AWS bedrock-agentcore medium security documentation change
Summary
Restructured documentation to focus on credential configuration and IAM permissions for Code Interpreter. Added detailed IAM policy requirements, removed code examples, and emphasized secure environment execution.
Security assessment
Added explicit IAM policy requirements for Code Interpreter access and emphasized secure execution environment. The changes introduce security controls by specifying granular permissions (bedrock-agentcore:CreateCodeInterpreter, InvokeCodeInterpreter, etc.) and requiring credential configuration, which helps prevent unauthorized access. However, there's no indication this addresses a specific existing vulnerability.
Diff
diff --git a/bedrock-agentcore/latest/devguide/code-interpreter-getting-started.md b/bedrock-agentcore/latest/devguide/code-interpreter-getting-started.md index 830e9d245..00cae1bb8 100644 --- a//bedrock-agentcore/latest/devguide/code-interpreter-getting-started.md +++ b//bedrock-agentcore/latest/devguide/code-interpreter-getting-started.md @@ -5 +5 @@ -PrerequisitesQuick start +PrerequisitesConfiguring your credentials @@ -7 +7 @@ PrerequisitesQuick start -Amazon Bedrock AgentCore is in preview release and is subject to change. +# Get started with AgentCore Code Interpreter @@ -9 +9 @@ Amazon Bedrock AgentCore is in preview release and is subject to change. -# Get started with Amazon Bedrock AgentCore Code Interpreter +AgentCore Code Interpreter enables your agents to execute Python code in a secure, managed environment. The agent can perform calculations, analyze data, generate visualizations, and validate answers through code execution. @@ -11 +11 @@ Amazon Bedrock AgentCore is in preview release and is subject to change. -The following sections show how you can get started with the AgentCore Code Interpreter tool by illustrating a hello world example. +This page covers the prerequisites and provides two approaches to get started: @@ -13 +13 @@ The following sections show how you can get started with the AgentCore Code Inte -## Prerequisites + * **Using AWS Strands** \- A high-level agent framework that simplifies building AI agents with built-in tool integration, conversation management, and automatic session handling. @@ -15 +15 @@ The following sections show how you can get started with the AgentCore Code Inte -Before using the AgentCore Code Interpreter, ensure you meet the following requirements: + * **Direct usage** \- SDK and Boto3 approaches that provide more control over session management and code execution for custom implementations. @@ -17 +16,0 @@ Before using the AgentCore Code Interpreter, ensure you meet the following requi - * You have an active AWS account with permissions to use Amazon Bedrock AgentCore @@ -19 +17,0 @@ Before using the AgentCore Code Interpreter, ensure you meet the following requi - * Python 3.10+ installed @@ -21 +18,0 @@ Before using the AgentCore Code Interpreter, ensure you meet the following requi - * For programmatic access, you have installed and configured the AWS SDK or AWS CLI @@ -22,0 +20 @@ Before using the AgentCore Code Interpreter, ensure you meet the following requi +###### Topics @@ -23,0 +22 @@ Before using the AgentCore Code Interpreter, ensure you meet the following requi + * Prerequisites @@ -24,0 +24 @@ Before using the AgentCore Code Interpreter, ensure you meet the following requi + * Configuring your credentials @@ -26 +26 @@ Before using the AgentCore Code Interpreter, ensure you meet the following requi -Install the necessary packages. This guide uses the AgentCore starter toolkit for streamlined integration: + * [Using AgentCore Code Interpreter via AWS Strands](./code-interpreter-using-strands.html) @@ -27,0 +28 @@ Install the necessary packages. This guide uses the AgentCore starter toolkit fo + * [Using AgentCore Code Interpreter directly](./code-interpreter-using-directly.html) @@ -29,2 +29,0 @@ Install the necessary packages. This guide uses the AgentCore starter toolkit fo - # Install boto3 - pip install boto3 @@ -32,2 +30,0 @@ Install the necessary packages. This guide uses the AgentCore starter toolkit fo - # Configure AWS credentials - aws configure @@ -35,2 +31,0 @@ Install the necessary packages. This guide uses the AgentCore starter toolkit fo - # For AgentCore SDK approach, also install: - pip install bedrock-agentcore @@ -38 +33 @@ Install the necessary packages. This guide uses the AgentCore starter toolkit fo -## Quick start +## Prerequisites @@ -40 +35 @@ Install the necessary packages. This guide uses the AgentCore starter toolkit fo -You can quickly get started with the AgentCore Code Interpreter using either the AgentCore SDK or boto3. Both approaches allow you to create sessions and execute code. +Before you start, ensure you have: @@ -42 +37 @@ You can quickly get started with the AgentCore Code Interpreter using either the -Using code_session + * AWS account with credentials configured. See Configuring your credentials. @@ -43,0 +39 @@ Using code_session + * Python 3.10+ installed @@ -45 +41 @@ Using code_session -This example uses the `code_session` context manager for automatic session management: + * Boto3 installed. See [Boto3 documentation](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/quickstart.html). @@ -46,0 +43 @@ This example uses the `code_session` context manager for automatic session manag + * IAM execution role with the required permissions. See Configuring your credentials. @@ -48 +45 @@ This example uses the `code_session` context manager for automatic session manag - from bedrock_agentcore.tools.code_interpreter_client import code_session + * Model access: Anthropic Claude Sonnet 4.0 [enabled](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access-modify.html) in the Amazon Bedrock console. For information about using a different model with the Strands Agents see the _Model Providers_ section in the [Strands Agents SDK documentation](https://strandsagents.com/latest/documentation/docs/). @@ -50,4 +47 @@ This example uses the `code_session` context manager for automatic session manag - # Create a code interpreter session using the context manager - with code_session("<Region>") as client: - # The session is automatically created and managed - print(f"Code interpreter session created") + * AWS Region where Amazon Bedrock AgentCore is available. See [AWS Regions](./agentcore-regions.html). @@ -55,5 +48,0 @@ This example uses the `code_session` context manager for automatic session manag - # Execute Python code - result = client.invoke("executeCode", { - "language": "python", - "code": 'print("Hello World!!!")' - }) @@ -61,3 +49,0 @@ This example uses the `code_session` context manager for automatic session manag - # Process the streaming results - for event in result["stream"]: - print(event["result"]["content"]) @@ -65 +50,0 @@ This example uses the `code_session` context manager for automatic session manag - # The session is automatically closed when exiting the context manager @@ -66,0 +52 @@ This example uses the `code_session` context manager for automatic session manag +## Configuring your credentials @@ -68 +54 @@ This example uses the `code_session` context manager for automatic session manag -Using boto3 +Perform the following steps to configure your AWS credentials and attach the required permissions. @@ -69,0 +56 @@ Using boto3 + 1. ###### Verify your AWS credentials @@ -71 +58 @@ Using boto3 -This example uses the boto3 client to start a code interpreter session and run a simple hello world program: +Confirm your AWS credentials are configured: @@ -72,0 +60 @@ This example uses the boto3 client to start a code interpreter session and run a + aws sts get-caller-identity @@ -74 +62 @@ This example uses the boto3 client to start a code interpreter session and run a - # hello_world.py +###### Note @@ -76,2 +64 @@ This example uses the boto3 client to start a code interpreter session and run a - import boto3 - import json +Take note of the user or credentials returned here, as you'll be using it when attaching the required permissions. @@ -79,3 +66 @@ This example uses the boto3 client to start a code interpreter session and run a - code_to_execute = """ - print("Hello World!!!") - """ +If this command fails, configure your credentials. For more information, see [Configuration and credential file settings in the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html). @@ -83 +68 @@ This example uses the boto3 client to start a code interpreter session and run a - client = boto3.client("bedrock-agentcore", region_name="<Region>", endpoint_url="https://bedrock-agentcore.<Region>.amazonaws.com") + 2. ###### Attach required permissions @@ -85,5 +70 @@ This example uses the boto3 client to start a code interpreter session and run a - session_id = client.start_code_interpreter_session( - codeInterpreterIdentifier="aws.codeinterpreter.v1", - name="my-code-session", - sessionTimeoutSeconds=900 - )["sessionId"] +Your IAM user or role needs permissions to use AgentCore Code Interpreter. Attach this policy to your IAM identity: @@ -91,7 +72,24 @@ This example uses the boto3 client to start a code interpreter session and run a - execute_response = client.invoke_code_interpreter( - codeInterpreterIdentifier="aws.codeinterpreter.v1", - sessionId=session_id, - name="executeCode", - arguments={ - "language": "python", - "code": code_to_execute +###### Note + +Replace `<region>` with your chosen region (for example, `us-west-2`) and `<account_id>` with your AWS account ID in the policy below: + + { + "Version":"2012-10-17", &TCX5-2025-waiver; + "Statement": [ + { + "Sid": "BedrockAgentCoreCodeInterpreterFullAccess", + "Effect": "Allow", + "Action": [ + "bedrock-agentcore:CreateCodeInterpreter", + "bedrock-agentcore:StartCodeInterpreterSession", + "bedrock-agentcore:InvokeCodeInterpreter", + "bedrock-agentcore:StopCodeInterpreterSession", + "bedrock-agentcore:DeleteCodeInterpreter", + "bedrock-agentcore:ListCodeInterpreters", + "bedrock-agentcore:GetCodeInterpreter", + "bedrock-agentcore:GetCodeInterpreterSession", + "bedrock-agentcore:ListCodeInterpreterSessions" + ], + "Resource": "arn:aws:bedrock-agentcore:<region>:<account_id>:code-interpreter/*" + } + ] @@ -99 +96,0 @@ This example uses the boto3 client to start a code interpreter session and run a - ) @@ -101,8 +97,0 @@ This example uses the boto3 client to start a code interpreter session and run a - # Extract and print the text output from the stream - for event in execute_response['stream']: - if 'result' in event: - result = event['result'] - if 'content' in result: - for content_item in result['content']: - if content_item['type'] == 'text': - print(content_item['text']) @@ -110,5 +98,0 @@ This example uses the boto3 client to start a code interpreter session and run a - # Don't forget to stop the session when you're done - client.stop_code_interpreter_session( - codeInterpreterIdentifier="aws.codeinterpreter.v1", - sessionId=session_id - ) @@ -117 +100,0 @@ This example uses the boto3 client to start a code interpreter session and run a -Using AgentCore SDK @@ -118,0 +102 @@ Using AgentCore SDK +###### To attach this policy @@ -120 +104 @@ Using AgentCore SDK -This example uses the Amazon Bedrock AgentCore SDK, which provides a more streamlined interface for working with the code interpreter: +Follow these steps: @@ -121,0 +106 @@ This example uses the Amazon Bedrock AgentCore SDK, which provides a more stream + 1. Go to the IAM console. @@ -123 +108 @@ This example uses the Amazon Bedrock AgentCore SDK, which provides a more stream - # hello_world_sdk.py + 2. Find your user or role from the response returned for the `get-caller-identity` API operation. @@ -125,2 +110 @@ This example uses the Amazon Bedrock AgentCore SDK, which provides a more stream - from bedrock_agentcore.tools.code_interpreter_client import CodeInterpreter - import json + 3. Choose **Add permissions** and then choose **Create inline policy** @@ -128,3 +112 @@ This example uses the Amazon Bedrock AgentCore SDK, which provides a more stream - # Configure and Start the code interpreter session - code_client = CodeInterpreter('<Region>') - code_client.start() + 4. Switch to JSON view and paste the policy above @@ -132,5 +114 @@ This example uses the Amazon Bedrock AgentCore SDK, which provides a more stream - # Execute the hello world code - response = code_client.invoke("executeCode", { - "language": "python", - "code": 'print("Hello World!!!")' - }) + 5. Name it `AgentCoreCodeInterpreterAccess` and save @@ -138,3 +115,0 @@ This example uses the Amazon Bedrock AgentCore SDK, which provides a more stream - # Process and print the response - for event in response["stream"]: - print(json.dumps(event["result"], indent=2))