Repository navigation
fix(terraform): grant intents Lambda dynamodb:ConditionCheckItem - #569
Merged
Merged
Conversation
Gate answers write a TransactWriteItems that fences run and stage ownership with ConditionCheck entries (humanTaskAnswerOwnershipChecks, added in 663962e via #466). DynamoDB authorizes each ConditionCheck as dynamodb:ConditionCheckItem, which the intents role never had, so every answer to an engine gate failed with AccessDeniedException (HTTP 500).
jeromevdl
requested review from
JWThewes,
eipasteur,
leandrodamascena and
svozza
as code owners
October 15, 2026 17:33
eipasteur
approved these changes
Oct 15, 2026
JWThewes
added a commit
that referenced
this pull request
Oct 27, 2026
The completion work adds the first orchestrator-issued transactions with ConditionCheck entries: updateForRun (integration writes, skip receipts, fan-out unit-plan decisions), deleteWorkflowCheckpoint with a run fence, and finalizeUnitCompletion with its unit-plan snapshot check. DynamoDB authorizes each ConditionCheck as dynamodb:ConditionCheckItem, which the orchestrator role never had. The call fails with AccessDeniedException rather than a conditional failure, so the orchestrator ends the intent FAILED with completion_unverified. DynamoDB Local does not enforce IAM, so the behavior tests cannot see this. Add a policy test, as the AgentCore role already has, and grant the action on the process table statement. Same class of failure as #569 for the intents role.
Contributor
|
TEST PURPOSES ONLY — DO NOT TAKE INTO ACCOUNT. Automatically computed PR review signals (deterministic)No production JS/TS in scope; the quality analyzer does not assess Terraform or IAM. Isobar map
Fixed repository map: red marks changed files; green marks static name matches or import links across components. These links indicate possible reach, not proven runtime impact or a risk grade. Signals
Legend
|
jeromevdl
pushed a commit
that referenced
this pull request
Oct 29, 2026
* Prevent incomplete intents from reaching success and publication A dependent walking skeleton or blocked-only lanes could let an intent finish while required current-plan work remained. Validate skeleton and wave selection, halt on unresolved lanes, and use one shared completion evaluator (lambda/shared/unit-completion.js) at section fan-in, final success and initial publication for new histories. Required integration writes are no longer best-effort: an unrecorded integration stops the lane, a lost response is reconciled from persisted state, and final status commits with its completion receipt under run, status, META revision and unit-plan conditions. Marker-absent histories keep their durable operation sequence. Review corrections included: re-promotion reselects a valid skeleton for a regenerated DAG, halt prompts count failed and blocked lanes separately, rewind/recompose return 409 execution_changed when retirement loses run ownership, and intent DELETE matches only the intent route. Squashes the reviewed restructure (originally 8018321..a870e6b) onto main; the deferred preservation-recovery work is not included. * Preserve legacy integrated units and serial completion presentation * Use one new completion policy above marker-absent legacy replay * fix: classify recorded aborts before legacy workflow resolution * fix(terraform): grant v2-orchestrator dynamodb:ConditionCheckItem The completion work adds the first orchestrator-issued transactions with ConditionCheck entries: updateForRun (integration writes, skip receipts, fan-out unit-plan decisions), deleteWorkflowCheckpoint with a run fence, and finalizeUnitCompletion with its unit-plan snapshot check. DynamoDB authorizes each ConditionCheck as dynamodb:ConditionCheckItem, which the orchestrator role never had. The call fails with AccessDeniedException rather than a conditional failure, so the orchestrator ends the intent FAILED with completion_unverified. DynamoDB Local does not enforce IAM, so the behavior tests cannot see this. Add a policy test, as the AgentCore role already has, and grant the action on the process table statement. Same class of failure as #569 for the intents role.
jeromevdl
added
area/infra
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Answering an engine-owned human gate (
POST /projects/{projectId}/intents/{intentId}/gates/{humanTaskId}/answer) returns HTTP 500. The intents Lambda logs:answerHumanTask/answerHumanTaskWithSteeringwrite aTransactWriteItemsthat fences run and stage ownership withConditionCheckentries (humanTaskAnswerOwnershipChecksinlambda/shared/v2-process-store.js). DynamoDB authorizes everyConditionCheckin a transaction asdynamodb:ConditionCheckItem. The intents role grantsTransactWriteItemsbut notConditionCheckItem, so the transaction is rejected whenever the gate carries anorchestratorRunId, which every engine-opened gate does.When it was introduced
ConditionChecks to the gate-answer transaction. dc9d3eb (2026-09-28) later refactored them without changing the transaction.mainin fix: recover Kiro intents after quota exhaustion and lost sessions #466 (fix/463-intent-recovery), merged 2026-10-14.mainsince 2026-10-14 cannot answer engine gates.Fix
Add
dynamodb:ConditionCheckItemto the v2 process-table statement ofaws_iam_role_policy.intents. The AgentCore role already grants it. No other role on that table issuesConditionChecks: over the last 14 days, a deployed stack logged no otherAccessDeniederrors on the table.Impact / rollout
Validation
terraform -chdir=terraform fmt -check -recursivepasses.terraform validatewas not run locally (it requires the CI local-backend override); left to the Terraform CI workflow.