Limit agent permissions and spend in AWS Transform custom
The AWS DevOps Blog describes three configuration controls for running the AWS Transform custom agent on fleets of repositories: a trust settings file that auto-approves some tool calls and shell commands, an IAM execution identity scoped to approved transformations, and an agent-minute cap plus an AWS Budgets alert on spend. The post walks through a sample Java 8 to Java 17 upgrade run using AWS Transform CLI 3.10.0, reporting 43 tool calls and that the trust allowlist reduced approval prompts from 23 to zero on a clean clone.
What changes for platform teams
Platform teams running agent-driven upgrades from pipelines can manage tool trust, identity scope and spend as configuration rather than new infrastructure. The post's own measurements are from one sample repository and one CLI version, so counts will differ on other estates.
Read the original at AWS DevOps Blog ↗
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules