Today I Learned — Daily learnings
Pydantic models passed to structured_output_model appear as tools in metrics tool_usage. If you see an unfamiliar tool name during debugging, it's the Structured Output mechanism.
If ECS Managed Daemons won't start, check that the instance profile uses AmazonECSInstanceRolePolicyForManagedInstances. The legacy AmazonEC2ContainerServiceforEC2Role won't work.
Security Agent Application is one per region, not one per account. An Application created in Tokyo is invisible from us-east-1. Each region requires its own create-application call.
Security Agent pentest fails at PREFLIGHT with AccessDeniedException if the service role lacks logs:CreateLogGroup. Not mentioned in official docs.
AWS Security Agent runs 13 attack categories in parallel, overwhelming Flask's dev server with HTTP 503. Multi-worker server like gunicorn is required for pentest targets.
sourceCode pentest failed with INTERNAL_ERROR twice in ap-northeast-1 but worked normally in us-east-1 with the same configuration. documents works fine in Tokyo.
Specifying a raw file in create-pentest assets.sourceCode returns 'Source code S3 URL must point to a ZIP archive'. documents accepts raw files directly.
sourceCode triggers CODE SCANNER (BUSINESS LOGIC / IMPORTANT FLOWS / FRAMEWORKS) for systematic static analysis that finds vulnerabilities before PENTEST. documents only runs a DOCUMENTS task for context processing.
verify-target-domain uses public access so private DNS returns UNREACHABLE, but VPC Config pentests perform separate internal verification during PREFLIGHT that succeeds.
AWS DevOps Agent IAM actions use the aidevops prefix, not devops-agent. The boto3 client name is devops-agent but IAM policies need aidevops:*. AWS CLI support was added in v2.34.20.