AWS bedrock-agentcore documentation change
Summary
Added token monitoring for long-term memory extraction
Security assessment
150,000 token/minute limit with CloudWatch monitoring helps detect resource overuse patterns but doesn't directly address a specific vulnerability. Enhances security observability.
Diff
diff --git a/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.md b/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.md index c5bcd2921..5a76f9294 100644 --- a//bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.md +++ b//bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.md @@ -7,2 +6,0 @@ AgentCore Runtime Service QuotasAgentCore Memory Service QuotasAgentCore Identit -Amazon Bedrock AgentCore is in preview release and is subject to change. - @@ -42,3 +40,3 @@ Resource allocation limits Limit | Default Value | Adjustable | Notes -Active Session workloads per account | 500 in US East (N. Virginia) and Asia Pacific (Sydney), and 250 in Europe (Frankfurt) and US West (Oregon). | Yes | Can be increased via support ticket -Total agents per account | 1000 | Yes | Can be increased via support ticket -Versions per agent | 1000 | Yes | Inactive versions deleted after 45 days +Active session workloads per account | 1,000 in US East (N. Virginia) and US West (Oregon), and 500 in other AWS Regions. | Yes | Can be increased via support ticket +Total agents per account | 1,000 | Yes | Can be increased via support ticket +Versions per agent | 1,000 | Yes | Inactive versions deleted after 45 days @@ -47 +45 @@ Maximum size for a Docker image in an AgentCore Runtime | 1 GB | No | -Hardware configuration per session | 2vCPU/8GB | No | The maximum memory/CPU usage and configuration per account +Maximum hardware allocation per session | 2vCPU/8GB | No | The maximum memory/CPU usage and allocation per Runtime session @@ -56,4 +54,25 @@ Request timeout | 15 minutes | No | Maximum time for synchronous requests -Max payload size | 100 MB | No | Maximum size for request/response payloads -Streaming max duration | 60 mins | No | Maximum time for streaming connections -Async job max duration | 8 hours | No | Maximum execution time for asynchronous jobs -Invocations per second | 100 per endpoint | Yes | Rate limit for API calls +Maximum payload size | 100 MB | No | Maximum size for request/response payloads +Streaming chunk size | 10 MB | No | Maximum size for individual chunks +Streaming maximum duration | 60 mins | No | Maximum time for streaming connections +Asynchronous job maximum duration | 8 hours | No | Maximum execution time for asynchronous jobs +Invocations per second | 25 per endpoint | Yes | Rate limit for API calls + +### Throttling limits + +The following table describes the rate limits for AgentCore Runtime after which you will be throttled: + +Throttling limits Limit | Value | Adjustable | Notes +---|---|---|--- +InvokeAgentRuntime API rate, per agent, per account | 25 TPS | Yes | Transactions per second +New sessions created rate, per endpoint | 10 TPM | No | Transactions per minute +CreateAgentRuntime API rate | 5 TPS | Yes | Transactions per second +CreateAgentRuntimeEndpoint API rate | 5 TPS | Yes | Transactions per second +GetAgentRuntime API rate | 50 TPS | Yes | Transactions per second +GetAgentRuntimeEndpoint API rate | 50 TPS | Yes | Transactions per second +UpdateAgentRuntime API rate | 5 TPS | Yes | Transactions per second +UpdateAgentRuntimeEndpoint API rate | 5 TPS | Yes | Transactions per second +DeleteAgentRuntime API rate | 5 TPS | Yes | Transactions per second +DeleteAgentRuntimeEndpoint API rate | 5 TPS | Yes | Transactions per second +ListAgentRuntimes API rate | 5 TPS | Yes | Transactions per second +ListAgentRuntimeEndpoints API rate | 5 TPS | Yes | Transactions per second +ListAgentRuntimeVersions API rate | 5 TPS | Yes | Transactions per second @@ -67,2 +86,2 @@ Lifetime session lifecycle parameters Phase | Timeout | Adjustable | Notes -Session Termination | 15 minutes of inactivity | No | Execution Environment is terminated. Customer will get a new Execution environment for the Session -Max Session Duration | 8 hrs | No | +Idle session timeout | 15 minutes of inactivity | Yes, through the `idleRuntimeSessionTimeout` API parameter in the `LifecycleConfiguration` data type | When this limit is reached, the execution environment is terminated and a new one is created for the session +Maximum session duration | 8 hrs | Yes, through the `maxLifetime` API parameter in the `LifecycleConfiguration` data type | @@ -72,14 +91,18 @@ Max Session Duration | 8 hrs | No | -AgentCore Memory limits Limit | Value ----|--- -Number of AgentCore Memory resources per AWS Region in an AWS account. | 50 -Max Number of memory strategies per AgentCore Memory instance | 6 -Minimum EventExpirationDuration days in CreateEvent operation | 7 -Maximum EventExpirationDuration days in CreateEvent operation | 365 -Prompt Size (AppendToPrompt) for Custom Memory Strategy (Extraction/Consolidation) | 30 KB -Max Number of messages per CreateEvent operation | 100 -Max message size in CreateEvent operation | 9 KB -Max event size in CreateEvent operation | 10 MB -Max TPS for CreateEvent (per account) | 5 -Max TPS for CreateEvent (per combination of account, actor, session) | 0.25 -Max TPS for RetrieveMemoryRecords (per account) | 5 -Max TPS for all other AgentCore Memory APIs | 20 +The following table describes the lifetime session lifecycle parameters for AgentCore Memory: + +AgentCore Memory limits Limit | Value | Notes +---|---|--- +Maximum number of AgentCore Memory resources per AWS Region in an AWS account account | 50 | +Maximum number of memory strategies per AgentCore Memory instance | 6 | +Minimum EventExpirationDuration days in a CreateEvent operation | 7 | +Maximum EventExpirationDuration days in a CreateEvent operation | 365 | +Maximum prompt size (AppendToPrompt) for custom memory strategy (Extraction/Consolidation) | 30 KB | +Maximum number of messages per CreateEvent operation | 100 | +Maximum message size in a CreateEvent operation | 9 KB | +Maximum event size in a CreateEvent operation | 10 MB | +Maximum CreateEvent requests | 5 | The maximum number of `CreateEvent` requests per second that you can perform in this AWS account account in the current AWS Region. +Maximum CreateEvent requests per actor, per session, including conversational payloads | 0.25 | The maximum number of `CreateEvent` requests per second, per actor, per session, including conversational payloads that you can perform in this AWS account account in the current AWS Region. +Maximum CreateEvent requests per actor, per session, not including conversational payloads | 10 | The maximum number of `CreateEvent` requests per second, per actor, per session, not including conversational payloads that you can perform in this AWS account account in the current AWS Region. +Maximum RetrieveMemoryRecords requests | 5 | The maximum number of `RetrieveMemoryRecords` requests per second that you can perform in this AWS account account in the current AWS Region. +Maximum requests for all other AgentCore Memory APIs | 20 | The maximum transactions per second (TPS) that can be processed in this AWS account account in the current AWS Region for all other AgentCore Memory APIs. +Maximum number of tokens per minute for long-term memory extraction | 150,000 | The maximum number of tokens per minute that can be processed for long-term memory extraction for built-in strategies in this AWS account in the current AWS Region. You can monitor token use through the [Amazon CloudWatch metric](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/working_with_metrics.html) named `TokenCount` in the `Bedrock-AgentCore` namespace. You can request an increase to this limit through the Service Quotas console. @@ -89 +112 @@ Max TPS for all other AgentCore Memory APIs | 20 -When working with AgentCore Runtime, you need to be aware of the service limits that apply to your account. These limits help ensure service stability and availability for all users. +When working with AgentCore Identity, you need to be aware of the service limits that apply to your account. These limits help ensure service stability and availability for all users. @@ -93,2 +116,3 @@ AgentCore Identity Limits Limit | Value | Adjustable | Notes -API keys stored per AWS account per AWS Region | 50 | Yes | Can be increased via Support ticket -OAuth client credentials stored per AWS account per AWS Region | 50 | Yes | Can be increased via Support ticket +Workload identities | 1,000 | No | The maximum number of workload identities that you can create in this account in the current Region. +Resource OAuth2 credential providers | 50 | No | The maximum number of OAuth2 credential providers for egress resources that you can create in this account in the current Region. +Resource API key credential providers | 50 | No | The maximum number of API key credential providers for egress resources that you can create in this account in the current Region. @@ -134,22 +158,24 @@ Amazon Bedrock AgentCore Gateway has the following service quotas. You can reque -Amazon Bedrock AgentCore Gateway service quotas Quota | Default value | Adjustable | Notes ----|---|---|--- -Number of gateways per account | 100 | Yes | -Number of targets per gateway | 10 | Yes | -Number of tools per target | 200 | Yes | -Timeout for a gateway invocation | 55 seconds | Yes | Aligns with Lambda function timeout -Maximum inline schema size | 1 MB | Yes | -Maximum S3 payload schema size | 2 MB | Yes | -Tool name character limit | 256 characters | Yes | -CreateGateway API rate | 5 TPM | Yes | Transactions per minute -UpdateGateway API rate | 5 TPM | Yes | Transactions per minute -GetGateway API rate | 5 TPS | Yes | Transactions per second -ListGateways API rate | 5 TPS | Yes | Transactions per second -DeleteGateway API rate | 5 TPM | Yes | Transactions per minute -CreateGatewayTarget API rate | 5 TPM | Yes | Transactions per minute -UpdateGatewayTarget API rate | 5 TPM | Yes | Transactions per minute -GetGatewayTarget API rate | 5 TPS | Yes | Transactions per second -ListGatewayTargets API rate | 5 TPS | Yes | Transactions per second -DeleteGatewayTarget API rate | 5 TPM | Yes | Transactions per minute -CallTool/ListTool/SearchTool API rate at gateway level | 5 TPS | Yes | Transactions per second -CallTool/ListTool/SearchTool API rate at account level | 5 TPS | Yes | Transactions per second -Maximum CallTool/ListTool/SearchTool payload size | 6 MB | Yes | +Amazon Bedrock AgentCore Gateway service quotas Quota | Default value | Adjustable +---|---|--- +Number of gateways per account | 1000 | Yes +Number of targets per gateway | 100 | Yes +Number of tools per target | 1000 | Yes +Timeout for a gateway invocation | 5 minutes | Yes +Maximum inline schema size | 1 MB | Yes +Maximum S3 payload schema size | 10 MB | Yes +Tool name character limit | 256 characters | Yes +CreateGateway API rate | 5 transactions per second | Yes +UpdateGateway API rate | 5 transactions per second | Yes +GetGateway API rate | 10 transactions per second | Yes +ListGateways API rate | 10 transactions per second | Yes +DeleteGateway API rate | 5 transactions per second | Yes +CreateGatewayTarget API rate | 5 transactions per second | Yes +UpdateGatewayTarget API rate | 5 transactions per second | Yes +GetGatewayTarget API rate | 10 transactions per second | Yes +ListGatewayTargets API rate | 10 transactions per second | Yes +DeleteGatewayTarget API rate | 5 transactions per second | Yes +Concurrent target operations (total of Create/Update/DeleteTarget) on same gateway | 5 | Yes +tool-call/tool-list rate at gateway level | 50 concurrent connections | Yes +tool-call/tool-list rate at account level | 50 concurrent connections | Yes +Search-based tool-call rate | 25 transactions per minute | Yes +Maximum tool-call/tool-list/tool-search payload size | 6 MB | Yes