@deployfoundation/foundation-deploy 0.2.13 → 0.2.14

package/dist/bin/app.js

@@ -7,7 +7,7 @@ import {
   FoundationNetwork,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-ww9chzp9.js";
+} from "../chunk-83781ggk.js";
 import {
   adminsFor,
   instanceNames,

package/dist/bin/foundation-deploy.js

@@ -1522,8 +1522,7 @@ function spansIngestionPolicy(account, region) {
     Version: "2012-10-17",
     Statement: [
       statement("SpansFromXray", "aws/spans"),
-      statement("ApplicationSignalsFromXray", "/aws/application-signals/data"),
-      statement("AgentCoreRuntimeSpansFromXray", "/aws/bedrock-agentcore/runtimes/*")
+      statement("ApplicationSignalsFromXray", "/aws/application-signals/data")
     ]
   });
 }
@@ -1538,7 +1537,7 @@ function hasSpansIngestionPolicy(describeOutput) {
     return false;
   return policies.some((p) => {
     const doc = String(p.policyDocument ?? "");
-    return doc.includes("aws/spans") && doc.includes("logs:CreateLogStream") && doc.includes("/aws/bedrock-agentcore/runtimes/");
+    return doc.includes("aws/spans") && doc.includes("logs:CreateLogStream");
   });
 }
 function parseDestination(text) {

package/dist/{chunk-ww9chzp9.js → chunk-83781ggk.js}

@@ -25,6 +25,7 @@ import {
 import * as cdk from "aws-cdk-lib";
 import * as ecr from "aws-cdk-lib/aws-ecr";
 import * as iam from "aws-cdk-lib/aws-iam";
+import * as logs from "aws-cdk-lib/aws-logs";
 class FoundationAgent extends cdk.Stack {
   repository;
   executionRole;
@@ -67,6 +68,7 @@ class FoundationAgent extends cdk.Stack {
     this.accessPoint = accessPoint;
     this.executionRole = this.buildExecutionRole(props);
     this.readOnlyRole = this.buildReadOnlyRole(props);
+    this.buildSpansIngestionPolicy();
     const gateway = this.buildToolGateway(display);
     this.webSearchUrl = gateway.getAtt("GatewayUrl").toString();
     this.executionRole.addToPolicy(new iam.PolicyStatement({
@@ -318,6 +320,27 @@ class FoundationAgent extends cdk.Stack {
     }));
     return role;
   }
+  buildSpansIngestionPolicy() {
+    return new logs.ResourcePolicy(this, "AgentSpansIngestion", {
+      resourcePolicyName: `${this.stackName}-AgentSpansFromXray`,
+      policyStatements: [
+        new iam.PolicyStatement({
+          sid: "AgentSpansFromXray",
+          principals: [new iam.ServicePrincipal("xray.amazonaws.com")],
+          actions: ["logs:PutLogEvents", "logs:CreateLogStream"],
+          resources: [
+            `arn:${this.partition}:logs:${this.region}:${this.account}:log-group:/aws/bedrock-agentcore/runtimes/${this.names.runtimeName}-*:*`
+          ],
+          conditions: {
+            StringEquals: { "aws:SourceAccount": this.account },
+            ArnLike: {
+              "aws:SourceArn": `arn:${this.partition}:xray:${this.region}:${this.account}:*`
+            }
+          }
+        })
+      ]
+    });
+  }
   buildExecutionRole(props) {
     const role = new iam.Role(this, "AgentExecutionRole", {
       assumedBy: new iam.ServicePrincipal("bedrock-agentcore.amazonaws.com"),

package/dist/src/index.js

@@ -9,7 +9,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-ww9chzp9.js";
+} from "../chunk-83781ggk.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.13",
+  "version": "0.2.14",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/deploy/tracing.ts

@@ -82,11 +82,12 @@ export function spansIngestionPolicy(account: string, region: string): string {
     Statement: [
       statement("SpansFromXray", "aws/spans"),
       statement("ApplicationSignalsFromXray", "/aws/application-signals/data"),
-      // The agent names its OWN runtime log group in `x-aws-log-group`, and
-      // X-Ray delivers there too: without this, exports fail with "not
-      // authorized to perform logs:PutLogEvents on /aws/bedrock-agentcore/
-      // runtimes/<runtime>-live" (2026-09-07).
-      statement("AgentCoreRuntimeSpansFromXray", "/aws/bedrock-agentcore/runtimes/*"),
+      // NOT the runtime's own log group, which is where the agent's spans
+      // actually go (`x-aws-log-group`): that grant is per instance and ships
+      // with every deploy as the agent stack's `AgentSpansIngestion` policy.
+      // Owning it here made it a one-time `setup` side effect, and an instance
+      // that reached its account by `deploy` alone never got it — every export
+      // a 400 (Olivia, 2026-09-26).
     ],
   });
 }
@@ -102,11 +103,7 @@ export function hasSpansIngestionPolicy(describeOutput: string): boolean {
   if (!Array.isArray(policies)) return false;
   return policies.some((p) => {
     const doc = String((p as { policyDocument?: unknown }).policyDocument ?? "");
-    return (
-      doc.includes("aws/spans") &&
-      doc.includes("logs:CreateLogStream") &&
-      doc.includes("/aws/bedrock-agentcore/runtimes/")
-    );
+    return doc.includes("aws/spans") && doc.includes("logs:CreateLogStream");
   });
 }
 

package/src/stacks/agent-stack.ts

@@ -4,6 +4,7 @@ import type * as ec2 from "aws-cdk-lib/aws-ec2";
 import * as ecr from "aws-cdk-lib/aws-ecr";
 import * as iam from "aws-cdk-lib/aws-iam";
 import type * as kms from "aws-cdk-lib/aws-kms";
+import * as logs from "aws-cdk-lib/aws-logs";
 import type * as s3 from "aws-cdk-lib/aws-s3";
 import type * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import type { Construct } from "constructs";
@@ -147,6 +148,7 @@ export class FoundationAgent extends cdk.Stack {
     this.accessPoint = accessPoint;
     this.executionRole = this.buildExecutionRole(props);
     this.readOnlyRole = this.buildReadOnlyRole(props);
+    this.buildSpansIngestionPolicy();
 
     // The gateway is independent of the runtime: it can (and does) exist
     // during the phase-one bootstrap deploy.
@@ -523,6 +525,48 @@ export class FoundationAgent extends cdk.Stack {
     return role;
   }
 
+  /**
+   * Let X-Ray write this runtime's spans into the runtime's own log group.
+   *
+   * The agent posts OTLP to the X-Ray endpoint with `x-aws-log-group` naming
+   * `/aws/bedrock-agentcore/runtimes/<runtime>-<endpoint>` (see
+   * `packages/agent/src/observability/otel.ts`). X-Ray, not the execution
+   * role, then calls `PutLogEvents` — as a role in an AWS service account —
+   * so the execution role's `AgentLogs` grant does not apply, and without a
+   * CloudWatch Logs RESOURCE policy every export is a 400 "not authorized to
+   * perform: logs:PutLogEvents" (Olivia, 2026-09-26). AWS: "If you set
+   * OTEL_EXPORTER_OTLP_TRACES_HEADERS to deliver spans to your own log group,
+   * you must also add an Amazon CloudWatch Logs resource policy … allow X-Ray
+   * (xray.amazonaws.com) to call logs:PutLogEvents on that log group"
+   * (bedrock-agentcore devguide, observability-configure).
+   *
+   * Logs resource policies are account-level (ten per Region), so the name is
+   * the stack's own and the grant covers only this runtime's endpoint groups,
+   * and only when X-Ray acts for this account. `CreateLogStream` rides along
+   * because X-Ray creates the `spans` stream on first delivery.
+   */
+  private buildSpansIngestionPolicy(): logs.ResourcePolicy {
+    return new logs.ResourcePolicy(this, "AgentSpansIngestion", {
+      resourcePolicyName: `${this.stackName}-AgentSpansFromXray`,
+      policyStatements: [
+        new iam.PolicyStatement({
+          sid: "AgentSpansFromXray",
+          principals: [new iam.ServicePrincipal("xray.amazonaws.com")],
+          actions: ["logs:PutLogEvents", "logs:CreateLogStream"],
+          resources: [
+            `arn:${this.partition}:logs:${this.region}:${this.account}:log-group:/aws/bedrock-agentcore/runtimes/${this.names.runtimeName}-*:*`,
+          ],
+          conditions: {
+            StringEquals: { "aws:SourceAccount": this.account },
+            ArnLike: {
+              "aws:SourceArn": `arn:${this.partition}:xray:${this.region}:${this.account}:*`,
+            },
+          },
+        }),
+      ],
+    });
+  }
+
   private buildExecutionRole(props: FoundationAgentProps): iam.Role {
     const role = new iam.Role(this, "AgentExecutionRole", {
       assumedBy: new iam.ServicePrincipal("bedrock-agentcore.amazonaws.com"),
@@ -574,9 +618,10 @@ export class FoundationAgent extends cdk.Stack {
         ],
       }),
     );
-    // Spans: the runtime SigV4-posts OTLP to the X-Ray endpoint, which routes
-    // them into the log group `AgentLogs` above already covers. None of these
-    // actions take a resource ARN — X-Ray scopes ingestion by account.
+    // Spans: the runtime SigV4-posts OTLP to the X-Ray endpoint. These actions
+    // only let it call X-Ray (none takes a resource ARN — X-Ray scopes
+    // ingestion by account); X-Ray's own write into the runtime log group is
+    // authorized by `AgentSpansIngestion`, not by `AgentLogs` above.
     role.addToPolicy(
       new iam.PolicyStatement({
         sid: "TraceIngest",