AWS bedrock-agentcore documentation change
Summary
Expanded observability documentation with new sections for resource usage metrics, span data, application logs, and error tracking. Added detailed telemetry specifications including CPU/memory monitoring, session-level logging, and integration with AWS monitoring services.
Security assessment
The changes enhance operational visibility but don't address specific vulnerabilities. However, they add security-adjacent documentation by detailing monitoring capabilities (resource usage, error tracking) that could help identify anomalies. The inclusion of session-level logging with sensitive fields like request/response payloads introduces potential data protection considerations, but no explicit security controls are mentioned.
Diff
diff --git a/bedrock-agentcore/latest/devguide/observability-runtime-metrics.md b/bedrock-agentcore/latest/devguide/observability-runtime-metrics.md index 0dffbb390..c053da7b5 100644 --- a//bedrock-agentcore/latest/devguide/observability-runtime-metrics.md +++ b//bedrock-agentcore/latest/devguide/observability-runtime-metrics.md @@ -5 +5 @@ -Error types +Observability runtime metricsResource usage metrics and logs Provided span dataApplication log dataError types @@ -7,3 +7 @@ Error types -Amazon Bedrock AgentCore is in preview release and is subject to change. - -# AgentCore provided runtime metrics +# AgentCore generated runtime observability data @@ -12,0 +11,17 @@ The runtime metrics provided by AgentCore give you visibility into your agent ex +###### Topics + + * Observability runtime metrics + + * Resource usage metrics and logs + + * Provided span data + + * Application log data + + * Error types + + + + +## Observability runtime metrics + @@ -59,0 +75,106 @@ Shows the total number of sessions across all resources. +## Resource usage metrics and logs + +Amazon Bedrock AgentCore runtime provides comprehensive resource usage telemetry, including CPU and memory consumption metrics for your runtime resources. + +###### Note + +Resource usage data may be delayed by up to 60 minutes and precision might differ across metrics. + +**Vended metrics** + +Amazon Bedrock AgentCore runtime automatically provides resource usage metrics at account, agent runtime, and agent endpoint levels. These metrics are published at 1-minute resolution. Amazon CloudWatch aggregation and metric data retention will follow standard Amazon CloudWatch data retention polices. For more information, see <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html#Metric>. + +Here are the dimension sets and metrics available for monitoring your resources: + +Name | Dimensions | Description +---|---|--- +CPUUsed-vCPUHours | Service; Service, Resource; Service, Resource, Name | The total amount of virtual CPU consumed in vCPU-Hours unit, available at the resource and account levels. Useful for resource tracking and estimated billing visibility. +MemoryUsed-GBHours | Service; Service, Resource; Service, Resource, Name | The total amount of memory consumed in GB-Hours unit, available at the resource and account levels. Useful for resource tracking and estimated billing visibility. + +Dimension explanation + + * **Service** \- AgentCore.Runtime + + * **Resource** \- Agent Arn + + * **Name** \- Agent Endpoint name, in the format of AgentName::EndpointName + + + + +Account level metrics are available in Amazon CloudWatch Bedrock AgentCore Observability Console under the **Runtime** tab. The dashboard displays Memory and CPU usage graphs generated from these metrics, representing total resource usage across all agents in your account within the region. + +Agent Endpoint level metrics are available in AgentEndpoint page of Amazon CloudWatch Bedrock AgentCore Observability Console. The dashboard displays Memory and CPU usage graphs generated from these metrics, representing total resource usage across all sessions invoked by the specified Agent Endpoint. + +###### Note + +Telemetry data is provided for monitoring purposes. Actual billing is calculated based on metered usage data and may differ from telemetry values due to aggregation timing, reconciliation processes, and measurement precision. Refer to your AWS billing statement for authoritative charges. + +**Vended logs** + +Bedrock AgentCore Runtime provides vended logs for session-level usage metrics at 1-second granularity. Each log record contains resource consumption data including CPU usage (agent.runtime.vcpu.hours.used) and memory consumption (agent.runtime.memory.gb_hours.used). + +Each log record will have following schema: + +Log type | Log fields | Description +---|---|--- +USAGE_LOGS | event_timestamp, resource_arn, service.name, cloud.provider, cloud.region, account.id, region, resource.id, session.id, agent.name, elapsed_time_seconds, agent.runtime.vcpu.hours.used, agent.runtime.memory.gb_hours.used | Resource Usage Logs for session-level resource tracking. + +To enable USAGE_LOG log type for your agents, see [Add observability to your Amazon Bedrock AgentCore resources](./observability-configure.html). The logs are then displayed in the configured destination (AWS LogGroup, Amazon S3 or Amazon Kinesis Firehose) as configured. + +In the Agent Session page of the Amazon CloudWatch Bedrock AgentCore Observability Console, you can see resource usage metrics generated from these logs. To optimize your metric viewing experience, select your desired time range using the selector in the top right to focus on specific CPU and Memory Usage data. + +###### Note + +Telemetry data is provided for monitoring purposes. Actual billing is calculated based on metered usage data and may differ from telemetry values due to aggregation timing, reconciliation processes, and measurement precision. Refer to your AWS billing statement for authoritative charges. + +## Provided span data + +To enhance observability, AgentCore provides structured spans that provide visibility into agent runtime invocations. To enable this span data, you need to enable observability on your agent resource. See [Add observability to your Amazon Bedrock AgentCore resources](./observability-configure.html) for steps and details. This span data is available in AWS CloudWatch Logs aws/spans log group. The following table defines the operation for which spans are created and the attributes for each captured span. + +Operation name | Span attributes | Description +---|---|--- +InvokeAgentRuntime | aws.operation.name, aws.resource.arn, aws.request_id, aws.agent.id, aws.endpoint.name, aws.account.id, session.id, latency_ms, error_type, aws.resource.type, aws.xray.origin, aws.region | Invokes the agent runtime. + + * aws.operation.name - the operation name (InvokeAgentRuntime) + + * aws.resource.arn - the Amazon resource name for the agent runtime + + * aws.request_id - request ID for the invocation + + * aws.agent.id - the unique identifier for the agent runtime + + * aws.endpoint.name - the name of the endpoint used to invoke the agent runtime + + * aws.account.id - customer’s account id + + * session.id - the session ID for the invocation + + * latency_ms - the latency of the request in milliseconds + + * error_type - either throttle, system, or user (only present if error) + + * aws.resource.type - the CFN resource type + + * aws.xray.origin - the CFN resource type used by x-ray to identify the service + + * aws.region - the region the customer resource exists in + + + + +## Application log data + +AgentCore provides structured Application logs that help you gain visibility into your agent runtime invocations and session-level resource consumption. This log data is provided when enabling observability on your agent resource. See [Add observability to your Amazon Bedrock AgentCore resources](./observability-configure.html) for steps and details. AgentCore can output logs to CloudWatch Logs, Amazon S3, or Firehose stream. If you use a CloudWatch Logs destination, these logs are stored under your agent’s application logs or under your own custom log group. + +Log type | Log fields | Description +---|---|--- +APPLICATION_LOGS | timestamp, resource_arn, event_timestamp, account_id, request_id, session_id, trace_id, span_id, service_name, operation, request_payload, response_payload | Application logs for InvokeRuntimeOperation with tracing fields, request, and response payloads + + * request_payload - the request payload of the agent invocation + + * response_payload - the response from the agent invocation + + + + @@ -99 +220 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -AgentCore provided metrics +AgentCore generated observability data @@ -101 +222 @@ AgentCore provided metrics -Provided memory metrics +Memory observability data