fix(import): strip reserved aws: tags from imported resources - #2289
fix(import): strip reserved aws: tags from imported resources#2289jariy17 wants to merge 1 commit into
Conversation
CloudFormation stamps aws:cloudformation:{stack-id,stack-name,logical-id}
on every resource it provisions. A resource retained after its stack is
deleted keeps these as orphans, and they are not customer-writable.
The import commands copied all tags from the source resource verbatim into
agentcore.json. Any aws:-prefixed key then fails TagKeySchema ("aws:" is
reserved) during config validation, blocking the import before any AWS call:
runtimes[0].tags.aws:cloudformation:stack-name: Invalid key in record
Add a shared stripReservedTags() helper and apply it at all four import
read-paths (runtime, memory, gateway, evaluator). User tags are preserved;
reserved tags are dropped and stay untouched on the resource in AWS.
agentcore-devx-automation
Bot
added
agentcore-harness-reviewing
|
Claude Security Review: no high-confidence findings. (run) |
agentcore-devx-automation
Bot
removed
the
claude-security-reviewing
Package TarballHow to installgh release download pr-2289-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.28.1.tgz |
agentcore-devx-automation
Bot
removed
the
agentcore-harness-reviewing
![agentcore-devx-automation[bot]](https://avatars.githubusercontent.com/u/2232217?s=60&v=4){kind=small}
There was a problem hiding this comment.
AgentCore Harness Review
Verdict: Looks good
Nice tight fix. The stripReservedTags helper is applied consistently to every import path that carries tags (import-runtime, import-evaluator, import-memory, import-gateway), and I confirmed the two remaining import modules (import-online-eval, import-pipeline) don't propagate tags into the spec, so nothing is missed. The aws: prefix check matches exactly what TagKeySchema rejects in src/schema/schemas/primitives/tags.ts, and the "returns undefined when nothing remains" contract keeps the callsites clean (...(tags && { tags })).
The test file is a good regression net — it exercises the real TagsSchema rather than mocking it, which is exactly the right level. The runtime-handler test tweak to use importOriginal for ../import-utils is the correct way to keep the mock working now that stripReservedTags is called from inside import-runtime.ts.
No telemetry gap here since this rides on the existing withCommandRunTelemetry wrappers in each import command.
Good to merge.
Coverage Report
|
1 participant
Problem
agentcore import <resource>copies every tag from the source resource intoagentcore.json. CloudFormation stampsaws:cloudformation:{stack-id,stack-name,logical-id}on every resource it provisions, and a resource retained after its stack is deleted keeps these as orphans. Becauseaws:-prefixed keys are reserved and not customer-writable, they failTagKeySchemaduring config validation — blocking the import before any AWS call:Fix
Add a shared
stripReservedTags()helper inimport-utils.tsand apply it at all four import read-paths (runtime, memory, gateway, evaluator). User tags are preserved;aws:-prefixed tags are dropped from the local config and stay untouched on the resource in AWS.The
aws:refine inTagKeySchemais intentionally left in place — it is correct for user-authored tags. Filtering happens at the import read-path instead.Testing
strip-reserved-tags.test.ts: reserved keys dropped, user tags kept,undefinedwhen only reserved remain, and output passesTagsSchema.parse.aws:cloudformation:*tags: pre-fix reproduces the validation failure above; post-fix the import writesagentcore.jsonsuccessfully.vi.mock('../import-utils')factory inimport-runtime-handler.test.tsto spread the real module, so new utils are no longer silently undefined in that test.