Skip to content

Making Infrastructure Safe for Agents: Guardrails, Context, and Trust in the Age of Agentic Development Walk Through#32

Closed
coryodaniel wants to merge 10 commits intomainfrom
0318-safe-agentic-infra
Closed

Making Infrastructure Safe for Agents: Guardrails, Context, and Trust in the Age of Agentic Development Walk Through#32
coryodaniel wants to merge 10 commits intomainfrom
0318-safe-agentic-infra

Conversation

@coryodaniel
Copy link
Member

@coryodaniel coryodaniel commented Mar 18, 2026

Summary

End-to-end example of safe agentic infrastructure development with Massdriver bundles, built using Claude Code + the Massdriver plugin.

What's in this PR

DynamoDB bundle (bundles/dynamodb/)

  • Single-table DynamoDB with configurable key schema, billing mode, and optional streams
  • Compliance hardcoded: encryption at rest, PITR, deletion protection, prevent_destroy
  • Dangerous settings (table name, keys, billing mode) marked $md.immutable
  • Produces two scoped IAM policies (Read Only / Read Write) via the aws-catalog/dynamodb artifact
  • Checkov clean

DynamoDB artifact definition (artifact-definitions/dynamodb/)

  • Defines the contract: table ARN, name, region, stream ARN, and IAM policies array

Lambda TODO API bundle (bundles/aws-lambda-todo-api/)

  • Node.js 22.x Lambda function with API Gateway HTTP API (v2) proxy integration
  • Consumes aws-catalog/dynamodb connection — selects IAM policy via $md.enum
  • Manages its own S3 deployment bucket (versioned, encrypted, public access blocked)
  • CloudWatch log groups for both Lambda and API Gateway with configurable retention
  • Operator guide with mustache templating
  • Checkov clean (42/42)
  • Deployment zip is just index.mjs (1.1KB) — AWS SDK v3 provided by Lambda runtime

How it was built

This PR was developed interactively using /massdriver:develop — the Massdriver Claude Code plugin's bundle development workflow. The iterative loop: scaffold → publish → deploy → watch logs → fix → redeploy.

Key issues found and fixed during development:

  • DynamoDB table hash key pk vs Lambda code using id — caused 500 on POST while GET worked
  • Operator guide using Go template syntax instead of mustache
  • Lambda zip bloated with node_modules (AWS SDK already in runtime) — slimmed from ~500KB to 1.1KB

Testing

  • Deployed to claude-test environment
  • GET /todos returns []
  • POST /todos creates items ✅
  • Full CRUD verified via curl
  • Checkov: 42 passed, 0 failed on Lambda bundle; clean on DynamoDB bundle

🤖 Generated with Claude Code

coryodaniel and others added 10 commits March 17, 2026 16:21
…nterface for managing a table. Make dangerous-to-change

fields immutable, hard code most compliance recommendations from the Massdriver provisioner. Note, nothing in this git repo has been published besides the AWS platform.
User prompts:
- "got an internal server error on create, check that you are using env vars using the dynamo artifact"
- "make sure to gitignore node_modules and the zip file paths!"

Changes:
- Resolve .gitignore merge conflict, use broad node_modules/ and *.zip patterns
- Update dynamodb _massdriver_variables.tf

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@coryodaniel coryodaniel changed the title 0318 safe agentic infra Making Infrastructure Safe for Agents: Guardrails, Context, and Trust in the Age of Agentic Development Walk Through Mar 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant