feat(examples): add native AgentCore Terraform templates

[jariy17]

Summary

Adds a standalone Terraform HCL template in examples/terraform/native for an AgentCore Runtime and short-term Memory using native hashicorp/aws resources and direct AgentCore APIs. Customers package the included Python sample and deploy it with ordinary terraform init, plan, and apply.

The template includes versioned encrypted S3 artifact storage, public-access blocking, an IAM runtime role with scoped artifact/logging/Memory permissions, configurable inputs, and Runtime/Memory outputs. No CLI implementation or dependency changes are included.

Files and usage

• main.tf: AgentCore Runtime and Memory resources.
• versions.tf, variables.tf, outputs.tf: providers, inputs, and outputs.
• storage.tf, iam.tf: artifact storage and runtime permissions.
• agent.py, build.py: dependency-free sample and ZIP packaging.
• terraform.tfvars.example, README.md: configuration and deployment/invocation instructions.

AWSCC provisions normal AgentCore resources without creating a CloudFormation stack. IAM and S3 use the AWS provider in both alternatives. Runtime uses Python 3.12 CodeZip and public networking; Memory has no long-term strategies. Application-specific resources and model permissions can be added to the .tf files.

Validation

• Terraform formatting and validation passed with the pinned providers.
• Repository formatting and secret scanning passed.
• Live AWS deployment passed: Runtime and Memory creation, Runtime invocation, description updates with unchanged resource IDs, and a final Terraform plan reporting no changes.
• Destruction was not exercised. Verification resources and state are retained.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Reviewed the Terraform backend preview end-to-end. Overall the design is careful about the tricky parts:

• Ownership is refused in both directions (assertBackendOwnership), a target's account/region/provider binding can't be silently reused, and outputs are re-validated against the target account/region ARN parts.
• Credentials aren't written into config, plan args, or the deployment.json binding; providers are additionally pinned with allowed_account_ids, giving defense in depth if the SDK/provider resolution paths diverge from STS.
• The applied/wasApplied gate prevents a fresh checkout from re-creating resources when local state is empty but the binding says the target was previously applied.
• The compiler validates unsupported project fields (arrays, objects, authorizerType, instrumentation, non-Python runtimes) before any Terraform runs, and physical-name length is enforced up front. literal() correctly escapes both ${ and %{ interpolation forms and there's a targeted test for it.
• Artifact packaging is deterministic (fixed mtime, sorted entries, symlink rejection, .env* exclusion, uv-lock required) and the SHA is used both as the S3 object key and as source_hash, so a description-only change reliably keeps the ZIP object stable (verified by the compiler test).
• Backend selection wiring goes through a single validateBackendCreateInput in the CLI handler, TUI screen, and manager, so the "unsupported template" error can't be bypassed.
• Tests use real temp directories and inject at true I/O boundaries (ProcessStreamer, resolveIdentity, checkTool) — no fs mocking, no SDK stubbing beyond what's necessary.

Nothing rose to the level of a blocking issue. Ship it.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.26%. Comparing base (a23e472) to head (a2989ec).

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2346   +/-   ##
=========================================
  Coverage     97.26%   97.26%           
=========================================
  Files           610      610           
  Lines         40590    40590           
=========================================
  Hits          39480    39480           
  Misses         1110     1110           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)