cleveragents/cleveragents-core

Fork 3

UAT: `CloudResourceHandler.resolve()` skips credential validation for hierarchical cloud types (e.g. `aws-vpc`, `aws-ec2-instance`) — only account-level types are validated #5917

New issue

Open

opened 2026-04-09 11:46:57 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-09 11:46:57 +00:00

Owner

Bug Report

Feature Area: Resource Management — Cloud Infrastructure Resources
Milestone Scope: v3.6.0 (cloud resource handler, issue #343)
Severity: Medium — credential validation gap allows invalid cloud resources to pass validation silently

What Was Tested

Code-level analysis of src/cleveragents/resource/handlers/cloud.py CloudResourceHandler.resolve() method.

Expected Behavior (from spec / docs)

Per docs/reference/cloud_resources.md:

Credentials are resolved in this priority order:

Explicit values — Passed directly via resource properties

Environment variables — Read from the process environment

Profile names (AWS only)

The credential validation should apply to all cloud resource types that carry provider credentials, not just account-level types.

Actual Behavior

CloudResourceHandler.resolve() contains this check:

is_account_type = type_name in (
    "aws",
    "gcp",
    "azure",
    "aws-account",
)
if is_account_type:
    errors = validate_credentials(provider, resolved)
    if errors:
        raise ValueError(...)

This means credential validation is only performed for aws, gcp, azure, and aws-account. All hierarchical types like aws-vpc, aws-ec2-instance, aws-s3-bucket, aws-eks-cluster, aws-region, gcp-*, azure-* etc. skip credential validation entirely.

After skipping validation, all types still raise NotImplementedError (which is expected for stubbed execution), but the validation step is bypassed.

Code Location

src/cleveragents/resource/handlers/cloud.py, CloudResourceHandler.resolve(), lines approximately 200–230.

Steps to Reproduce

Create a cloud resource with type aws-vpc and no credentials set
Call CloudResourceHandler().resolve(resource=..., plan_id=..., slot_name=..., sandbox_manager=...)
Observe: credentials are resolved but NOT validated — no ValueError is raised for missing required fields
The method proceeds directly to raise NotImplementedError(...) without checking credentials

Impact

Users can register aws-vpc, aws-ec2-instance, etc. resources with missing credentials and receive no validation error
The validation gap means the system cannot catch misconfigured cloud resources early
When cloud SDK execution is eventually implemented, these resources will fail at runtime rather than at registration time

Fix

Remove the is_account_type guard and validate credentials for all provider-specific cloud types:

# Validate credentials for all provider-specific types (not generic cloud-* base types)
errors = validate_credentials(provider, resolved)
if errors:
    raise ValueError(
        f"Cloud resource validation failed for '{type_name}' "
        f"(provider={provider}): " + "; ".join(errors)
    )

The provider is None check (for generic cloud-* base types) already handles the case where no provider-specific validation applies.

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Bug Report **Feature Area**: Resource Management — Cloud Infrastructure Resources **Milestone Scope**: v3.6.0 (cloud resource handler, issue #343) **Severity**: Medium — credential validation gap allows invalid cloud resources to pass validation silently --- ## What Was Tested Code-level analysis of `src/cleveragents/resource/handlers/cloud.py` `CloudResourceHandler.resolve()` method. ## Expected Behavior (from spec / docs) Per `docs/reference/cloud_resources.md`: > Credentials are resolved in this priority order: > 1. Explicit values — Passed directly via resource properties > 2. Environment variables — Read from the process environment > 3. Profile names (AWS only) The credential validation should apply to all cloud resource types that carry provider credentials, not just account-level types. ## Actual Behavior `CloudResourceHandler.resolve()` contains this check: ```python is_account_type = type_name in ( "aws", "gcp", "azure", "aws-account", ) if is_account_type: errors = validate_credentials(provider, resolved) if errors: raise ValueError(...) ``` This means credential validation is **only performed** for `aws`, `gcp`, `azure`, and `aws-account`. All hierarchical types like `aws-vpc`, `aws-ec2-instance`, `aws-s3-bucket`, `aws-eks-cluster`, `aws-region`, `gcp-*`, `azure-*` etc. **skip credential validation entirely**. After skipping validation, all types still raise `NotImplementedError` (which is expected for stubbed execution), but the validation step is bypassed. ## Code Location `src/cleveragents/resource/handlers/cloud.py`, `CloudResourceHandler.resolve()`, lines approximately 200–230. ## Steps to Reproduce 1. Create a cloud resource with type `aws-vpc` and no credentials set 2. Call `CloudResourceHandler().resolve(resource=..., plan_id=..., slot_name=..., sandbox_manager=...)` 3. Observe: credentials are resolved but NOT validated — no `ValueError` is raised for missing required fields 4. The method proceeds directly to `raise NotImplementedError(...)` without checking credentials ## Impact - Users can register `aws-vpc`, `aws-ec2-instance`, etc. resources with missing credentials and receive no validation error - The validation gap means the system cannot catch misconfigured cloud resources early - When cloud SDK execution is eventually implemented, these resources will fail at runtime rather than at registration time ## Fix Remove the `is_account_type` guard and validate credentials for all provider-specific cloud types: ```python # Validate credentials for all provider-specific types (not generic cloud-* base types) errors = validate_credentials(provider, resolved) if errors: raise ValueError( f"Cloud resource validation failed for '{type_name}' " f"(provider={provider}): " + "; ".join(errors) ) ``` The `provider is None` check (for generic `cloud-*` base types) already handles the case where no provider-specific validation applies. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 added the

labels

2026-04-09 11:50:03 +00:00

HAL9000 added a new dependency

2026-04-09 12:05:47 +00:00

#5176 EPIC: Extended Resource Types — Cloud Infrastructure, Database & Virtual Resources (v3.6.0)

HAL9000 added the

State

Unverified

label

2026-04-09 12:07:10 +00:00

HAL9000 added this to the v3.5.0 milestone

2026-04-09 12:21:09 +00:00

~~HAL9000 referenced this issue 2026-04-09 12:21:22 +00:00~~

[AUTO-UAT-POOL] UAT Testing Report (Cycle 1) #5750

HAL9000 added

and removed

labels

2026-04-09 12:23:15 +00:00

HAL9000 commented

2026-04-09 12:33:19 +00:00

Author

Owner

Label compliance fix applied:

Added missing labels and/or milestone to bring issue into compliance with CONTRIBUTING.md

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: backlog-groomer

Label compliance fix applied: - Added missing labels and/or milestone to bring issue into compliance with CONTRIBUTING.md --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: backlog-groomer

HAL9000 referenced this issue

2026-04-09 12:35:08 +00:00

[AUTO-PROJ-OWN] Project Owner Report (Cycle 30) #5908

HAL9000 referenced this issue

2026-04-09 12:37:01 +00:00

[AUTO-EPIC] Epic Planning Health Report (Cycle 21) #5883

HAL9000 added the

Points

label

2026-04-09 12:52:45 +00:00