Hierarchical coding-agent config in SSM Parameter Store: path design, IAM scoping, SecureString, cached reads, throughput limits and labels.

Query coding-agent tool audits and eval traces in S3 with Athena: Firehose landing, partition projection, scan limits, Parquet and ready SQL.

When a coding-agent sandbox wedges mid-refactor, humans still need a break-glass shell — without scattering SSH keys or bastion snowflakes. AWS Systems Manager Session Manager opens audited interactive sessions to EC2/Fargate-compatible targets with CloudTrail and optional S3/CloudWatch session logs. Distinct from Network Firewall egress filtering and IAM Roles Anywhere — this is human break-glass access with forensics, not network policy or cert-based machine identity.

Coding-agent tool roles accrete permissions until someone can s3:GetObject on every bucket "for RAG debugging." AWS IAM Access Analyzer finds unused privileges, external access, and policy issues before those roles leak into a credential incident. Distinct from GuardDuty (runtime threat) and Verified Permissions (app-level authZ): Access Analyzer is continuous IAM posture for the roles your agents assume.

Multi-hop coding agents fail in the gaps between services: the planner was fine, the sandbox timed out, the RAG tool silently retried. Amazon CloudWatch Application Signals gives you service-level objectives, RED metrics, and trace correlation for those hops without hand-rolling a dozen custom dashboards. Distinct from raw Logs Insights spelunking and ad-hoc X-Ray alone: Application Signals standardizes SLOs and service maps for the agent tool graph.

Coding-agent pipelines that only pass happy-path integration tests will fail the first time a sandbox dies mid-apply or IAM denies a tool call. AWS Fault Injection Service (FIS) runs controlled chaos — stop tasks, add latency, inject IAM denial scenarios — so you prove fail-closed behavior before customers do. Pair with GuardDuty/SCPs for real attacks and AppConfig kill switches for human-triggered stops.

GuardDuty told you a coding-agent task role was exfiltrated — now you need the who/what/when graph, not a pile of CloudTrail rows. Amazon Detective turns GuardDuty findings into entity timelines and related-finding graphs so you can revoke the right sessions, trace artifact access, and close the blast radius without overnight SQL archaeology.

Coding-agent artifact buckets accumulate patch diffs, test logs, and “debug” uploads that quietly contain PATs, cloud keys, and customer PII. Amazon Macie continuously discovers and classifies sensitive data in those buckets — find leaked secrets before the next tenant sync, and wire findings into rotate-and-quarantine playbooks.

Stolen IAM keys and over-permissioned agent task roles show up as odd AssumeRole chains and crypto-mining API calls long before humans notice a jailbreak. Amazon GuardDuty catches compromised coding-agent credentials early — enable S3/Malware/EKS protections where relevant, route findings to tickets, and pair with CloudTrail Lake forensics.

Secrets Manager rotation for coding-agent tools: four-step rotation Lambda tested with moto, GitHub App installation tokens, tag-based access, and keeping secrets out of model context.