[jariy17]

Description

Removes the region allowlist from the CLI. A region without AgentCore now fails at deploy time when CloudFormation rejects the template, instead of being blocked by a hardcoded list that needs a CLI release for every new region.

Changes:

• src/projectSchemas/aws-targets.ts: AgentCoreRegionSchema is z.string().trim().min(1), so an empty region in aws-targets.json reports ✖ Region must not be empty → at [0].region.
• src/core/project/manager.tsx: removed the "Supported regions: …" check when creating the default deployment target. Because a mistyped or not-enabled region now fails at STS, that error names the region and asks the user to check it before suggesting aws login:

  …the AWS account could not be resolved in region 'foo': getaddrinfo ENOTFOUND sts.foo.amazonaws.com
  Check that 'foo' is a region enabled for your account (--region or AWS_REGION), and sign in with 'aws login' …
  

• Tests that expected a rejected region are removed; one test asserts a region outside the old list is accepted.

Not changed: the frozen v0 schema (src/projectSchemas/v0/) and BEDROCK_AGENT_IMPORT_REGIONS (source regions for Bedrock Agent import, a different service).

Error a user now sees from agentcore deploy --region ap-northeast-3:

❌  AgentCore-<project>-default failed: ValidationError: Template format error: Unrecognized resource types: [AWS::BedrockAgentCore::Runtime]

Companion library PR: aws/agentcore-l3-cdk-constructs#439. The vended CDK app pins @aws/agentcore-cdk 1.0.0, which still validates aws-targets.json against the allowlist, so a new region fails at synth until the pin moves to a release containing #439.

Related Issue

N/A

Documentation PR

Not applicable.

Type of Change

• New feature

Testing

• I ran bun test (4698 passed)
• I ran the relevant end-to-end tests with bun run test:e2e — replaced by the manual deploy below
• I ran bun run typecheck
• I ran bun run lint:check
• I ran bun run format:check
• I ran bun run build
• Deployed a project with a Runtime to ap-northeast-3 with this CLI and ci: bump github/codeql-action from 3 to 4 #439 packed locally; CloudFormation rejected the change set with the error above and no stack was created.

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works

[github-actions]

Package Tarball

aws-agentcore-1.0.0.tgz

How to install

gh release download pr-2716-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-1.0.0.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Changes requested

The direction is right — a hardcoded allowlist that needs a CLI release per new region is the wrong place to enforce availability. But the replacement drops all validation of the field, not just the availability check, and that has a couple of consequences worth fixing before merge.

1. z.string() accepts values that are not regions at all — including ""

src/projectSchemas/aws-targets.ts:6

export const AgentCoreRegionSchema = z.string();

This now accepts "", "US-EAST-1", "us-east-11", " us-east-1", "prod". The removed test at src/handlers/project/deploy/index.test.ts:672 (names the offending field for an unsupported region, using us-east-11) was specifically covering typo detection in a hand-edited aws-targets.json, and that signal is gone along with the availability check.

The failure mode for the --region path is worse than the one advertised in the description. provisionDefaultTarget calls resolveAccount(region) first (src/core/project/manager.tsx:1793), so agentcore deploy --region us-east-11 resolves an STS endpoint of sts.us-east-11.amazonaws.com, the call fails at DNS, and the catch block reports:

Cannot create the default deployment target ... because the AWS account could not be resolved: getaddrinfo ENOTFOUND ...
Sign in with 'aws login' (or set AWS_PROFILE or credential environment variables) and re-run 'agentcore deploy'.

A region typo is reported as a credentials problem and tells the user to log in again. Likewise an empty region in a hand-edited aws-targets.json now parses and is handed to the CDK app as env.region.

Options:

• Keep the field forward-compatible but shaped, e.g. z.string().regex(/^[a-z]{2}(-[a-z]+)+-\d$/, "...") — this still accepts ap-northeast-3, ap-southeast-7, us-gov-west-1, cn-north-1, and future regions, while rejecting empty strings and obvious typos.
• Or keep z.string() but add .min(1) and make the provisionDefaultTarget catch mention the region (...could not be resolved for region '<region>'; check --region/AWS_REGION and your credentials), so an endpoint-resolution failure is not attributed solely to credentials.

2. No behavioral coverage replaces the removed tests

The three removed tests are replaced only by expect(AgentCoreRegionSchema.safeParse("ap-northeast-3").success).toBe(true), which is tautological for z.string(). The behavior this PR actually changes — that a region outside the old allowlist is now resolved against STS and persisted to agentcore/aws-targets.json — is untested. Converting the deleted manager.test.ts case (src/core/project/manager.test.ts:2098) into its positive form (asserts the STS/account call happened with ap-northeast-3 and that the written target records that region) would keep the guarantee at the layer that changed.

3. Merge ordering with the vended CDK pin

Noted in the description, but it affects whether this is shippable on its own: src/assets/cdk/package.json pins @aws/agentcore-cdk to 1.0.0, whose AwsDeploymentTargetSchema still enforces an allowlist that is narrower than the one being removed here (no ap-south-2, ap-southeast-5/7, cn-north-1, cn-northwest-1, eu-south-1/2, us-west-1). Until the library release containing aws/agentcore-l3-cdk-constructs#439 lands and the pin moves, a new region fails at cdk synth with a zod enum error rather than the CloudFormation Unrecognized resource types message quoted in the description — so the user-visible outcome is a confusing synth error, not a late, clear failure. Please either land/bump the library pin in the same change or gate this merge on that release.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.54%. Comparing base (9ab9ed9) to head (ff5d215).
⚠️ Report is 8 commits behind head on refactor.

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #2716      +/-   ##
============================================
- Coverage     96.62%   96.54%   -0.08%     
============================================
  Files           706      706              
  Lines         58447    58529      +82     
============================================
+ Hits          56472    56508      +36     
- Misses         1975     2021      +46     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)