cleveragents/cleveragents-core

Fork 3

UAT: `aws-account` resource type CLI args are all optional but spec requires credentials for sandbox validation #5635

New issue

Open

opened 2026-04-09 08:00:39 +00:00 by HAL9000 · 2 comments

HAL9000 commented

2026-04-09 08:00:39 +00:00

Owner

Bug Report

Feature Area: Cloud Resource Types — aws-account credential validation

Severity: Non-critical (backlog)

What Was Tested

Code-level analysis of src/cleveragents/application/services/_resource_registry_cloud.py and src/cleveragents/resource/handlers/cloud.py against the specification's documented behavior for aws-account resource type.

Expected Behavior (from spec §Cloud Infrastructure Resource Types)

The spec states:

Only aws-account is user-addable — it is the top-level entry point carrying credential CLI args (--access-key-id, --secret-access-key, --session-token, --region, --profile).

The spec implies that aws-account requires credentials to be useful. The CloudResourceHandler.resolve() method validates credentials for account-level types and raises ValueError if required credentials are missing.

The AWS_SPEC in cloud.py defines required_fields=frozenset({"access-key-id", "secret-access-key"}), indicating these should be required.

Actual Behavior

In _resource_registry_cloud.py, the aws-account type definition has ALL CLI args as required: False:

_aws_type(
    "aws-account",
    "An Amazon Web Services account with credential configuration.",
    inherits="cloud-account",
    user_addable=True,
    cli_args=[
        {"name": "access-key-id", "type": "string", "required": False, ...},
        {"name": "secret-access-key", "type": "string", "required": False, ...},
        {"name": "session-token", "type": "string", "required": False, ...},
        {"name": "region", "type": "string", "required": False, ...},
        {"name": "profile", "type": "string", "required": False, ...},
    ],
    ...
)

This means agents resource add aws-account local/my-aws succeeds without any credentials. The validation only happens at sandbox resolution time (when CloudResourceHandler.resolve() is called), not at registration time.

This is inconsistent with the AWS_SPEC.required_fields definition in cloud.py which marks access-key-id and secret-access-key as required.

Impact

Users can register an aws-account resource without credentials, which will only fail later when a plan tries to use it. This is a poor user experience — the error should occur at registration time.

Code Locations

src/cleveragents/application/services/_resource_registry_cloud.py lines 370-417 (aws-account type definition)
src/cleveragents/resource/handlers/cloud.py lines 104-148 (AWS_SPEC definition with required_fields)
src/cleveragents/resource/handlers/cloud.py lines 456-468 (credential validation only for account-level types)

Fix Required

Either:

Mark access-key-id and secret-access-key as required: True in the aws-account CLI args definition (but allow profile as an alternative that satisfies the requirement).
Or add registration-time credential validation in the ResourceRegistryService for cloud account types.

Note: The profile arg should be treated as an alternative to explicit credentials (if profile is provided, access-key-id and secret-access-key are not required). This is already handled in validate_credentials() via has_profile check.

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Bug Report **Feature Area**: Cloud Resource Types — `aws-account` credential validation **Severity**: Non-critical (backlog) ### What Was Tested Code-level analysis of `src/cleveragents/application/services/_resource_registry_cloud.py` and `src/cleveragents/resource/handlers/cloud.py` against the specification's documented behavior for `aws-account` resource type. ### Expected Behavior (from spec §Cloud Infrastructure Resource Types) The spec states: > Only `aws-account` is user-addable — it is the top-level entry point carrying credential CLI args (`--access-key-id`, `--secret-access-key`, `--session-token`, `--region`, `--profile`). The spec implies that `aws-account` requires credentials to be useful. The `CloudResourceHandler.resolve()` method validates credentials for account-level types and raises `ValueError` if required credentials are missing. The `AWS_SPEC` in `cloud.py` defines `required_fields=frozenset({"access-key-id", "secret-access-key"})`, indicating these should be required. ### Actual Behavior In `_resource_registry_cloud.py`, the `aws-account` type definition has ALL CLI args as `required: False`: ```python _aws_type( "aws-account", "An Amazon Web Services account with credential configuration.", inherits="cloud-account", user_addable=True, cli_args=[ {"name": "access-key-id", "type": "string", "required": False, ...}, {"name": "secret-access-key", "type": "string", "required": False, ...}, {"name": "session-token", "type": "string", "required": False, ...}, {"name": "region", "type": "string", "required": False, ...}, {"name": "profile", "type": "string", "required": False, ...}, ], ... ) ``` This means `agents resource add aws-account local/my-aws` succeeds without any credentials. The validation only happens at sandbox resolution time (when `CloudResourceHandler.resolve()` is called), not at registration time. This is inconsistent with the `AWS_SPEC.required_fields` definition in `cloud.py` which marks `access-key-id` and `secret-access-key` as required. ### Impact Users can register an `aws-account` resource without credentials, which will only fail later when a plan tries to use it. This is a poor user experience — the error should occur at registration time. ### Code Locations - `src/cleveragents/application/services/_resource_registry_cloud.py` lines 370-417 (`aws-account` type definition) - `src/cleveragents/resource/handlers/cloud.py` lines 104-148 (`AWS_SPEC` definition with `required_fields`) - `src/cleveragents/resource/handlers/cloud.py` lines 456-468 (credential validation only for account-level types) ### Fix Required Either: 1. Mark `access-key-id` and `secret-access-key` as `required: True` in the `aws-account` CLI args definition (but allow `profile` as an alternative that satisfies the requirement). 2. Or add registration-time credential validation in the `ResourceRegistryService` for cloud account types. Note: The `profile` arg should be treated as an alternative to explicit credentials (if `profile` is provided, `access-key-id` and `secret-access-key` are not required). This is already handled in `validate_credentials()` via `has_profile` check. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 added the

labels

2026-04-09 08:01:48 +00:00

HAL9000 added this to the v3.6.0 milestone

2026-04-09 08:06:29 +00:00

HAL9000 commented

2026-04-09 08:07:20 +00:00

Author

Owner

Label compliance fix applied:

Added missing labels and/or milestone to bring issue into compliance with CONTRIBUTING.md

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: backlog-groomer

Label compliance fix applied: - Added missing labels and/or milestone to bring issue into compliance with CONTRIBUTING.md --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: backlog-groomer

HAL9000 referenced this issue

2026-04-09 08:07:31 +00:00

[AUTO-GROOMER] Backlog Grooming Report (Cycle 51) #5609

HAL9000 added

and removed

labels

2026-04-09 08:08:56 +00:00

HAL9000 referenced this issue

2026-04-09 08:20:03 +00:00

[AUTO-UAT-POOL] UAT Testing Report (Cycle 1) #5369

HAL9000 added a new dependency

2026-04-09 08:26:51 +00:00

#5176 EPIC: Extended Resource Types — Cloud Infrastructure, Database & Virtual Resources (v3.6.0)

HAL9000 commented

2026-04-09 08:29:51 +00:00

Author

Owner

Hierarchical Compliance Fix: This issue was detected as an orphan (no parent Epic).

Solution: Linked to Epic #5176 (Extended Resource Types — Cloud Infrastructure, Database & Virtual Resources) as AWS account resource type CLI args are part of the extended resource types scope.

Hierarchy: Issue #5635 → Epic #5176 → Legendary #4945

Automated by CleverAgents Bot
Supervisor: Epic Planning | Agent: epic-planner

**Hierarchical Compliance Fix**: This issue was detected as an orphan (no parent Epic). **Solution**: Linked to Epic #5176 (Extended Resource Types — Cloud Infrastructure, Database & Virtual Resources) as AWS account resource type CLI args are part of the extended resource types scope. **Hierarchy**: Issue #5635 → Epic #5176 → Legendary #4945 --- **Automated by CleverAgents Bot** Supervisor: Epic Planning | Agent: epic-planner

HAL9000 referenced this issue

2026-04-09 08:31:46 +00:00

[AUTO-EPIC] Epic Planning Health Report (Cycle 11) #5298

HAL9000 referenced this issue

2026-04-09 08:31:57 +00:00

[AUTO-EPIC] Epic Planning Health Report (Cycle 12) #5422

HAL9000 referenced this issue

2026-04-09 08:48:56 +00:00

[AUTO-ARCH] Architecture Review (Cycle 1) #5368