fix: address bnusunny PR review findings for ECS/AgentCore container sync

- sam sync now captures the ECR URI returned by ECRUploader.upload and
  registers a new TaskDefinition revision with the updated image, then
  updates matching ECS services to that revision (fixes silent no-op)
- Tighten _force_ecs_deployment → _update_services_to_task_definition to
  require both the arn:aws:ecs: prefix and :service/ segment, preventing
  false matches on App Runner / VPC Lattice / AppMesh ARNs
- Split AgentCore out of ECSContainerSyncFlow: GENERATOR_MAPPING now routes
  AWS::BedrockAgentCore::Runtime to _create_agentcore_flow which logs a
  clear 'not yet supported' warning and returns None (UpdateAgentRuntime
  not yet implemented)
- Add AWS::ECS::TaskDefinition to SyncCodeResources._accepted_resources so
  sam sync --code-resource AWS::ECS::TaskDefinition is accepted by Click
- Add ApiCallTypes.UPDATE_CONTAINER_IMAGE enum value; use it in
  ECSContainerSyncFlow._get_resource_api_calls instead of UPDATE_FUNCTION_CODE
- Fix multi-container TaskDefinition safety: raise DockerBuildFailed when
  >1 ContainerDefinitions and no Metadata.ContainerName (app_builder.py)
- Fix AgentCore _update_built_resource: replace setdefault chain (which
  corrupts intrinsics) with direct dict assignment
- Fix isinstance(metadata, dict) guards in _update_built_resource,
  _has_container_build_metadata, and ECSTaskDefinitionImageResource
- Update ECSTaskDefinitionImageResource docstring and add LOG.warning for
  multi-container fallback (packageable_resources.py)
- Remove dead BuildGraph.CONTAINER_BUILD_DEFINITIONS constant and
  get/put_container_build_definition methods (zero callers, not
  serialized in _read/_write)
- Add test_ecs_container_sync_flow.py with 17 unit tests covering the
  new sync path, ARN filtering, error handling, and tag propagation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: singledigit

samcli/lib/build/app_builder.py

@@ -420,7 +420,7 @@ def _update_built_resource(
         if resource_type == AWS_ECS_TASK_DEFINITION:
             container_defs = resource_properties.get("ContainerDefinitions", [])
             if container_defs:
-                target_name = metadata.get("ContainerName") if metadata else None
+                target_name = metadata.get("ContainerName") if isinstance(metadata, dict) else None
                 if target_name:
                     for container_def in container_defs:
                         if container_def.get("Name") == target_name:
@@ -431,12 +431,17 @@ def _update_built_resource(
                             f"Metadata.ContainerName '{target_name}' does not match any "
                             f"container in ContainerDefinitions"
                         )
+                elif len(container_defs) > 1:
+                    raise DockerBuildFailed(
+                        f"TaskDefinition has {len(container_defs)} containers but Metadata.ContainerName is not set. "
+                        f"Add 'ContainerName: <name>' to the resource Metadata to specify which container to build."
+                    )
                 else:
                     container_defs[0]["Image"] = path
         if resource_type == AWS_BEDROCK_AGENTCORE_RUNTIME:
-            artifact = resource_properties.setdefault("AgentRuntimeArtifact", {})
-            container_config = artifact.setdefault("ContainerConfiguration", {})
-            container_config["ContainerUri"] = path
+            resource_properties["AgentRuntimeArtifact"] = {
+                "ContainerConfiguration": {"ContainerUri": path}
+            }
 
     def _build_lambda_image(self, function_name: str, metadata: Dict, architecture: str) -> str:
         """

samcli/lib/build/build_graph.py

@@ -200,14 +200,12 @@ class BuildGraph:
     # global table build definitions key
     FUNCTION_BUILD_DEFINITIONS = "function_build_definitions"
     LAYER_BUILD_DEFINITIONS = "layer_build_definitions"
-    CONTAINER_BUILD_DEFINITIONS = "container_build_definitions"
 
     def __init__(self, build_dir: str) -> None:
         # put build.toml file inside .aws-sam folder
         self._filepath = Path(build_dir).parent.joinpath(DEFAULT_BUILD_GRAPH_FILE_NAME)
         self._function_build_definitions: List["FunctionBuildDefinition"] = []
         self._layer_build_definitions: List["LayerBuildDefinition"] = []
-        self._container_build_definitions: List["ContainerBuildDefinition"] = []
         self._atomic_read()
 
     def get_function_build_definitions(self) -> Tuple["FunctionBuildDefinition", ...]:
@@ -216,21 +214,6 @@ def get_function_build_definitions(self) -> Tuple["FunctionBuildDefinition", ...
     def get_layer_build_definitions(self) -> Tuple["LayerBuildDefinition", ...]:
         return tuple(self._layer_build_definitions)
 
-    def get_container_build_definitions(self) -> Tuple["ContainerBuildDefinition", ...]:
-        return tuple(self._container_build_definitions)
-
-    def put_container_build_definition(self, container_build_definition: "ContainerBuildDefinition") -> None:
-        """
-        Puts the newly read container build definition into existing build graph.
-        Each container build definition is unique per resource identifier.
-        """
-        if container_build_definition not in self._container_build_definitions:
-            LOG.debug(
-                "Adding container build definition: %s",
-                container_build_definition,
-            )
-            self._container_build_definitions.append(container_build_definition)
-
     def get_function_build_definition_with_full_path(
         self, function_full_path: str
     ) -> Optional["FunctionBuildDefinition"]:

samcli/lib/package/packageable_resources.py

@@ -694,7 +694,8 @@ def export(self, resource_id: str, resource_dict: Optional[Dict], parent_dir: st
 class ECSTaskDefinitionImageResource(ResourceImage):
     """
     Represents an ECS TaskDefinition with a container image that needs to be pushed to ECR.
-    The image reference is at ContainerDefinitions[0].Image.
+    For single-container TaskDefinitions the first container is used by default; for
+    multi-container TaskDefinitions Metadata.ContainerName must be set.
     """
 
     RESOURCE_TYPE = AWS_ECS_TASK_DEFINITION
@@ -703,8 +704,8 @@ class ECSTaskDefinitionImageResource(ResourceImage):
 
     def _get_target_index(self, container_defs):
         """Find the target container index using ContainerName from Metadata."""
-        metadata = getattr(self, "resource_metadata", None) or {}
-        target_name = metadata.get("ContainerName")
+        metadata = getattr(self, "resource_metadata", None)
+        target_name = metadata.get("ContainerName") if isinstance(metadata, dict) else None
         if target_name:
             for i, cd in enumerate(container_defs):
                 if cd.get("Name") == target_name:
@@ -714,9 +715,15 @@ def _get_target_index(self, container_defs):
                 property_name=self.PROPERTY_NAME,
                 property_value=target_name,
                 ex=ValueError(
-                    f"Metadata.ContainerName '{target_name}' does not match any " f"container in ContainerDefinitions"
+                    f"Metadata.ContainerName '{target_name}' does not match any container in ContainerDefinitions"
                 ),
             )
+        if len(container_defs) > 1:
+            LOG.warning(
+                "TaskDefinition has multiple containers but Metadata.ContainerName is not set; "
+                "packaging the first container. Add 'ContainerName: <name>' to the resource Metadata "
+                "to avoid ambiguity."
+            )
         return 0
 
     def export(self, resource_id, resource_dict, parent_dir):

samcli/lib/providers/sam_container_provider.py

@@ -81,7 +81,7 @@ def _extract_container_services(self) -> None:
     @staticmethod
     def _has_container_build_metadata(metadata: Optional[Dict]) -> bool:
         """Check if metadata contains the required fields for a container image build."""
-        if not metadata:
+        if not isinstance(metadata, dict):
             return False
         return bool(metadata.get("Dockerfile") and metadata.get("DockerContext"))
 

samcli/lib/sync/sync_flow.py

@@ -43,6 +43,7 @@ class ApiCallTypes(Enum):
     UPDATE_FUNCTION_CONFIGURATION = "UpdateFunctionConfiguration"
     UPDATE_FUNCTION_CODE = "UpdateFunctionCode"
     PUBLISH_VERSION = "PublishVersion"
+    UPDATE_CONTAINER_IMAGE = "UpdateContainerImage"
 
 
 class ResourceAPICall(NamedTuple):

samcli/lib/sync/sync_flow_factory.py

@@ -75,6 +75,7 @@ class SyncCodeResources:
         AWS_APIGATEWAY_V2_API,
         AWS_SERVERLESS_STATEMACHINE,
         AWS_STEPFUNCTIONS_STATEMACHINE,
+        AWS_ECS_TASK_DEFINITION,
     ]
 
     @classmethod
@@ -356,6 +357,19 @@ def _create_ecs_container_flow(
             application_build_result,
         )
 
+    def _create_agentcore_flow(
+        self,
+        resource_identifier: ResourceIdentifier,
+        application_build_result: Optional[ApplicationBuildResult],
+    ) -> Optional[SyncFlow]:
+        # AgentCore sync requires UpdateAgentRuntime, which is not yet implemented.
+        LOG.warning(
+            "sam sync is not yet supported for AWS::BedrockAgentCore::Runtime resource '%s'. "
+            "Use sam deploy to update AgentCore resources.",
+            str(resource_identifier),
+        )
+        return None
+
     GeneratorFunction = Callable[
         ["SyncFlowFactory", ResourceIdentifier, Optional[ApplicationBuildResult]], Optional[SyncFlow]
     ]
@@ -371,7 +385,7 @@ def _create_ecs_container_flow(
         AWS_SERVERLESS_STATEMACHINE: _create_stepfunctions_flow,
         AWS_STEPFUNCTIONS_STATEMACHINE: _create_stepfunctions_flow,
         AWS_ECS_TASK_DEFINITION: _create_ecs_container_flow,
-        AWS_BEDROCK_AGENTCORE_RUNTIME: _create_ecs_container_flow,
+        AWS_BEDROCK_AGENTCORE_RUNTIME: _create_agentcore_flow,
     }
 
     # SyncFlow mapping between resource type and creation function