aws-cdk — Engineering Performance
1 engineers all time · Oct 2025 – May 2026 · built 2026-09-10 · GitHub
Performance snapshot
Today's rolling 90-day reading for aws-cdk, compared with the start of the series. Pick a window to move that comparison point.
Avg. perf / dev / mo
−100.0%
1.15 → 0.00 ETV
Active engineers
−100.0%
1.0 → 0.0
Features
−59.4pp
59.4% → 0.0%
Performance Composition
Each month's output split by type of work: Features (new value), Maintenance (sustaining systems), Tests, Docs, and Fixes (rework). The yellow line is output per engineer, so when it rises each engineer is delivering more, whatever the team size did. Unit: Engineering Throughput Value (ETV).
Engineering capacity
Effective engineers behind aws-cdk, against its pre-AI baseline. Each subject has its own: aws-cdk's is 0.86 ETV / dev / mo, its first reading in its first reading. Per-engineer ETV divided by that gives a capacity multiple, and that multiple applied to the engineers active in the trailing 90 days turns it into engineer-equivalents. The line is the real headcount, so the gap between line and area is what the leverage is worth. Because each baseline is its own, every subject opens at 1.0x on its first day: multiples measure improvement and are not comparable between subjects.
Knowledge concentration
How dependent is this repo on a small number of engineers? Higher top-1 share = higher key-person risk.
Alain Krok owns 100.0 % of commits.
Behind the numbers
Written summary of the work completed each month.
No monthly reports available yet.
Top engineers
Most impactful commits
Top 10 by ETV in the all-time window.
- 2.2ETVfeat(agentcore): add identity L2 constructs (#37610) ### Issue # (if applicable) Add L2 CDK constructs for: - https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-bedrockagentcore-oauth2credentialprovider.html - https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-bedrockagentcore-apikeycredentialprovider.html - https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-bedrockagentcore-workloadidentity.html to the agentcore package. Update also the gateway construct to support the credentials providers when configuring outbound auth for a target ### Reason for this change Feature gap ### Description of changes - Updated the existing gateway construct - Added a new folder with the new L2 constructs for identity - BREAKING CHANGE: ICredentialProviderConfig.grantNeededPermissionsToRole parameter renamed from role (IRole) to gateway (IGateway) so the implementation can derive scoped resource ARNs (e.g. workload identity wildcards keyed on gateway name) and attach policies to the gateway's execution role in a single call, rather than requiring callers to pass both separately. ### Describe any new or updated permissions being added Exposed the permissions specific to the identity providers ### Description of how you validated changes - added unit tests - added integration tests - deployed couple of examples: Examples: 1) Created a cdk stack linking against the custom package With: ``` const apiKeyProvider = new agentcore.ApiKeyCredentialProvider(this, 'ApiKeyIdentityTestScoped', { apiKeyCredentialProviderName: 'test-scoped-api-key-provider', apiKey: cdk.SecretValue.unsafePlainText('integ-placeholder-api-key'), tags: { integ: 'gateway-identity-outbound' }, }); const oauthProvider = agentcore.OAuth2CredentialProvider.usingGithub(this, 'OAuthIdentityTestScoped', { oAuth2CredentialProviderName: 'test-scoped-oauth-provider', clientId: 'integ-github-client-id', clientSecret: cdk.SecretValue.unsafePlainText('integ-github-client-secret'), tags: { integ: 'gateway-identity-outbound' }, }); const workloadIdentity = new agentcore.WorkloadIdentity(this, 'WorkloadIdentityTestScoped', { workloadIdentityName: 'test-scoped-workload-identity', tags: { integ: 'workload-identity-outbound' }, }); ``` The following resources are deployed: <img width="1478" height="244" alt="image" src="https://github.com/user-attachments/assets/86dac3a8-2a9b-43c9-8902-53f3f563e6aa" /> 2) Creating a workload identity ``` new agentcore.WorkloadIdentity(this, 'WorkloadIdentity', { workloadIdentityName: 'integ-workload-identity-outbound', tags: { integ: 'workload-identity-outbound' }, }); ``` <img width="1124" height="109" alt="image" src="https://github.com/user-attachments/assets/2ef8b1f7-cf53-4318-ae90-c898f90a7429" /> 3) Deploying a gateway with target ``` const gateway = new agentcore.Gateway(this, 'Gateway', { gatewayName: 'integ-gateway-identity-outbound', description: 'Gateway with OpenAPI targets wired to Token Vault L2 identities', // Inbound IAM avoids default Cognito domain (global uniqueness); this integ focuses on outbound Token Vault auth. authorizerConfiguration: agentcore.GatewayAuthorizer.usingAwsIam(), }); const openApiSchema = agentcore.ApiSchema.fromInline( JSON.stringify({ openapi: '3.0.0', info: { title: 'GatewayIdentityOutboundInteg', version: '1.0.0' }, servers: [{ url: 'https://example.com' }], paths: { '/ping': { get: { operationId: 'ping', responses: { 200: { description: 'ok' } }, }, }, }, }), ); const apiKeyProvider = new agentcore.ApiKeyCredentialProvider(this, 'ApiKeyIdentity', { apiKeyCredentialProviderName: 'integ-gw-outbound-apikey', apiKey: cdk.SecretValue.unsafePlainText('integ-placeholder-api-key'), tags: { integ: 'gateway-identity-outbound' }, }); gateway.addOpenApiTarget('OpenApiApiKeyTarget', { gatewayTargetName: 'integ-openapi-api-key', description: 'OpenAPI target with API key Token Vault identity', apiSchema: openApiSchema, credentialProviderConfigurations: [agentcore.GatewayCredentialProvider.fromApiKeyIdentity(apiKeyProvider)], }); ``` Deploys correctly <img width="995" height="311" alt="image" src="https://github.com/user-attachments/assets/25775657-8ba1-4fe5-84ee-e7497668ca47" /> <img width="1476" height="212" alt="image" src="https://github.com/user-attachments/assets/a5370df9-a446-4db2-b82f-64796478f513" /> <img width="1484" height="178" alt="image" src="https://github.com/user-attachments/assets/a8214ca7-db71-4e4f-80f5-f4d7d727f889" /> ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*Alain Krok · 67c3af26 · 2026-05-07
- 1.4ETVfeat(agentcore): add agentcore L2 constructs for 1p tools (#35577) ### Issue # (if applicable) Related to https://github.com/aws/aws-cdk-rfcs/issues/785 ### Reason for this change Adding a new alpha package for Amazon Bedrock AgentCore and add support for 1p tools (Browser, Code Interpreter). ### Description of changes - Create a new alpha package - Add L2 constructs for browser, code interpreter - Add documentation - Add tests ### Describe any new or updated permissions being added Using permissions for agent core defined in https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrockagentcore.html ### Description of how you validated changes Unit tests, integration tests, manual tests ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*Alain Krok · 3087ffa3 · 2025-10-17
- 1.2ETVfeat(memory): add agentcore memory l2 construct (#35757) ### Issue # (if applicable) Related to https://github.com/aws/aws-cdk-rfcs/pull/825 ### Reason for this change Adding a new alpha package for Amazon Bedrock AgentCore and add support for memory. ### Description of changes - Create a new alpha package - Add L2 constructs for memory - Add documentation - Add tests ### Describe any new or updated permissions being added Using permissions for agent core defined in https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrockagentcore.html ### Description of how you validated changes Unit tests, integration tests, manual tests ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*Alain Krok · 6a2e17e8 · 2025-10-29
- 0.7ETVfeat(agentcore): add new properties for runtime, browser (#36003) ### Issue # (if applicable) Add support for new properties in agentcore alpha package: - Runtime: - [Code Configuration](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrockagentcore-runtime-codeconfiguration.html) (Direct code deployment) - [Lifecycle configuration](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrockagentcore-runtime-lifecycleconfiguration.html) - [Request header configuration](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrockagentcore-runtime-requestheaderconfiguration.html) - Browser: - [Browser signing](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrockagentcore-browsercustom-browsersigning.html) Also fix a warning (@param userPoolClients) in JSDoc due to wrong param name (missing 's') ### Reason for this change Supporting new features ### Description of changes Adding support for new properties, not changing existing implementation ### Describe any new or updated permissions being added Granting permissions on bucket when using code configuration as a runtime artifact ### Description of how you validated changes unit tests, integration tests, manual tests Example: - Deploying a runtime from a zip available in S3: ```ts const agentArtifact = AgentRuntimeArtifact.fromS3({ bucketName: 'XXXXXXXXXX', objectKey: 'deployment_package.zip', }, AgentCoreRuntime.PYTHON_3_13, ['main.py']); const runtime1 = new Runtime(this, 'MinimalRuntime', { runtimeName: 'minimal_runtime', agentRuntimeArtifact: agentArtifact, requestHeaderConfiguration: { allowList: ['X-Amzn-Bedrock-AgentCore-Runtime-Custom-H1'] }, lifecycleConfiguration: { idleRuntimeSessionTimeout: Duration.minutes(10), maxLifetime: Duration.hours(4), }, }); // Grant permission to invoke Bedrock models ... ``` <img width="1062" height="79" alt="image" src="https://github.com/user-attachments/assets/5af7a392-5d31-4e5a-b2c0-b3a2e7fd57b6" /> - Deploying a browser with signing enabled ```ts new BrowserCustom(this, 'Browser', { browserCustomName: 'my-browser', description: 'Strands browser', browserSigning: BrowserSigning.ENABLED, }); ``` <img width="1232" height="339" alt="Screenshot 2025-11-19 at 4 53 22 PM" src="https://github.com/user-attachments/assets/f9906ddb-ed37-4170-8cf9-6d8b08c92a2e" /> ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*Alain Krok · 439495fd · 2025-11-21
- 0.5ETVfeat(bedrock-agentcore-alpha): add support for custom claims and scopes to runtime/gateway authorizers (#36810) ### Issue # (if applicable) Add support for allowed audience to runtime and gateway JWT authorizers see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/inbound-jwt-authorizer.html, as well as https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrockagentcore-runtime-customjwtauthorizerconfiguration.html and https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrockagentcore-gateway-customjwtauthorizerconfiguration.html ### Reason for this change Coverage of missing features ### Description of changes Add missing properties to existing code ### Describe any new or updated permissions being added No changes in perms ### Description of how you validated changes Added unit tests Updated an integ test ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*Alain Krok · a3abcd01 · 2026-02-02
- 0.2ETVfix(bedrock-agentcore-alpha): empty submodule accidentally exposed and runtime validation fix (#36148) ### Issue # (if applicable) - Remove namespace from gateway perms causing the release of an empty submodule - Add validation logic to ensure no error when unresolved token for duration in runtime - Move files under lib and remove the /agentcore folder ### Reason for this change ### Description of changes ### Describe any new or updated permissions being added ### Description of how you validated changes ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*Alain Krok · 72d3e6f4 · 2025-11-21
- 0.0ETVdocs(bedrock): update readme (#36761) ### Issue # (if applicable) Closes #<issue number here>. ### Reason for this change Update the readme for bedrock and bedrock agentcore to reflect the location of L2 constructs ### Description of changes ### Describe any new or updated permissions being added ### Description of how you validated changes ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*Alain Krok · ba1a10e6 · 2026-01-27