Coding-agent HTTP APIs do not need you to babysit ECS services, ALB target groups, and autoscaling policies for every tenant prototype. AWS App Runner builds from a container or source repo, gives you HTTPS, autoscaling, and rolling deploys — ideal for agent control-plane APIs and tool webhooks when Fargate Spot sandboxes stay on ECS for heavy jobs.

Coding agents overwrite “final” patches, delete incriminating logs, and race two tools into the same key. Amazon S3 Object Lock (WORM) makes artifact buckets immutable for a retention window — governance or compliance mode — so agents can write once, auditors can trust history, and ransomware-style deletes fail closed. Distinct from If-None-Match conditional writes.

GuardDuty, Macie, Inspector, and custom agent findings scatter across sandbox accounts until nobody sees the fleet-wide pattern. AWS Security Hub aggregates those findings into one severity-normalized console — Standards, automations, and cross-account views so coding-agent security debt becomes tickets, not tribal knowledge.

On-prem and datacenter coding-agent runners still need AWS creds for S3 artifacts, CodeArtifact, and Bedrock — long-lived access keys in ~/.aws are a breach waiting to happen. AWS IAM Roles Anywhere issues short-lived role sessions from X.509 certificates — trust anchors, profiles, and cert rotation without embedding static keys in factory images.

Deny-by-default egress for coding-agent sandboxes with AWS Network Firewall: strict-order domain allowlists, drop_established, VPC endpoints for CodeArtifact, routing and an egress probe.

Coding-agent tools that open a fresh Postgres/MySQL connection per tool turn melt RDS connection limits and spike Lambda/Fargate cold paths. Amazon RDS Proxy pools and multiplexes those connections — pin sessions only when you must, keep IAM auth short-lived, and never let agents hold idle DB sockets across chat turns.

Create interface VPC endpoints for Amazon Bedrock, restrict them with endpoint policies and aws:SourceVpce, and prove agent model calls skip the NAT.

Multi-turn coding agents that re-clone the same monorepo on every Lambda, Fargate, or CodeBuild step waste minutes and burn git forge rate limits. Amazon EFS gives a shared workspace mount across those steps — pick throughput mode wisely, lock security groups and POSIX, and never treat EFS as a substitute for durable artifact stores.

Always-on Fargate and long CodeBuild fleets burn money while coding-agent sandboxes sit idle between clone/test/apply bursts. Fargate Spot gives cheap ephemeral capacity for short-lived agent sandboxes — handle SIGTERM interruptions, keep task defs thin, and pair IAM with SCPs so Spot savings do not become Spot blast radius.

Per-tenant coding-agent AWS accounts still blow up when an over-permissioned tool role gets iam:CreateUser or organizations:LeaveOrganization. Service Control Policies at the Organizations OU hard-cap what agent accounts can call even if the role policy is wrong — complementing Verified Permissions and IAM condition keys.