Hey folks, been wrestling with an interesting challenge in our AWS environment and wanted to share the step-by-step process. We've been piloting Amazon CodeWhisperer for some dev teams, but its default suggestions kept violating our internal naming conventions for IAM roles and security groups. This was a non-starter for our compliance checks.
Our convention is strict: `[app]-[environment]-[resource-type]-[region]`. For example, a role for the payment service in production should be `payment-prod-role-us-east-1`. CodeWhisperer kept suggesting generic names like `PaymentServiceRole`. Here's how I guided it:
First, I had to provide context in the comment right before the line where I needed the resource defined. I found being extremely explicit in plain English worked best.
```python
# Create an IAM role for the payment service in production, following naming convention: app-environment-resource-type-region
# The role should allow EC2 to assume it and have a managed policy for S3 read-only access.
```
This prompt led CodeWhisperer to generate:
```python
payment_prod_role_us_east_1 = iam.Role(
self,
"paymentProdRole",
assumed_by=iam.ServicePrincipal("ec2.amazonaws.com"),
role_name="payment-prod-role-us-east-1",
managed_policies=[
iam.ManagedPolicy.from_aws_managed_policy_name("AmazonS3ReadOnlyAccess")
]
)
```
Key takeaways for getting consistent results:
* **Context is king:** You must "set the scene" in the comment. Mention the convention literally.
* **Placement matters:** Put the instructional comment on the line *immediately* before the code you want generated.
* **Iterate:** The first suggestion might be close. Reject it, adjust your comment, and try again. It learns from the immediate context.
For security groups, it was trickier. I had to define the naming logic first in a variable to get it to stick.
```python
# Security group name must follow convention: app-environment-purpose-region
sg_name = f"{app_name}-{env}-web-{region}"
# Create the security group for the web tier allowing HTTP and HTTPS from anywhere.
```
This finally yielded a correctly named SG resource. It's not fully autonomous—you need to guide it with clear, contextual comments—but once you get the hang of the prompting, it becomes a powerful consistency tool for enforcing security and compliance rules at the code suggestion level.
security by default