fix(ecs): grant ECS task role AgentCore Memory access (F-2, ABCA-488-class)

Live-caught during the fork stress smoke (ABCA-495): the ECS TaskDefTaskRole
got AccessDeniedException on bedrock-agentcore:CreateEvent for the AgentMemory
resource, so the agent's cross-task learning writes (write_task_episode /
write_repo_learnings) silently no-op'd (WARN) on EVERY ECS task — memory never
persisted on the fork's ECS-only substrate.

Same class as ABCA-488: the AgentCore runtime role gets memory access via
agentMemory.grantReadWrite(runtime) in agent.ts, and the orchestrator gets it
too, but the ECS task role never did.

Fix: EcsAgentCluster gains an optional agentMemory prop; when provided the task
role gets agentMemory.grantReadWrite (read actions + CreateEvent), scoped to the
memory ARN (synth-verified: no wildcard resource, so the existing IAM5 nag
suppression is unaffected). agent.ts passes agentMemory to the ECS cluster
alongside the existing memoryId. Omitted in isolated construct tests /
memory-less deploys → no grant (asserted).

Tests: construct asserts CreateEvent on the task role scoped to MemoryArn when
wired, and NO bedrock-agentcore grant when unwired. Full cdk build green (2883).

(cherry picked from commit c23d49fbead30ed52860e3975815e3643b22ade0)
(cherry picked from commit 44bb71e)

Author: bgagent

cdk/src/constructs/ecs-agent-cluster.ts

@@ -28,6 +28,7 @@ import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import { NagSuppressions } from 'cdk-nag';
 import { Construct } from 'constructs';
+import { AgentMemory } from './agent-memory';
 import { AgentSessionRole } from './agent-session-role';
 import { resolveBedrockModelIds } from './bedrock-models';
 
@@ -74,6 +75,18 @@ export interface EcsAgentClusterProps {
    * retains the legacy direct grants.
    */
   readonly agentSessionRole?: AgentSessionRole;
+
+  /**
+   * AgentCore Memory for cross-task learning (F-2 / ABCA-488-class parity). When
+   * provided, the ECS task role is granted read+write on it so the agent's
+   * memory writes (write_task_episode / write_repo_learnings →
+   * ``bedrock-agentcore:CreateEvent``) succeed on the ECS substrate. The
+   * AgentCore runtime role already gets this via ``agentMemory.grantReadWrite``
+   * in agent.ts; without the same grant here, memory writes hit AccessDenied and
+   * silently no-op on ECS (WARN), so learning never persists on an ECS-only
+   * deployment. Omitted in isolated construct tests / memory-less deployments.
+   */
+  readonly agentMemory?: AgentMemory;
 }
 
 /** HTTPS port — the only egress allowed from the agent task ENIs. */
@@ -222,6 +235,17 @@ export class EcsAgentCluster extends Construct {
       props.artifactsBucket.grantReadWrite(taskRole);
     }
 
+    // F-2 (ABCA-488-class parity): grant the task role read+write on the
+    // AgentCore Memory so the agent's cross-task learning writes
+    // (write_task_episode / write_repo_learnings → bedrock-agentcore:CreateEvent)
+    // succeed on ECS. The AgentCore runtime role gets this via
+    // agentMemory.grantReadWrite(runtime) in agent.ts; without the same grant
+    // here the writes hit AccessDenied and silently no-op (WARN) on the ECS
+    // substrate, so learning never persists on an ECS-only deployment.
+    if (props.agentMemory) {
+      props.agentMemory.grantReadWrite(taskRole);
+    }
+
     // ABCA-488: per-workspace Linear/Jira OAuth tokens live in Secrets Manager
     // under `bgagent-linear-oauth-*` (written by the CLI at setup). For a
     // Linear/Jira-channel task the agent resolves that token at startup

cdk/test/constructs/ecs-agent-cluster.test.ts

@@ -26,6 +26,7 @@ import * as ecr_assets from 'aws-cdk-lib/aws-ecr-assets';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import { AgentMemory } from '../../src/constructs/agent-memory';
 import { AgentSessionRole } from '../../src/constructs/agent-session-role';
 import { EcsAgentCluster } from '../../src/constructs/ecs-agent-cluster';
 
@@ -174,6 +175,64 @@ describe('EcsAgentCluster construct', () => {
     expect(hasLinearOauthGrant).toBe(true);
   });
 
+  test('task role gets bedrock-agentcore:CreateEvent on the AgentMemory when wired (F-2 / ABCA-488-class)', () => {
+    // REGRESSION: the agent's cross-task learning writes (write_task_episode /
+    // write_repo_learnings) call bedrock-agentcore:CreateEvent on the AgentCore
+    // Memory. The runtime role gets this via agentMemory.grantReadWrite; the ECS
+    // task role did NOT, so writes hit AccessDenied and silently no-op'd (WARN)
+    // on the ECS substrate — learning never persisted on an ECS-only deploy.
+    // Build a stack WITH an AgentMemory and assert the CreateEvent grant exists,
+    // scoped to the memory ARN (not a wildcard).
+    const app = new App();
+    const stack = new Stack(app, 'EcsMemStack');
+    const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });
+    const agentImageAsset = new ecr_assets.DockerImageAsset(stack, 'AgentImage', {
+      directory: path.join(__dirname, '..', '..', '..', 'agent'),
+    });
+    const mk = (id: string) =>
+      new dynamodb.Table(stack, id, { partitionKey: { name: 'task_id', type: dynamodb.AttributeType.STRING } });
+    const userConcurrencyTable = new dynamodb.Table(stack, 'UserConcurrencyTable', {
+      partitionKey: { name: 'user_id', type: dynamodb.AttributeType.STRING },
+    });
+    const agentMemory = new AgentMemory(stack, 'AgentMemory');
+    new EcsAgentCluster(stack, 'EcsAgentCluster', {
+      vpc,
+      agentImageAsset,
+      taskTable: mk('TaskTable'),
+      taskEventsTable: mk('TaskEventsTable'),
+      userConcurrencyTable,
+      githubTokenSecret: new secretsmanager.Secret(stack, 'GitHubTokenSecret'),
+      agentMemory,
+    });
+    const template = Template.fromStack(stack);
+    const policies = template.findResources('AWS::IAM::Policy');
+    let hasCreateEvent = false;
+    for (const [id, p] of Object.entries(policies)) {
+      if (!id.includes('TaskDefTaskRole')) continue;
+      for (const s of p.Properties.PolicyDocument.Statement) {
+        const actions = Array.isArray(s.Action) ? s.Action : [s.Action];
+        if (actions.includes('bedrock-agentcore:CreateEvent')) {
+          hasCreateEvent = true;
+          // resource must reference the memory ARN, not a bare wildcard
+          expect(JSON.stringify(s.Resource)).toContain('MemoryArn');
+          expect(s.Resource).not.toEqual('*');
+        }
+      }
+    }
+    expect(hasCreateEvent).toBe(true);
+  });
+
+  test('task role has NO bedrock-agentcore grant when no AgentMemory is wired (isolated default)', () => {
+    const policies = baseTemplate.findResources('AWS::IAM::Policy');
+    for (const [id, p] of Object.entries(policies)) {
+      if (!id.includes('TaskDefTaskRole')) continue;
+      for (const s of p.Properties.PolicyDocument.Statement) {
+        const actions = Array.isArray(s.Action) ? s.Action : [s.Action];
+        expect(actions.some((a: string) => a.startsWith('bedrock-agentcore:'))).toBe(false);
+      }
+    }
+  });
+
   test('task role Bedrock InvokeModel is scoped to explicit model/inference-profile ARNs (no wildcard)', () => {
     const policies = baseTemplate.findResources('AWS::IAM::Policy');
     let bedrockStatement: { Resource: unknown } | undefined;