Rendered at 22:58:32 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
coder-pm 2 days ago [-]
I have read the template and all the microVMs are running under the same role which has read and write access to checkpoints/*, so every user's folder in the bucket. The prefixes for users are just names, not boundaries. What stops one agent to read or overwrite the checkpoints for someone else?
cdani 33 minutes ago [-]
You're absolutely right! This started as a personal project, so I did not manage IAM isolation as my highest priority but I definitely will fix it
xms17189 2 days ago [-]
How do you handle network egress filtering when an agent legitimately needs to install dependencies or pull docs versus preventing arbitrary outbound traffic during autonomous execution?
cdani 30 minutes ago [-]
Right now there is no such filter, but it'up to the administrator to se the boundaries. You can deploy the AgentCore Runtime in a VPC and so you can apply whataver traffic rules you want
new23d 1 days ago [-]
If the workload's network interface (ENI in AWS) is in a VPC that you manage, an outbound traffic filtering solution can prevent that. See AWS Network Firewall or the product we develop, DiscrimiNAT (https://chasersystems.com/), for example.
Rules can be per Security Group, too, for fine-grained access control. I would also strongly recommend that installation of dependencies is a build-time task, not a run-time task, and if those two stages are separated, it makes egress filtering a whole lot more effective since the build-time allowlists are often multi-tenant CDNs where a threat actor can host their own data capturing or malicious payload delivering service.
Rules can be per Security Group, too, for fine-grained access control. I would also strongly recommend that installation of dependencies is a build-time task, not a run-time task, and if those two stages are separated, it makes egress filtering a whole lot more effective since the build-time allowlists are often multi-tenant CDNs where a threat actor can host their own data capturing or malicious payload delivering service.