docs(bootstrap): correct the ECS ComputeTypes enable instructions

The //cdk:bootstrap task hint and DEPLOYMENT_ROLES.md both said to enable the ECS
compute backend with 'mise //cdk:bootstrap -- --context ComputeTypes=agentcore,ecs'.
That does NOT work: ComputeTypes is a CloudFormation *template parameter*, and this
CDK version's 'cdk bootstrap' has no way to set one — there's no --parameters flag,
and --context sets CDK construct context, not a CFN parameter. So the ECS policy
(IaCRole-ABCA-Compute-ECS, conditional on ComputeTypes containing 'ecs') was never
attached, and a --context compute_type=ecs deploy then failed with AccessDenied on
ecs:* — live-caught deploying the substrate to dev.

Correct it to the mechanism that actually works: bootstrap normally, then set the
parameter directly on the CDKToolkit stack via
'aws cloudformation update-stack ... ParameterKey=ComputeTypes,ParameterValue=agentcore,ecs'
(with a describe-stacks verify). Fixed in the mise task description + comment and
both DEPLOYMENT_ROLES.md occurrences; Starlight mirror regenerated. Drift gate green.

(cherry picked from commit a46683e)

Author: isadeks

cdk/mise.toml

@@ -40,8 +40,17 @@ run = ["mkdir -p $TMPDIR", "yarn synth:quiet"]
 description = "cdk deploy (pass args after --)"
 run = "npx cdk deploy"
 
+# Bootstraps with ComputeTypes=agentcore (the template default). To ALSO enable the
+# ECS compute backend you must set the ComputeTypes CFN *parameter* — `cdk bootstrap`
+# has no way to pass template parameters (no --parameters flag; --context sets CDK
+# construct context, NOT a CFN parameter), so run this task once, then set the
+# parameter directly on the CDKToolkit stack:
+#   aws cloudformation update-stack --stack-name CDKToolkit --use-previous-template \
+#     --capabilities CAPABILITY_NAMED_IAM \
+#     --parameters ParameterKey=ComputeTypes,ParameterValue=agentcore\,ecs
+#   # verify: aws cloudformation describe-stacks --stack-name CDKToolkit --query 'Stacks[0].Parameters'
 [tasks.bootstrap]
-description = "Bootstrap CDK with least-privilege policies (pass -- --context ComputeTypes=agentcore,ecs for ECS)"
+description = "Bootstrap CDK with least-privilege policies (ComputeTypes=agentcore; for ECS set the ComputeTypes CFN param on CDKToolkit — see comment above the task)"
 depends = [":install", ":bootstrap:generate"]
 run = "npx cdk bootstrap --template bootstrap/bootstrap-template.yaml"
 

docs/design/DEPLOYMENT_ROLES.md

@@ -33,9 +33,18 @@ These policies are not created or attached manually. The repository generates th
 
 ```bash
 # Regenerate artifacts (policies JSON + template YAML) and bootstrap.
-# Default ComputeTypes is "agentcore"; pass ECS via context to also include Compute-ECS:
+# ComputeTypes defaults to "agentcore".
 MISE_EXPERIMENTAL=1 mise //cdk:bootstrap
-MISE_EXPERIMENTAL=1 mise //cdk:bootstrap -- --context ComputeTypes=agentcore,ecs
+
+# To ALSO enable the ECS compute backend (attach IaCRole-ABCA-Compute-ECS), set the
+# ComputeTypes CFN *parameter*. `cdk bootstrap` cannot pass template parameters — it
+# has no --parameters flag, and --context sets CDK construct context, not a CFN
+# parameter — so bootstrap first (above), then update the parameter on CDKToolkit:
+aws cloudformation update-stack --stack-name CDKToolkit --use-previous-template \
+  --capabilities CAPABILITY_NAMED_IAM \
+  --parameters ParameterKey=ComputeTypes,ParameterValue=agentcore\,ecs
+# verify it took:
+aws cloudformation describe-stacks --stack-name CDKToolkit --query 'Stacks[0].Parameters'
 ```
 
 Under the hood, `mise //cdk:bootstrap` runs `npx cdk bootstrap --template bootstrap/bootstrap-template.yaml` (see `cdk/mise.toml`). The generated template defines five inline `AWS::IAM::ManagedPolicy` resources that **replace** the default `AdministratorAccess` on the CloudFormation execution role; the `IaCRole-ABCA-Compute-ECS` policy is conditional on the `ComputeTypes` parameter including `ecs`. The policy sources are `cdk/src/bootstrap/policies/{infrastructure,application,observability,compute-agentcore,compute-ecs}.ts`, compiled to `cdk/bootstrap/policies/*.json` by `cdk/scripts/generate-bootstrap-artifacts.ts`.
@@ -701,7 +710,7 @@ Bedrock AgentCore runtime/memory operations — a single statement granting `bed
 
 ### IaCRole-ABCA-Compute-ECS
 
-When the ECS Fargate compute backend is enabled (bootstrap with `--context ComputeTypes=agentcore,ecs`), the generated template conditionally attaches this policy to the CloudFormation execution role. It is a standalone managed policy, not an addition to `IaCRole-ABCA-Application`.
+When the ECS Fargate compute backend is enabled (set the `ComputeTypes` CFN parameter to `agentcore,ecs` on the `CDKToolkit` stack — see the bootstrap snippet near the top of this doc), the generated template conditionally attaches this policy to the CloudFormation execution role. It is a standalone managed policy, not an addition to `IaCRole-ABCA-Application`.
 
 ```json
 {

docs/src/content/docs/architecture/Deployment-roles.md

@@ -37,9 +37,18 @@ These policies are not created or attached manually. The repository generates th
 
 ```bash
 # Regenerate artifacts (policies JSON + template YAML) and bootstrap.
-# Default ComputeTypes is "agentcore"; pass ECS via context to also include Compute-ECS:
+# ComputeTypes defaults to "agentcore".
 MISE_EXPERIMENTAL=1 mise //cdk:bootstrap
-MISE_EXPERIMENTAL=1 mise //cdk:bootstrap -- --context ComputeTypes=agentcore,ecs
+
+# To ALSO enable the ECS compute backend (attach IaCRole-ABCA-Compute-ECS), set the
+# ComputeTypes CFN *parameter*. `cdk bootstrap` cannot pass template parameters — it
+# has no --parameters flag, and --context sets CDK construct context, not a CFN
+# parameter — so bootstrap first (above), then update the parameter on CDKToolkit:
+aws cloudformation update-stack --stack-name CDKToolkit --use-previous-template \
+  --capabilities CAPABILITY_NAMED_IAM \
+  --parameters ParameterKey=ComputeTypes,ParameterValue=agentcore\,ecs
+# verify it took:
+aws cloudformation describe-stacks --stack-name CDKToolkit --query 'Stacks[0].Parameters'
 ```
 
 Under the hood, `mise //cdk:bootstrap` runs `npx cdk bootstrap --template bootstrap/bootstrap-template.yaml` (see `cdk/mise.toml`). The generated template defines five inline `AWS::IAM::ManagedPolicy` resources that **replace** the default `AdministratorAccess` on the CloudFormation execution role; the `IaCRole-ABCA-Compute-ECS` policy is conditional on the `ComputeTypes` parameter including `ecs`. The policy sources are `cdk/src/bootstrap/policies/{infrastructure,application,observability,compute-agentcore,compute-ecs}.ts`, compiled to `cdk/bootstrap/policies/*.json` by `cdk/scripts/generate-bootstrap-artifacts.ts`.
@@ -705,7 +714,7 @@ Bedrock AgentCore runtime/memory operations — a single statement granting `bed
 
 ### IaCRole-ABCA-Compute-ECS
 
-When the ECS Fargate compute backend is enabled (bootstrap with `--context ComputeTypes=agentcore,ecs`), the generated template conditionally attaches this policy to the CloudFormation execution role. It is a standalone managed policy, not an addition to `IaCRole-ABCA-Application`.
+When the ECS Fargate compute backend is enabled (set the `ComputeTypes` CFN parameter to `agentcore,ecs` on the `CDKToolkit` stack — see the bootstrap snippet near the top of this doc), the generated template conditionally attaches this policy to the CloudFormation execution role. It is a standalone managed policy, not an addition to `IaCRole-ABCA-Application`.
 
 ```json
 {