spec_version: 1
name: cloudenv
display_name: "CloudEnv AWS Configuration Environment"
description: >
  An RL environment where an AI agent configures AWS cloud infrastructure pipelines.
  The agent receives a broken pipeline and must issue AWS API actions (S3, SQS, Lambda,
  IAM, etc.) to restore it to a valid state. Tasks range from easy single-service fixes
  to hard multi-service orchestration with complex IAM policies.
  Rewards are shaped based on pipeline connection validity and step efficiency.
type: space
runtime: fastapi
app: cloudenv.server.app:app
port: 7860
tags:
  - openenv
  - aws
  - cloud-infrastructure
  - reinforcement-learning

action_space:
  type: composite
  fields:
    - name: task_id
      type: string
      description: "Task identifier (maps to pipeline_id)"
    - name: episode_id
      type: string
      description: "Episode identifier"
    - name: service
      type: string
      values:
        [
          s3,
          sqs,
          sns,
          dynamodb,
          lambda,
          iam,
          sts,
          secretsmanager,
          logs,
          events,
          kinesis,
          cloudwatch,
          ssm,
          stepfunctions,
          firehose,
          ec2,
          rds,
          elasticache,
          ecs,
          route53,
          apigateway,
          apigatewayv2,
          cognito-idp,
          cognito-identity,
          ses,
          sesv2,
          acm,
          wafv2,
          glue,
          athena,
        ]
      description: "AWS service to interact with (or internal for init)"
    - name: operation
      type: string
      description: >
        AWS API operation name (e.g. CreateBucket, PutBucketPolicy) or internal
        operations like InitializeEnvironment.
    - name: payload
      type: object
      description: "Arguments for the AWS API call"
    - name: instance_id
      type: string
      required: false
      description: "Specific instance of the AWS service (e.g. bucket name, queue URL)"
    - name: intent
      type: string
      required: false
      description: "Optional semantic intent describing the goal of this action"
    - name: principal_arn
      type: string
      required: false
      description: "IAM principal ARN performing the action (defaults to root)"

observation_space:
  fields:
    - name: task_id
      type: string
      description: "Current task identifier"
    - name: episode_id
      type: string
      description: "Current episode identifier"
    - name: step_count
      type: integer
      description: "Number of steps taken so far in this episode"
    - name: operation_result
      type: object
      description: "Result of the last AWS API operation (service, operation, status, result/error)"
    - name: reward
      type: float
      description: "Reward received for the last action"
    - name: done
      type: boolean
      description: "Whether the episode is complete (pipeline fully restored)"
    - name: current_pipeline_state
      type: object
      description: "Current broken pipeline graph after the last action"

reward:
  min: 0.0
  max: 1.0
  description: >
    Per-step reward is shaped by pipeline validity (0.7 * valid_ratio),
    improvement deltas (0.15 * combined_delta), and step efficiency
    (0.05 * step_factor). When all connections match the ideal pipeline,
    the environment returns reward=0.99 and done=true. Episode-level scoring
    is produced by cloudenv.server.graders.* (0.01-0.99).

difficulties:
  - easy
  - medium
  - hard
  - all

max_steps: 50

tasks:
  - id: easy-task-1
    description: >
      Single-service S3 policy fix: a bucket policy denies s3:GetObject on a target
      bucket. Correct it to Allow so the pipeline validates.
    grader: cloudenv.server.graders.easy_grader

  - id: easy-task-2
    description: >
      Lambda invoke fix: a lambda:func_a -> lambda:func_b edge denies
      lambda:InvokeFunction. Update IAM policy to Allow invocation.
    grader: cloudenv.server.graders.easy_grader

  - id: medium-task-1
    description: >
      Multi-service chain: s3 -> lambda is valid, but lambda -> sqs denies
      sqs:SendMessage while lambda -> sns is already valid. Update the SQS policy
      (or IAM role) to allow SendMessage.
    grader: cloudenv.server.graders.medium_grader

  - id: hard-task-1
    description: >
      S3 -> Lambda -> SQS pipeline with broken service_url configs and an SQS policy
      denying SendMessage. Fix the Lambda/SQS config URLs and attach an Allow
      SendMessage role policy.
    grader: cloudenv.server.graders.hard_grader

  - id: hard-task-2
    description: >
      IAM role-policy mismatch with duplicate node configs. Normalize Lambda config
      (service_url/timeout/retry_attempts), normalize SQS config
      (service_url/visibility_timeout), and allow SendMessage/ReceiveMessage in IAM.
    grader: cloudenv.server.graders.hard_grader