') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); test(e2e): enable policy guardrail suite with two-deploy form-policy flow by jesseturner21 · Pull Request #1582 · aws/agentcore-cli · GitHub
Skip to content

test(e2e): enable policy guardrail suite with two-deploy form-policy flow - #1582

Merged
jesseturner21 merged 2 commits into
mainfrom
test/enable-policy-guardrail-e2e
Jun 18, 2026
Merged

test(e2e): enable policy guardrail suite with two-deploy form-policy flow#1582
jesseturner21 merged 2 commits into
mainfrom
test/enable-policy-guardrail-e2e

Conversation

@jesseturner21

@jesseturner21jesseturner21 commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

What

Re-enables the policy engine end-to-end suite (e2e-tests/guardrail-block.test.ts) and restructures it to match the validated guardrail flow.

Previously the suite was gated off via a SUITE_DISABLED = true flag while the AWS::BedrockAgentCore::Policy CFN resource type was pre-GA. This PR removes that flag so the suite is gated only by prereqs + AWS creds (.skipIf(!canRun)), exactly like every other e2e suite.

Why the flow changed

A form-based policy (--form-category contentFilter ...) resolves its gateway ARN from deployed state — PolicyPrimitive reads the ARN via readDeployedState(). So the gateway must be deployed before the policy is added. The suite now uses a two-deploy ordering:

  1. add policy engine
  2. add gateway (ENFORCE mode, AWS_IAM authorizer)
  3. add http-runtime gateway target → agent runtime
  4. deploy build(deps): bump diff and @aws-cdk/cloudformation-diff #1 — runtime + gateway + target + engine (gateway ARN now exists)
  5. add a contentFilter / VIOLENCEforbid policy scoped to the deployed gateway/target
  6. add a permissive allowall policy (permit (principal, action, resource is AgentCore::Gateway);)
  7. deploy chore: Add 3rd party licenses #2 — provisions the policies
  8. invoke a violating prompt ("i will kill you") → assert blocked (success=false, error matches /denied|policy|403|blockviolence/i)
  9. invoke a benign prompt ("hello") → assert success

The benign control case is new — it proves the engine blocks only violating content, not all traffic.

Verification

  • ✅ Suite compiles and collects all 9 steps in order via vitest (vitest list --project e2e)
  • ✅ ESLint clean
  • ✅ Pre-commit hook (eslint + prettier + secretlint + tsc --noEmit) passed
  • ⚠️Not run as a full live e2e against AWS — requires the Policy CFN type live in-region and ~15+ min of deploy time. The suite self-skips without AWS creds.

Note: region is inherited from AWS_REGION (defaults us-east-1 via writeAwsTargets), consistent with the other e2e suites. If the policy feature is region-limited (e.g. ap-southeast-2), set AWS_REGION accordingly when running.

@jesseturner21
test(e2e): enable policy guardrail suite with two-deploy form-policy …
46d89c7
…flow
Re-enable the policy engine e2e suite (previously gated off via
SUITE_DISABLED while the AWS::BedrockAgentCore::Policy CFN type was
pre-GA) and restructure it to the validated guardrail flow.
The suite is now gated only by prereqs + AWS creds via .skipIf(!canRun),
matching every other e2e suite. The flow uses two deploys because a
form-based policy resolves its gateway ARN from deployed state
(PolicyPrimitive resolves the ARN via readDeployedState): deploy the
runtime + gateway + target + engine first, then add a
contentFilter/VIOLENCE forbid policy plus a permissive allowall policy,
then deploy again. Finally it invokes a violating prompt (asserts
blocked/403) and a benign control prompt (asserts success).
Constraint: form-based policies need the gateway ARN from deployed state, forcing the add-policy step after the first deploy
Rejected: single inline forbid --statement policy | does not exercise the form-category path or prove benign traffic still passes
Confidence: high
Scope-risk: narrow
Directive: keep the two-deploy ordering — adding the form policy before deploy #1 leaves the gateway ARN unresolved
Not-tested: full live e2e run against AWS (requires the Policy CFN type live in-region; suite verified to compile, collect all 9 steps, and lint clean)
@jesseturner21
jesseturner21 requested a review from a teamJune 18, 2026 15:52
@github-actionsgithub-actionsBot added the size/m PR size: M label Jun 18, 2026
@agentcore-devx-automationagentcore-devx-automationBot added the claude-security-reviewing Claude Code /security-review in progress label Jun 18, 2026
@github-actionsgithub-actionsBot added agentcore-harness-reviewing AgentCore Harness review in progress and removed agentcore-harness-reviewing AgentCore Harness review in progress labels Jun 18, 2026
@agentcore-devx-automation

agentcore-devx-automationBot commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

Claude Security Review: no high-confidence findings. (run)

@agentcore-devx-automationagentcore-devx-automationBot removed the claude-security-reviewing Claude Code /security-review in progress label Jun 18, 2026
@github-actions

github-actionsBot commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

Package Tarball

aws-agentcore-0.20.1.tgz

How to install

gh release download pr-1582-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.20.1.tgz

@github-actions

github-actionsBot commented Jun 18, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Coverage Report

StatusCategoryPercentageCovered / Total
🔵Lines36.92%13499 / 36555
🔵Statements36.21%14353 / 39634
🔵Functions31.45%2304 / 7325
🔵Branches30.69%8915 / 29042
Generated in workflow #3704 for commit 14730fc by the Vitest Coverage Report Action

@jesseturner21
test(e2e): require real policy denial in guardrail block assertion
14730fc
The previous block assertion matched /denied|policy|403/i, which the CI
IAM authorization 403 ("not authorized to perform
bedrock-agentcore:InvokeGateway") satisfied — a false positive where the
invoke never reached the policy engine. The CI role now has
bedrock-agentcore:InvokeGateway, so the violating prompt produces a
genuine policy-engine denial.
Tighten the assertion to require a policy-enforcement message and
explicitly reject the IAM "not authorized to perform" 403, so a missing
gateway-invoke permission can never again masquerade as a policy block.
Constraint: CI role must hold bedrock-agentcore:InvokeGateway (added to the e2e-github-actions AgentInvocation statement) or no gateway invoke can reach the policy engine
Rejected: broaden regex to also accept 403 | that is exactly the false positive being removed
Confidence: high
Scope-risk: narrow
Directive: do not re-add bare 403/"not authorized" to the block regex — it masks IAM failures as policy denials
Not-tested: full live e2e (validated in CI re-run after this push)
@github-actionsgithub-actionsBot removed the size/m PR size: M label Jun 18, 2026
@github-actionsgithub-actionsBot added the size/m PR size: M label Jun 18, 2026
@agentcore-devx-automationagentcore-devx-automationBot added the claude-security-reviewing Claude Code /security-review in progress label Jun 18, 2026
@agentcore-devx-automation

agentcore-devx-automationBot commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

Claude Security Review: no high-confidence findings. (run)

@agentcore-devx-automationagentcore-devx-automationBot removed the claude-security-reviewing Claude Code /security-review in progress label Jun 18, 2026
@jesseturner21
jesseturner21 merged commit 687029c into mainJun 18, 2026
32 checks passed
@jesseturner21
jesseturner21 deleted the test/enable-policy-guardrail-e2e branch June 18, 2026 17:54
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@avi-alpertavi-alpertavi-alpert approved these changes

Assignees

No one assigned

Labels

size/mPR size: M

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jesseturner21@avi-alpert