AWS bedrock-agentcore low security documentation change
Summary
Restructured documentation with expanded prerequisites, added IAM policy configuration details, and integration guidance for AWS Strands framework. Removed preview notice and simplified setup instructions.
Security assessment
Added detailed IAM policy configuration requiring specific permissions for browser session management and model access. While not fixing a vulnerability, it explicitly documents security controls required for safe usage of the service.
Diff
diff --git a/bedrock-agentcore/latest/devguide/browser-onboarding.md b/bedrock-agentcore/latest/devguide/browser-onboarding.md index 97072491b..ef2712177 100644 --- a//bedrock-agentcore/latest/devguide/browser-onboarding.md +++ b//bedrock-agentcore/latest/devguide/browser-onboarding.md @@ -5 +5,13 @@ -PrerequisitesQuick startBest practices +PrerequisitesUsing AgentCore Browser via AWS Strands + +# Get started with AgentCore Browser + +AgentCore Browser enables your agents to interact with web pages through a managed Chrome browser. The agent can navigate websites, search for information, extract content, and interact with web elements in a secure, managed environment. + +This page covers the prerequisites and helps you get started using _AWS Strands_. Strands provides a high-level agent framework that simplifies building AI agents with built-in tool integration, conversation management, and automatic session handling. + +###### Topics + + * Prerequisites + + * Using AgentCore Browser via AWS Strands @@ -7 +18,0 @@ PrerequisitesQuick startBest practices -Amazon Bedrock AgentCore is in preview release and is subject to change. @@ -9 +19,0 @@ Amazon Bedrock AgentCore is in preview release and is subject to change. -# Get started with Amazon Bedrock AgentCore Browser @@ -11 +20,0 @@ Amazon Bedrock AgentCore is in preview release and is subject to change. -The following sections show how you can get started with the AgentCore Browser tool. @@ -15 +24 @@ The following sections show how you can get started with the AgentCore Browser t -Before using the AgentCore Browser, ensure you meet the following requirements: +Before you start, ensure you have: @@ -17 +26 @@ Before using the AgentCore Browser, ensure you meet the following requirements: - * You have an active AWS account with access to Amazon Bedrock AgentCore + * AWS account with credentials configured. See Configuring your credentials. @@ -20,0 +30,8 @@ Before using the AgentCore Browser, ensure you meet the following requirements: + * Boto3 installed. See [Boto3 documentation](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/quickstart.html). + + * IAM execution role with the required permissions. See Configuring your credentials. + + * Model access: Anthropic Claude Sonnet 4.0 [enabled](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access-modify.html) in the Amazon Bedrock console. For information about using a different model with the Strands Agents see the _Model Providers_ section in the [Strands Agents SDK documentation](https://strandsagents.com/latest/documentation/docs/). + + * AWS Region where Amazon Bedrock AgentCore is available. See [AWS Regions](./agentcore-regions.html). + @@ -26 +43 @@ Before using the AgentCore Browser, ensure you meet the following requirements: -###### Install the SDK +### Configuring your credentials @@ -28 +45 @@ Before using the AgentCore Browser, ensure you meet the following requirements: -Install the Amazon Bedrock AgentCore SDK using pip: +Perform the following steps to configure your AWS credentials and attach the required permissions to use AgentCore Browser. @@ -29,0 +47 @@ Install the Amazon Bedrock AgentCore SDK using pip: + 1. ###### Verify your AWS credentials @@ -31 +49 @@ Install the Amazon Bedrock AgentCore SDK using pip: - pip install bedrock-agentcore +Confirm your AWS credentials are configured: @@ -33 +51 @@ Install the Amazon Bedrock AgentCore SDK using pip: -## Quick start + aws sts get-caller-identity @@ -35 +53 @@ Install the Amazon Bedrock AgentCore SDK using pip: -The following example demonstrates how to start a remote browser session, interact with it programmatically using Playwright, and observe the session in real time via Live View. +Take note of the user or credentials returned here, as you'll be attaching permissions to this identity in the next step. @@ -37 +55 @@ The following example demonstrates how to start a remote browser session, intera -In this setup, Playwright is used to drive the browser automation. Simultaneously, clients can watch the browser's behavior in Live View as Playwright executes tasks. There are two primary ways to connect to the remote browser: +If this command fails, configure your credentials. For more information, see [Configuration and credential file settings](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html) in the AWS CLI documentation. @@ -39 +57 @@ In this setup, Playwright is used to drive the browser automation. Simultaneousl - * Automation endpoint – Enables agents to interact with the browser programmatically using automation frameworks like Playwright + 2. ###### Attach required permissions @@ -41 +59 @@ In this setup, Playwright is used to drive the browser automation. Simultaneousl - * Live View stream – Allows human users to watch the agent's interaction with the browser in real time and optionally take control for manual input. +Your IAM user or role needs permissions to use AgentCore Browser. Attach this policy to your IAM identity: @@ -42,0 +61,34 @@ In this setup, Playwright is used to drive the browser automation. Simultaneousl + { + "Version":"2012-10-17", + "Statement": [ + { + "Sid": "BedrockAgentCoreBrowserFullAccess", + "Effect": "Allow", + "Action": [ + "bedrock-agentcore:CreateBrowser", + "bedrock-agentcore:ListBrowsers", + "bedrock-agentcore:GetBrowser", + "bedrock-agentcore:DeleteBrowser", + "bedrock-agentcore:StartBrowserSession", + "bedrock-agentcore:ListBrowserSessions", + "bedrock-agentcore:GetBrowserSession", + "bedrock-agentcore:StopBrowserSession", + "bedrock-agentcore:UpdateBrowserStream", + "bedrock-agentcore:ConnectBrowserAutomationStream", + "bedrock-agentcore:ConnectBrowserLiveViewStream" + ], + "Resource": "arn:aws:bedrock-agentcore:<Region>:<account_id>:browser/*" + }, + { + "Sid": "BedrockModelAccess", + "Effect": "Allow", + "Action": [ + "bedrock:InvokeModel", + "bedrock:InvokeModelWithResponseStream" + ], + "Resource": [ + "*" + ] + } + ] + } @@ -43,0 +96 @@ In this setup, Playwright is used to drive the browser automation. Simultaneousl +**To attach this policy** : @@ -44,0 +98 @@ In this setup, Playwright is used to drive the browser automation. Simultaneousl + * Navigate to the IAM Console @@ -46 +100 @@ In this setup, Playwright is used to drive the browser automation. Simultaneousl -You can set up the Browser Tool quickly by installing and using the Amazon Bedrock AgentCore SDK. + * Find your user or role (the one returned by `aws sts get-caller-identity`) @@ -47,0 +102 @@ You can set up the Browser Tool quickly by installing and using the Amazon Bedro + * Click **Add permissions** → **Create inline policy** @@ -49,2 +104 @@ You can set up the Browser Tool quickly by installing and using the Amazon Bedro - # Clone the SDK examples repository - git clone https://github.com/awslabs/amazon-bedrock-agentcore-samples.git + * Switch to JSON view and paste the policy above @@ -52,3 +106 @@ You can set up the Browser Tool quickly by installing and using the Amazon Bedro - # Follow the README instructions to install dependencies - cd amazon-bedrock-agentcore-samples - pip install -r requirements.txt + * Name it `AgentCoreBrowserAccess` and save @@ -56,3 +108 @@ You can set up the Browser Tool quickly by installing and using the Amazon Bedro - # Install a browser automation framework such as Playwright (for Python) - # to programmatically control and interact with browser - pip install playwright +###### Note @@ -60,2 +110 @@ You can set up the Browser Tool quickly by installing and using the Amazon Bedro - # For browser visualization, you'll need the BrowserViewerServer component - cd 01-tutorials/05-AgentCore-tools/02-Agent-Core-browser-tool/interactive_tools +Replace `<Region>` with your actual AWS Region and `<account_id>` with your AWS account ID. @@ -62,0 +112 @@ You can set up the Browser Tool quickly by installing and using the Amazon Bedro + 3. ###### Verify your setup @@ -64 +114 @@ You can set up the Browser Tool quickly by installing and using the Amazon Bedro -After installing the SDK and Playwright, you can start a browser session with the following code: +Confirm your setup is correct by checking: @@ -65,0 +116 @@ After installing the SDK and Playwright, you can start a browser session with th + * Your AWS credentials are properly configured @@ -67,5 +118 @@ After installing the SDK and Playwright, you can start a browser session with th - from playwright.sync_api import sync_playwright, Playwright, BrowserType - from bedrock_agentcore.tools.browser_client import browser_session - from browser_viewer import BrowserViewerServer - import time - from rich.console import Console + * The IAM policy is attached to your user or role @@ -73 +120 @@ After installing the SDK and Playwright, you can start a browser session with th - console = Console() + * Model access is enabled in the Amazon Bedrock console @@ -75,4 +121,0 @@ After installing the SDK and Playwright, you can start a browser session with th - def run(playwright: Playwright): - # Create the browser session and keep it alive - with browser_session('us-west-2') as client: - ws_url, headers = client.generate_ws_headers() @@ -80,3 +122,0 @@ After installing the SDK and Playwright, you can start a browser session with th - # Start viewer server - viewer = BrowserViewerServer(client, port=8005) - viewer_url = viewer.start(open_browser=True) @@ -84,6 +123,0 @@ After installing the SDK and Playwright, you can start a browser session with th - # Connect using headers - chromium: BrowserType = playwright.chromium - browser = chromium.connect_over_cdp( - ws_url, - headers=headers - ) @@ -91,2 +125 @@ After installing the SDK and Playwright, you can start a browser session with th - context = browser.contexts[0] - page = context.pages[0] +The following sections show you how to use the Amazon Bedrock AgentCore Browser with and without the agent framework. Using the Browser directly without an agent framework is especially useful when you want to execute specific browser automation tasks programmatically. @@ -94,15 +127 @@ After installing the SDK and Playwright, you can start a browser session with th - try: - page.goto("https://amazon.com/") - console.print(page.title()) - # Keep running - while True: - time.sleep(120) - except KeyboardInterrupt: - console.print("\n\n[yellow]Shutting down...[/yellow]") - if 'client' in locals(): - client.stop() - console.print("✅ Browser session terminated") - except Exception as e: - console.print(f"\n[red]Error: {e}[/red]") - import traceback - traceback.print_exc() +## Using AgentCore Browser via AWS Strands @@ -110,2 +129 @@ After installing the SDK and Playwright, you can start a browser session with th - with sync_playwright() as playwright: - run(playwright) +The following sections show you how to use the Amazon Bedrock AgentCore Browser with the Strands SDK. Before you go through the examples in this section, see Prerequisites. @@ -112,0 +131 @@ After installing the SDK and Playwright, you can start a browser session with th +###### Topics @@ -114 +133 @@ After installing the SDK and Playwright, you can start a browser session with th -This example: + * Step 1: Install dependencies @@ -116 +135 @@ This example: - * Creates a browser session using the browser_session client + * Step 2: Create your agent with AgentCore Browser @@ -118 +137 @@ This example: - * Retrieve the WebSocket connection details required for automation and live view. + * Step 3: Run the agent @@ -120 +139 @@ This example: - * Start the viewer server, which launches a browser window to display the remote browser session via Live View. + * Step 4: View the browser session live