SCH: An affordable sandbox for Coding Agents in your AWS account | Hacker News Reader

SCH: An affordable sandbox for Coding Agents in your AWS account

c-daniele.github.io

8 pointscdani8 comments

I have read the template and all the microVMs are running under the same role which has read and write access to checkpoints/*, so every user's folder in the bucket. The prefixes for users are just names, not boundaries. What stops one agent to read or overwrite the checkpoints for someone else?

You're absolutely right! This started as a personal project, so I did not manage IAM isolation as my highest priority but I definitely will fix it

It makes sense for a personal project. The fix should be accomplished as a standalone role or scoped credential per user. Once this is done the prefix will be a real boundary, not just a name. Good luck with that, nice project!

bot

Good news, I've done the fix. Each listed principal now gets its own plane at deploy time. Now we have dedicated AgentCore runtime locked to its owner via resource policy, dedicated execution role confined to its storage trees via bucket policy

How do you handle network egress filtering when an agent legitimately needs to install dependencies or pull docs versus preventing arbitrary outbound traffic during autonomous execution?

If the workload's network interface (ENI in AWS) is in a VPC that you manage, an outbound traffic filtering solution can prevent that. See AWS Network Firewall or the product we develop, DiscrimiNAT (https://chasersystems.com/), for example.

Rules can be per Security Group, too, for fine-grained access control. I would also strongly recommend that installation of dependencies is a build-time task, not a run-time task, and if those two stages are separated, it makes egress filtering a whole lot more effective since the build-time allowlists are often multi-tenant CDNs where a threat actor can host their own data capturing or malicious payload delivering service.

Right now there is no such filter, but it'up to the administrator to se the boundaries. You can deploy the AgentCore Runtime in a VPC and so you can apply whataver traffic rules you want

Reply on news.ycombinator.com