fix: validate existing IAM role trust policies

[nborges-aws]

Description

Adds trust-policy validation before reusing an existing managed IAM role in the imperative agentcore run ab-test path

• Adds a shared IAM trust-policy validator
• Validates an existing deterministic AB-test role before adopting it or updating its inline permissions
• Rejects missing, malformed, or divergent trust policies with guidance to delete the conflicting role or provide --role-arn
• Handling of attached or inline permission-policies remains unchanged

Behavior Change

Existing AB tests are unaffected. New roles, matching existing roles, and explicit customer-managed roles continue to work normally.

When creating, retrying, or recreating an AB test without --role-arn, the CLI will now reject an existing deterministic role whose trust policy differs from the policy it would create.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[github-actions]

Package Tarball

aws-agentcore-0.27.0.tgz

How to install

gh release download pr-2033-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.27.0.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	40.76%	15323 / 37585
🔵	Statements	40.03%	16338 / 40813
🔵	Functions	34.94%	2622 / 7503
🔵	Branches	34.04%	10212 / 30000

Generated in workflow #4352 for commit de7f107 by the Vitest Coverage Report Action

[aidandaly24]

This looks good to me no findings