AWS bedrock-agentcore documentation change
Summary
Updated branding to consistently use 'AgentCore Runtime', removed preview notice, enhanced technical details about session isolation and authentication, and added a structured 'Topics' section with security-related links.
Security assessment
The changes emphasize security features like microVM session isolation, memory sanitization, and authentication integration, and add documentation topics for IAM permissions, OAuth, and session management. However, there is no explicit evidence of addressing a specific security vulnerability.
Diff
diff --git a/bedrock-agentcore/latest/devguide/agents-tools-runtime.md b/bedrock-agentcore/latest/devguide/agents-tools-runtime.md index 8641e1637..84f95eea6 100644 --- a//bedrock-agentcore/latest/devguide/agents-tools-runtime.md +++ b//bedrock-agentcore/latest/devguide/agents-tools-runtime.md @@ -5,2 +4,0 @@ -Amazon Bedrock AgentCore is in preview release and is subject to change. - @@ -14 +12 @@ Framework agnostic -Runtime lets you transform any local agent code to cloud-native deployments with a few lines of code no matter the underlying framework. Works seamlessly with popular frameworks like LangGraph, Strands, and CrewAI. You can also leverage it with custom agents that don't use a specific framework. +AgentCore Runtime lets you transform any local agent code to cloud-native deployments with a few lines of code no matter the underlying framework. Works seamlessly with popular frameworks like LangGraph, Strands, and CrewAI. You can also leverage it with custom agents that don't use a specific framework. @@ -19 +17 @@ Model flexibility -Runtime works with any Large Language Model, such as models offered by Amazon Bedrock, Anthropic Claude, Google Gemini, and OpenAI. +AgentCore Runtime works with any Large Language Model, such as models offered by Amazon Bedrock, Anthropic Claude, Google Gemini, and OpenAI. @@ -24 +22 @@ Protocol support -Runtime lets agents communicate with other agents and tools via Model Context Protocol (MCP). +AgentCore Runtime lets agents communicate with other agents and tools via Model Context Protocol (MCP). @@ -29 +27 @@ Extended execution time -Runtime supports both real-time interactions and long-running workloads up to 8 hours, enabling complex agent reasoning and asynchronous workloads that may involve multi-agent collaboration or extended problem-solving sessions. +AgentCore Runtime supports both real-time interactions and long-running workloads up to 8 hours, enabling complex agent reasoning and asynchronous workloads that may involve multi-agent collaboration or extended problem-solving sessions. @@ -34 +32 @@ Enhanced payload handling -Runtime can process 100MB payloads enabling seamless processing of multiple modalities (text, images, audio, video), with rich media content or large datasets. +AgentCore Runtime can process 100MB payloads enabling seamless processing of multiple modalities (text, images, audio, video), with rich media content or large datasets. @@ -39 +37 @@ Session isolation -In Runtime, each user session runs in a dedicated microVM with isolated CPU, memory, and filesystem resources. This helps create complete separation between user sessions, safeguarding stateful agent reasoning processes and helps prevent cross-session data contamination. After session completion, the entire microVM is terminated and memory is sanitized, delivering deterministic security even when working with non-deterministic AI processes. +In AgentCore Runtime, each user session runs in a dedicated microVM with isolated CPU, memory, and filesystem resources. This helps create complete separation between user sessions, safeguarding stateful agent reasoning processes and helps prevent cross-session data contamination. After session completion, the entire microVM is terminated and memory is sanitized, delivering deterministic security even when working with non-deterministic AI processes. @@ -49 +47 @@ Built-in authentication -Runtime, powered by Amazon Bedrock AgentCore Identity, assigns distinct identities to AI agents and seamlessly integrates with your corporate identity provider such as Okta, Microsoft Entra ID, or Amazon Cognito, enabling your end users to authenticate into only the agents they have access to. In addition, Runtime lets outbound authentication flows to securely access third-party services like Slack, Zoom, and GitHub - whether operating on behalf of users or autonomously (using either OAuth or API keys). +AgentCore Runtime, powered by AgentCore Identity, assigns distinct identities to AI agents and seamlessly integrates with your corporate identity provider such as Okta, Microsoft Entra ID, or Amazon Cognito, enabling your end users to authenticate into only the agents they have access to. In addition, Runtime lets outbound authentication flows to securely access third-party services like Slack, Zoom, and GitHub - whether operating on behalf of users or autonomously (using either OAuth or API keys). @@ -54 +52 @@ Agent-specific observability -Runtime provides specialized built-in tracing that captures agent reasoning steps, tool invocations, and model interactions, providing clear visibility into agent decision-making processes, a critical capability for debugging and auditing AI agent behaviors. +AgentCore Runtime provides specialized built-in tracing that captures agent reasoning steps, tool invocations, and model interactions, providing clear visibility into agent decision-making processes, a critical capability for debugging and auditing AI agent behaviors. @@ -59 +57,38 @@ Unified set of agent-specific capabilities -Runtime is delivered through a single, comprehensive SDK that provides streamlined access to the complete Amazon Bedrock AgentCore capabilities including Memory, Tools, and Gateway. This integrated approach eliminates the integration work typically required when building equivalent agent infrastructure from disparate components. +AgentCore Runtime is delivered through a single, comprehensive SDK that provides streamlined access to the complete AgentCore capabilities including Memory, Tools, and Gateway. This integrated approach eliminates the integration work typically required when building equivalent agent infrastructure from disparate components. + +###### Topics + + * [How it works](./runtime-how-it-works.html) + + * [IAM Permissions for AgentCore Runtime](./runtime-permissions.html) + + * [Get started with AgentCore Runtime](./runtime-getting-started.html) + + * [Use any agent framework](./using-any-agent-framework.html) + + * [Use any foundation model](./using-any-model.html) + + * [Deploy MCP servers in AgentCore Runtime](./runtime-mcp.html) + + * [Deploy A2A servers in AgentCore Runtime](./runtime-a2a.html) + + * [Use isolated sessions for agents](./runtime-sessions.html) + + * [Handle asynchronous and long running agents with Amazon Bedrock AgentCore Runtime ](./runtime-long-run.html) + + * [Stream agent responses](./response-streaming.html) + + * [Pass custom headers to Amazon Bedrock AgentCore Runtime](./runtime-header-allowlist.html) + + * [Authenticate and authorize with Inbound Auth and Outbound Auth](./runtime-oauth.html) + + * [AgentCore Runtime versioning and endpoints](./agent-runtime-versioning.html) + + * [Invoke an AgentCore Runtime agent](./runtime-invoke-agent.html) + + * [Observe agents in Amazon Bedrock AgentCore Runtime](./runtime-observability.html) + + * [Troubleshoot AgentCore Runtime](./runtime-troubleshooting.html) + + + @@ -67 +102 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -AWS Regions +Understand the available interfaces for using AgentCore