| spec_version: 1 |
| name: cloudenv |
| display_name: "CloudEnv AWS Configuration Environment" |
| description: > |
| An RL environment where an AI agent configures AWS cloud infrastructure pipelines. |
| The agent receives a broken pipeline and must issue AWS API actions (S3, SQS, Lambda, |
| IAM, etc.) to restore it to a valid state. Tasks range from easy single-service fixes |
| to hard multi-service orchestration with complex IAM policies. |
| Rewards are shaped based on pipeline connection validity and step efficiency. |
| type: space |
| runtime: fastapi |
| app: cloudenv.server.app:app |
| port: 7860 |
| tags: |
| - openenv |
| - aws |
| - cloud-infrastructure |
| - reinforcement-learning |
|
|
| action_space: |
| type: composite |
| fields: |
| - name: task_id |
| type: string |
| description: "Task identifier (maps to pipeline_id)" |
| - name: episode_id |
| type: string |
| description: "Episode identifier" |
| - name: service |
| type: string |
| values: |
| [ |
| s3, |
| sqs, |
| sns, |
| dynamodb, |
| lambda, |
| iam, |
| sts, |
| secretsmanager, |
| logs, |
| events, |
| kinesis, |
| cloudwatch, |
| ssm, |
| stepfunctions, |
| firehose, |
| ec2, |
| rds, |
| elasticache, |
| ecs, |
| route53, |
| apigateway, |
| apigatewayv2, |
| cognito-idp, |
| cognito-identity, |
| ses, |
| sesv2, |
| acm, |
| wafv2, |
| glue, |
| athena, |
| ] |
| description: "AWS service to interact with (or internal for init)" |
| - name: operation |
| type: string |
| description: > |
| AWS API operation name (e.g. CreateBucket, PutBucketPolicy) or internal |
| operations like InitializeEnvironment. |
| - name: payload |
| type: object |
| description: "Arguments for the AWS API call" |
| - name: instance_id |
| type: string |
| required: false |
| description: "Specific instance of the AWS service (e.g. bucket name, queue URL)" |
| - name: intent |
| type: string |
| required: false |
| description: "Optional semantic intent describing the goal of this action" |
| - name: principal_arn |
| type: string |
| required: false |
| description: "IAM principal ARN performing the action (defaults to root)" |
|
|
| observation_space: |
| fields: |
| - name: task_id |
| type: string |
| description: "Current task identifier" |
| - name: episode_id |
| type: string |
| description: "Current episode identifier" |
| - name: step_count |
| type: integer |
| description: "Number of steps taken so far in this episode" |
| - name: operation_result |
| type: object |
| description: "Result of the last AWS API operation (service, operation, status, result/error)" |
| - name: reward |
| type: float |
| description: "Reward received for the last action" |
| - name: done |
| type: boolean |
| description: "Whether the episode is complete (pipeline fully restored)" |
| - name: current_pipeline_state |
| type: object |
| description: "Current broken pipeline graph after the last action" |
|
|
| reward: |
| min: 0.0 |
| max: 1.0 |
| description: > |
| Per-step reward is shaped by pipeline validity (0.7 * valid_ratio), |
| improvement deltas (0.15 * combined_delta), and step efficiency |
| (0.05 * step_factor). When all connections match the ideal pipeline, |
| the environment returns reward=0.99 and done=true. Episode-level scoring |
| is produced by cloudenv.server.graders.* (0.01-0.99). |
| |
| difficulties: |
| - easy |
| - medium |
| - hard |
| - all |
|
|
| max_steps: 50 |
|
|
| tasks: |
| - id: easy-task-1 |
| description: > |
| Single-service S3 policy fix: a bucket policy denies s3:GetObject on a target |
| bucket. Correct it to Allow so the pipeline validates. |
| grader: cloudenv.server.graders.easy_grader |
|
|
| - id: easy-task-2 |
| description: > |
| Lambda invoke fix: a lambda:func_a -> lambda:func_b edge denies |
| lambda:InvokeFunction. Update IAM policy to Allow invocation. |
| grader: cloudenv.server.graders.easy_grader |
|
|
| - id: medium-task-1 |
| description: > |
| Multi-service chain: s3 -> lambda is valid, but lambda -> sqs denies |
| sqs:SendMessage while lambda -> sns is already valid. Update the SQS policy |
| (or IAM role) to allow SendMessage. |
| grader: cloudenv.server.graders.medium_grader |
|
|
| - id: hard-task-1 |
| description: > |
| S3 -> Lambda -> SQS pipeline with broken service_url configs and an SQS policy |
| denying SendMessage. Fix the Lambda/SQS config URLs and attach an Allow |
| SendMessage role policy. |
| grader: cloudenv.server.graders.hard_grader |
|
|
| - id: hard-task-2 |
| description: > |
| IAM role-policy mismatch with duplicate node configs. Normalize Lambda config |
| (service_url/timeout/retry_attempts), normalize SQS config |
| (service_url/visibility_timeout), and allow SendMessage/ReceiveMessage in IAM. |
| grader: cloudenv.server.graders.hard_grader |
|
|
