Coding-agent sandboxes that npm/pip/go fetch from the public internet are slow, flaky, and supply-chain risky — one compromised package and your agent applies malware as a “fix.” AWS CodeArtifact gives private package mirrors with upstreams, domain policies, and IAM so CodeBuild/Fargate/Lambda sandboxes resolve only approved registries.

Find denied calls, IAM writes and passed roles from coding-agent IAM roles with Athena over CloudTrail logs, CloudWatch alerts and EventBridge, and CloudTrail Lake for existing customers.

Multi-tenant coding agents fail in silent clusters — one tenant's tool timeout looks like another tenant's Bedrock throttle in raw CloudWatch. Logs Insights queries with parse/filter/stats on tool name, tenant_id, latency, and error class turn Lambda log soup into forensics. Saved queries + optional Contributor Insights catch top offenders without a warehouse.

Multi-hop coding agents invoke orchestrator Lambdas that call tool Lambdas — without W3C trace context you cannot stitch latency or failures. ADOT OpenTelemetry propagates traceparent across hops, adds span attributes for tool name and tokens, and complements EMF cost metrics.

This senior-level guide covers Lambda Destinations with production trade-offs for reliability, security, and cost.

This senior-level guide covers CodeBuild Spec Sandboxes for AI Coding with production trade-offs for reliability, security, and cost.

This senior-level guide covers Lambda Recursive Loop Protection with production trade-offs for reliability, security, and cost.

This senior-level guide covers CloudWatch EMF for LLM Cost with production trade-offs for reliability, security, and cost.