Restrict cors and access policies by aaravmat1209 · Pull Request #64 · ASUCICREPO/Agentic-Job-Search

aaravmat1209 · 2025-10-30T18:33:30Z

No description provided.

…64 directly and fixing deployment

…ssions to specific resources and actions. Update environment variable for Amplify branch.

Copilot

Pull Request Overview

This PR enhances security and fixes configuration issues in the AWS CDK infrastructure for a job search application. The changes implement least-privilege IAM permissions, fix CORS configuration to use dynamic Amplify app URLs, resolve environment variable issues, and correct typos in the codebase.

Replaces wildcard IAM permissions with scoped resource-specific policies for all AWS services
Moves Amplify app creation earlier in the stack to properly configure CORS with the actual app URL
Removes unused aws-lambda package dependency and cleans up stale JavaScript build artifacts
Fixes typos in agent prompts and removes unnecessary await responseStream.finished() calls

Reviewed Changes

Copilot reviewed 5 out of 7 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
backend/package.json	Adds aws-lambda package dependency
backend/package-lock.json	Updates lock file with aws-lambda and transitive dependencies, removes dev-only flags from shared dependencies
backend/lib/backend-stack.ts	Moves Amplify app creation earlier, replaces wildcard IAM policies with scoped permissions, fixes CORS and environment variables
backend/lib/backend-stack.js	Generated JavaScript output from TypeScript compilation
backend/lambda/agent-proxy/index.js	Removes unnecessary `await responseStream.finished()` calls and trailing whitespace
backend/bin/backend.js	Generated JavaScript output from TypeScript compilation
backend/JobSearchAgent/StrandsAgents.py	Fixes typos in job search prompt instructions

Files not reviewed (1)

backend/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-10-30T18:35:50Z

    "@aws-cdk/aws-amplify-alpha": "^2.216.0-alpha.0",
    "@cdklabs/generative-ai-cdk-constructs": "^0.1.309",
    "aws-cdk-lib": "^2.216.0",
+    "aws-lambda": "^1.0.7",


The aws-lambda package appears to be unused in the codebase. This package is typically for running Lambda functions locally, but the project uses AWS CDK with direct Lambda deployment. Consider removing this dependency as it adds unnecessary transitive dependencies (aws-sdk v2, commander, js-yaml, watchpack) to the production bundle.

Suggested change

"aws-lambda": "^1.0.7",

Copilot · 2025-10-30T18:35:50Z

        actions: ["bedrock-agentcore:InvokeAgentRuntime"],
-        resources: ["*"],
+        resources: [
+          `arn:aws:bedrock-agentcore:${aws_region}:${this.account}:runtime/*`


The IAM policy resource ARN pattern appears incorrect. Based on the action bedrock-agentcore:InvokeAgentRuntime, the correct resource pattern should likely be arn:aws:bedrock-agentcore:${aws_region}:${this.account}:agent/* or arn:aws:bedrock-agentcore:${aws_region}:${this.account}:agent-runtime/*, not runtime/*. This may cause authorization failures when invoking the agent.

Suggested change

`arn:aws:bedrock-agentcore:${aws_region}:${this.account}:runtime/*`

`arn:aws:bedrock-agentcore:${aws_region}:${this.account}:agent-runtime/*`

Copilot · 2025-10-30T18:35:50Z

+        conditions: {
+          StringEquals: {
+            "cloudwatch:namespace": "AWS/Bedrock"
+          }
+        }


The IAM policy condition uses conditions as the key, but the correct AWS IAM policy syntax requires Condition (capital C). This will likely cause the policy statement to fail validation or be ignored, allowing broader permissions than intended for CloudWatch metrics.

Copilot · 2025-10-30T18:35:51Z

@@ -0,0 +1,791 @@
+"use strict";


This appears to be a compiled JavaScript file from TypeScript source. Compiled/generated files should typically be excluded from version control by adding them to .gitignore. Consider adding backend/lib/**/*.js and backend/bin/**/*.js to .gitignore to prevent committing build artifacts.

Copilot · 2025-10-30T18:35:51Z

+            effect: iam.Effect.ALLOW,
+            actions: ["bedrock-agentcore:InvokeAgentRuntime"],
+            resources: [
+                `arn:aws:bedrock-agentcore:${aws_region}:${this.account}:agent/*`,


The IAM policy includes both agent/* and agent-runtime/* resource patterns for the bedrock-agentcore:InvokeAgentRuntime action. Verify which resource pattern is correct for this action to avoid granting broader permissions than necessary. The TypeScript version at line 425 only uses runtime/* pattern, creating an inconsistency between the two files.

Suggested change

`arn:aws:bedrock-agentcore:${aws_region}:${this.account}:agent/*`,

Copilot · 2025-10-30T18:35:51Z

+            conditions: {
+                StringEquals: {
+                    "cloudwatch:namespace": "AWS/Bedrock"
+                }
+            }


The IAM policy condition uses lowercase conditions as the key, but AWS IAM policy syntax requires Condition (capital C). This will cause the policy statement to fail validation or be ignored, allowing broader permissions than intended for CloudWatch metrics.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2025-10-30T18:38:08Z

@aaravmat1209 I've opened a new pull request, #65, to work on those changes. Once the pull request is ready, I'll request review from you.

…mproved security and maintainability; streamline access for logs, ECR, X-Ray, and CloudWatch.

…enhance security and simplify policy management.

aryankhanna2004

LGTM

Copilot

Pull Request Overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

backend/package-lock.json: Language not supported

Comments suppressed due to low confidence (1)

backend/lib/backend-stack.ts:1

The trailing comma was added to this line, but this appears to be within a string literal (part of a prompt), not actual JSON code. Adding a trailing comma in JSON strings that will be parsed could cause parsing errors if the consumer expects strict JSON. Verify that the system consuming this prompt can handle trailing commas in JSON examples.

import * as cdk from "aws-cdk-lib";

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-10-30T23:45:23Z

    // Add environment variables to Amplify branch
    mainBranch.addEnvironment('REACT_APP_AGENT_QUALIFIER', 'DEFAULT');
-    mainBranch.addEnvironment('REACT_APP_AGENT_RUNTIME_ARN', 'MANUALLY ADD HERE');
+    mainBranch.addEnvironment('REACT_APP_AGENT_RUNTIME_ARN', 's ADD HERE');


Corrupted text in environment variable placeholder. The value should be 'MANUALLY ADD HERE' to match the pattern used in line 523.

Suggested change

mainBranch.addEnvironment('REACT_APP_AGENT_RUNTIME_ARN', 's ADD HERE');

mainBranch.addEnvironment('REACT_APP_AGENT_RUNTIME_ARN', 'MANUALLY ADD HERE');

Copilot · 2025-10-30T23:45:24Z

+          "sms-voice:SendTextMessage"
+        ],
+        resources: [
+          `arn:aws:sms-voice:${aws_region}:${this.account}:phone-number/${senderNumber.replace('+', '')}`,


The replace('+', '') method only replaces the first occurrence of '+'. If the phone number contains multiple '+' characters (which is unlikely but possible), they won't be removed. Use replaceAll('+', '') or a regular expression .replace(/\+/g, '') to ensure all '+' characters are removed.

Suggested change

`arn:aws:sms-voice:${aws_region}:${this.account}:phone-number/${senderNumber.replace('+', '')}`,

`arn:aws:sms-voice:${aws_region}:${this.account}:phone-number/${senderNumber.replace(/\+/g, '')}`,

aaravmat1209 added 4 commits October 29, 2025 11:27

Add Amplify app configuration with custom build and CORS settings

fd0b7e3

updated the strands agent file with a few minor changes

c520105

Refactor JobSearchAgent image platform configuration to use LINUX_ARM…

9444b1e

…64 directly and fixing deployment

Refactor IAM policies for Bedrock and DynamoDB access; restrict permi…

57fa64e

…ssions to specific resources and actions. Update environment variable for Amplify branch.

Copilot AI review requested due to automatic review settings October 30, 2025 18:33

Copilot AI reviewed Oct 30, 2025

View reviewed changes

Copilot AI mentioned this pull request Oct 30, 2025

[WIP] Update CORS and access policies implementation #65

Closed

Refactor Bedrock agent role permissions to use managed policies for i…

334e95f

…mproved security and maintainability; streamline access for logs, ECR, X-Ray, and CloudWatch.

aryankhanna2004 suggested changes Oct 30, 2025

View reviewed changes

Comment thread backend/lib/backend-stack.ts Outdated

Remove specific Bedrock AgentCore permissions from execution role to …

733545b

…enhance security and simplify policy management.

Copilot AI review requested due to automatic review settings October 30, 2025 23:43

aryankhanna2004 approved these changes Oct 30, 2025

View reviewed changes

Copilot AI reviewed Oct 30, 2025

View reviewed changes

aaravmat1209 merged commit 55a4479 into main Oct 30, 2025
7 checks passed

	`arn:aws:bedrock-agentcore:${aws_region}:${this.account}:runtime/*`
	`arn:aws:bedrock-agentcore:${aws_region}:${this.account}:agent-runtime/*`

	mainBranch.addEnvironment('REACT_APP_AGENT_RUNTIME_ARN', 's ADD HERE');
	mainBranch.addEnvironment('REACT_APP_AGENT_RUNTIME_ARN', 'MANUALLY ADD HERE');

	`arn:aws:sms-voice:${aws_region}:${this.account}:phone-number/${senderNumber.replace('+', '')}`,
	`arn:aws:sms-voice:${aws_region}:${this.account}:phone-number/${senderNumber.replace(/\+/g, '')}`,

Uh oh!

Conversation

aaravmat1209 commented Oct 30, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

aaravmat1209 Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Oct 30, 2025

Uh oh!

Uh oh!

aryankhanna2004 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants