@deployfoundation/foundation-deploy 0.2.36 → 0.2.37

package/dist/bin/app.js

@@ -8,7 +8,7 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-zbw2awg7.js";
+} from "../chunk-9yz4hnte.js";
 import {
   adminsFor,
   instanceNames,

package/dist/{chunk-zbw2awg7.js → chunk-9yz4hnte.js}

@@ -1106,6 +1106,7 @@ class FoundationApi extends cdk2.Stack {
       sid: "ReadRuntimeEndpointVersion",
       actions: ["bedrock-agentcore:GetAgentRuntimeEndpoint"],
       resources: [
+        `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*`,
         `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*/runtime-endpoint/*`
       ]
     }));
@@ -1438,6 +1439,11 @@ class FoundationApi extends cdk2.Stack {
         actions: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:DeleteItem"],
         resources: [upworkApprovalTable.tableArn]
       }));
+      upworkProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "UpworkDraftDataKey",
+        actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
+        resources: [props.dataKey.keyArn]
+      }));
       this.upworkProxyFunction = new lambda.Function(this, "UpworkProxyFunction", {
         functionName: names.upworkProxyFunctionName,
         runtime: lambda.Runtime.NODEJS_22_X,

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-zbw2awg7.js";
+} from "../chunk-9yz4hnte.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.36",
+  "version": "0.2.37",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/stacks/api-stack.ts

@@ -534,7 +534,10 @@ export class FoundationApi extends cdk.Stack {
       new iam.PolicyStatement({
         sid: "ReadRuntimeEndpointVersion",
         actions: ["bedrock-agentcore:GetAgentRuntimeEndpoint"],
+        // AgentCore authorizes this call against BOTH the runtime and the
+        // endpoint (CloudTrail, 2026-10-11): the endpoint alone is denied.
         resources: [
+          `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*`,
           `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*/runtime-endpoint/*`,
         ],
       }),
@@ -1006,6 +1009,15 @@ export class FoundationApi extends cdk.Stack {
           resources: [upworkApprovalTable.tableArn],
         }),
       );
+      // The approval table is encrypted with the instance data key: without it
+      // every draft write fails (Sky, 2026-10-11, prepare_proposal proxy_error).
+      upworkProxyRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "UpworkDraftDataKey",
+          actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
+          resources: [props.dataKey.keyArn],
+        }),
+      );
       this.upworkProxyFunction = new lambda.Function(this, "UpworkProxyFunction", {
         functionName: names.upworkProxyFunctionName,
         runtime: lambda.Runtime.NODEJS_22_X,