC

Security Scan Results

Scan Metadata

Project: ASH
Scan executed: 2026-03-12T14:20:49+00:00
ASH version: 3.2.2

Summary

Scanner Results

The table below shows findings by scanner, with status based on severity thresholds and dependencies:

Column Explanations:

Severity Levels (S/C/H/M/L/I):

Suppressed (S): Security findings that have been explicitly suppressed/ignored and don't affect the scanner's pass/fail status
Critical (C): The most severe security vulnerabilities requiring immediate remediation (e.g., SQL injection, remote code execution)
High (H): Serious security vulnerabilities that should be addressed promptly (e.g., authentication bypasses, privilege escalation)
Medium (M): Moderate security risks that should be addressed in normal development cycles (e.g., weak encryption, input validation issues)
Low (L): Minor security concerns with limited impact (e.g., information disclosure, weak recommendations)
Info (I): Informational findings for awareness with minimal security risk (e.g., code quality suggestions, best practice recommendations)

Other Columns:

Time: Duration taken by each scanner to complete its analysis
Action: Total number of actionable findings at or above the configured severity threshold that require attention

Scanner Results:

PASSED: Scanner found no security issues at or above the configured severity threshold - code is clean for this scanner
FAILED: Scanner found security vulnerabilities at or above the threshold that require attention and remediation
MISSING: Scanner could not run because required dependencies/tools are not installed or available
SKIPPED: Scanner was intentionally disabled or excluded from this scan
ERROR: Scanner encountered an execution error and could not complete successfully

Severity Thresholds (Thresh Column):

CRITICAL: Only Critical severity findings cause scanner to fail
HIGH: High and Critical severity findings cause scanner to fail
MEDIUM (MED): Medium, High, and Critical severity findings cause scanner to fail
LOW: Low, Medium, High, and Critical severity findings cause scanner to fail
ALL: Any finding of any severity level causes scanner to fail

Threshold Source: Values in parentheses indicate where the threshold is configured:

(g) = global: Set in the global_settings section of ASH configuration
(c) = config: Set in the individual scanner configuration section
(s) = scanner: Default threshold built into the scanner itself

Statistics calculation:

All statistics are calculated from the final aggregated SARIF report
Suppressed findings are counted separately and do not contribute to actionable findings
Scanner status is determined by comparing actionable findings to the threshold

Scanner	C	Time	Action	Result	Thresh
bandit	0	498ms	0	PASSED	MED (g)
cdk-nag	0	40.4s	0	PASSED	MED (g)
cfn-nag	0	6ms	0	PASSED	MED (g)
checkov	1	7.9s	1	FAILED	MED (g)
detect-secrets	0	937ms	0	PASSED	MED (g)
grype	0	42.9s	0	PASSED	MED (g)
npm-audit	0	175ms	0	PASSED	MED (g)
opengrep	9	26.7s	9	FAILED	MED (g)
semgrep	9	19.2s	9	FAILED	MED (g)
syft	0	1.6s	0	PASSED	MED (g)

Detailed Findings

Show 19 actionable findings

Finding 1: CKV2_AWS_5

Severity: HIGH
Scanner: checkov
Rule ID: CKV2_AWS_5
Location: infra-terraform/modules/backend/runtime.tf:369-379

Description:
Ensure that Security Groups are attached to another resource

Code Snippet:

resource "aws_security_group" "runtime_default" {
  count = var.backend_network_mode == "VPC" && length(var.backend_vpc_security_group_ids) == 0 ? 1 : 0

  name        = "${var.stack_name_base}-agentcore-runtime-sg"
  description = "Default security group for AgentCore Runtime VPC deployment"
  vpc_id      = var.backend_vpc_id

  tags = {
    Name = "${var.stack_name_base}-agentcore-runtime-sg"
  }
}

Finding 2: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: semgrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:126

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const patternDir = path.join(repoRoot, "patterns", pattern)

Finding 3: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: semgrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:154

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const content = fs.readFileSync(path.join(patternDir, file))

Finding 4: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: semgrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:154

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const content = fs.readFileSync(path.join(patternDir, file))

Finding 5: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: semgrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:168

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const requirementsPath = path.join(patternDir, "requirements.txt")

Finding 6: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: semgrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:998

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const fullPath = path.join(dirPath, entry.name)

Finding 7: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: semgrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:998

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const fullPath = path.join(dirPath, entry.name)

Finding 8: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: semgrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:999

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const relativePath = path.join(prefix, entry.name)

Finding 9: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: semgrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:999

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const relativePath = path.join(prefix, entry.name)

Finding 10: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags

Severity: HIGH
Scanner: semgrep
Rule ID: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags
Location: infra-terraform/modules/backend/runtime.tf:14-28

Description:
The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting image_tag_mutability to IMMUTABLE.

Code Snippet:

resource "aws_ecr_repository" "agent" {
  count = local.is_docker && var.container_uri == null ? 1 : 0

  name                 = "${var.stack_name_base}-agent-runtime"
  image_tag_mutability = "MUTABLE"
  force_delete         = true

  image_scanning_configuration {
    scan_on_push = true
  }

  encryption_configuration {
    encryption_type = "AES256"
  }
}

Finding 11: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: opengrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:126

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const patternDir = path.join(repoRoot, "patterns", pattern)

Finding 12: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: opengrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:154

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const content = fs.readFileSync(path.join(patternDir, file))

Finding 13: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: opengrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:154

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const content = fs.readFileSync(path.join(patternDir, file))

Finding 14: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: opengrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:168

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const requirementsPath = path.join(patternDir, "requirements.txt")

Finding 15: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: opengrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:998

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const fullPath = path.join(dirPath, entry.name)

Finding 16: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: opengrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:998

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const fullPath = path.join(dirPath, entry.name)

Finding 17: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: opengrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:999

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const relativePath = path.join(prefix, entry.name)

Finding 18: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Severity: HIGH
Scanner: opengrep
Rule ID: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
Location: infra-cdk/lib/backend-stack.ts:999

Description:
Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Code Snippet:

const relativePath = path.join(prefix, entry.name)

Finding 19: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags

Severity: HIGH
Scanner: opengrep
Rule ID: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags
Location: infra-terraform/modules/backend/runtime.tf:14-28

Description:
The ECR repository allows tag mutability. Image tags could be overwritten with compromised images. ECR images should be set to IMMUTABLE to prevent code injection through image mutation. This can be done by setting image_tag_mutability to IMMUTABLE.

Code Snippet:

resource "aws_ecr_repository" "agent" {
  count = local.is_docker && var.container_uri == null ? 1 : 0

  name                 = "${var.stack_name_base}-agent-runtime"
  image_tag_mutability = "MUTABLE"
  force_delete         = true

  image_scanning_configuration {
    scan_on_push = true
  }

  encryption_configuration {
    encryption_type = "AES256"
  }
}

Report generated by Automated Security Helper (ASH) at 2026-03-12T14:20:43+00:00

kunanit · 2026-03-11T21:59:12Z

Can we also add the equivalent input validation and conditional environment variable from this diff?

https://github.com/awslabs/fullstack-solution-template-for-agentcore/pull/45/files#diff-718b8ef5e762a0e3002e3a6a30e785229a15e2c50001ca09f35364fabb6a6d4f

…E_USE_BEDROCK env var - Add precondition to prevent zip deployment with claude-agent-sdk patterns - Add conditional CLAUDE_CODE_USE_BEDROCK=1 environment variable - Add is_claude_agent_sdk local flag Mirrors CDK backend-stack.ts changes from PR #45.

Rename the default agent name from StrandsAgent to FASTAgent since the template is framework-agnostic and supports multiple patterns. Updated in: - infra-cdk/lib/backend-stack.ts (CfnParameter default) - infra-terraform/modules/backend/locals.tf - infra-terraform/README.md Note: the CDK change is slightly out of scope for this Terraform-focused PR but included here to keep the two infra tools in sync.

Change *.py to **/*.py so files in subdirectories (code_int_mcp/, agents/, tools/) are included in the Docker image content hash. Without this, edits to those files wouldn't trigger a rebuild.

kunanit · 2026-03-12T18:20:30Z

infra-terraform/modules/backend/locals.tf

  is_zip    = var.backend_deployment_type == "zip"

+  # Pattern flags
+  is_claude_agent_sdk = contains(["claude-agent-sdk-single-agent", "claude-agent-sdk-multi-agent"], var.backend_pattern)


kunanit · 2026-03-12T18:21:29Z

infra-terraform/modules/backend/runtime.tf

    [filesha256("${local.pattern_dir}/Dockerfile")],
    [filesha256("${local.pattern_dir}/requirements.txt")],
-    [for f in fileset(local.pattern_dir, "*.py") : filesha256("${local.pattern_dir}/${f}")],
+    [for f in fileset(local.pattern_dir, "**/*.py") : filesha256("${local.pattern_dir}/${f}")],


feat(terraform): add claude-agent-sdk patterns to backend_pattern var…

8379efe

…iable

kaleko requested a review from a team March 11, 2026 19:45

github-actions bot added the infrastructure label Mar 11, 2026

kaleko added 2 commits March 12, 2026 14:11

github-actions bot added the documentation Improvements or additions to documentation label Mar 12, 2026

fix(terraform): use recursive glob for pattern dir change detection

ec33efd

Change *.py to **/*.py so files in subdirectories (code_int_mcp/, agents/, tools/) are included in the Docker image content hash. Without this, edits to those files wouldn't trigger a rebuild.

kaleko self-assigned this Mar 12, 2026

kunanit approved these changes Mar 12, 2026

View reviewed changes

kaleko merged commit 1e8ab2a into main Mar 12, 2026
9 checks passed

Conversation

kaleko commented Mar 11, 2026

Uh oh!

github-actions bot commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security Scan Results

Scan Metadata

Summary

Scanner Results

Detailed Findings

Finding 1: CKV2_AWS_5

Finding 2: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 3: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 4: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 5: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 6: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 7: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 8: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 9: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 10: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags

Finding 11: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 12: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 13: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 14: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 15: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 16: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 17: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 18: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Finding 19: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags

Uh oh!

kunanit commented Mar 11, 2026

Uh oh!

kunanit Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

kunanit Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Mar 11, 2026 •

edited

Loading