FYI I ran this code through an ASH security scan and (after some small changes to the Dockerfile which were included in my latest push) there are 0 vulnerabilities of any level found.

@kaleko L2 constructs are coming soon. Here are the public PRs you can track:

• gateway: feat(agentcore): agentcore gateway L2 construct aws/aws-cdk#35771
• 1p tools: feat(agentcore): add agentcore L2 constructs for 1p tools aws/aws-cdk#35577
• runtime: feat(agentcore): add agentcore runtime L2 construct aws/aws-cdk#35623
• memory: feat(memory): add agentcore memory l2 construct aws/aws-cdk#35757

Latest scan for commit: 2697101 | Updated: 2025-10-20 20:33:53 UTC

Security Scan Results

Scan Metadata

• Project: ASH
• Scan executed: 2025-10-20T20:33:36+00:00
• ASH version: 3.0.0

Summary

Scanner Results

The table below shows findings by scanner, with status based on severity thresholds and dependencies:

Column Explanations:

Severity Levels (S/C/H/M/L/I):

• Suppressed (S): Security findings that have been explicitly suppressed/ignored and don't affect the scanner's pass/fail status
• Critical (C): The most severe security vulnerabilities requiring immediate remediation (e.g., SQL injection, remote code execution)
• High (H): Serious security vulnerabilities that should be addressed promptly (e.g., authentication bypasses, privilege escalation)
• Medium (M): Moderate security risks that should be addressed in normal development cycles (e.g., weak encryption, input validation issues)
• Low (L): Minor security concerns with limited impact (e.g., information disclosure, weak recommendations)
• Info (I): Informational findings for awareness with minimal security risk (e.g., code quality suggestions, best practice recommendations)

Other Columns:

• Time: Duration taken by each scanner to complete its analysis
• Action: Total number of actionable findings at or above the configured severity threshold that require attention

Scanner Results:

• PASSED: Scanner found no security issues at or above the configured severity threshold - code is clean for this scanner
• FAILED: Scanner found security vulnerabilities at or above the threshold that require attention and remediation
• MISSING: Scanner could not run because required dependencies/tools are not installed or available
• SKIPPED: Scanner was intentionally disabled or excluded from this scan
• ERROR: Scanner encountered an execution error and could not complete successfully

Severity Thresholds (Thresh Column):

• CRITICAL: Only Critical severity findings cause scanner to fail
• HIGH: High and Critical severity findings cause scanner to fail
• MEDIUM (MED): Medium, High, and Critical severity findings cause scanner to fail
• LOW: Low, Medium, High, and Critical severity findings cause scanner to fail
• ALL: Any finding of any severity level causes scanner to fail

Threshold Source: Values in parentheses indicate where the threshold is configured:

• (g) = global: Set in the global_settings section of ASH configuration
• (c) = config: Set in the individual scanner configuration section
• (s) = scanner: Default threshold built into the scanner itself

Statistics calculation:

• All statistics are calculated from the final aggregated SARIF report
• Suppressed findings are counted separately and do not contribute to actionable findings
• Scanner status is determined by comparing actionable findings to the threshold

@evandrofranco I'll implement these changes shortly. One clarification:

Can the folder name be 01-getting-started-with-strands instead of basic-runtime
I called it basic-runtime because I wanted the structure of 04-infrastructure-as-code/cdk/ to exactly match 04-infrastructure-as-code/cloudformation/. Should I keep basic-runtime to maintain the symmetry?

This is also why I called the agent "BasicAgent", that is what it is called in the symmetrical CFN example

@evandrofranco I incorporated your changes except for the renaming of BasicAgent and the directory, per my previous comment. Let me know what you think