AWS bedrock-agentcore documentation change
Summary
Expanded documentation on gateway metrics with detailed invocation/usage metrics, CloudWatch viewing instructions, and alarm setup guidance. Added structured metric tables, dimensions explanation, and CLI examples for monitoring.
Security assessment
The changes enhance observability by documenting metrics like throttles, errors, and latency monitoring. While improved monitoring can help detect operational issues, there's no direct evidence of addressing a specific security vulnerability. The alarm setup example for error rates improves operational awareness but doesn't explicitly mitigate a security flaw.
Diff
diff --git a/bedrock-agentcore/latest/devguide/observability-gateway-metrics.md b/bedrock-agentcore/latest/devguide/observability-gateway-metrics.md index cc077368f..123de45de 100644 --- a//bedrock-agentcore/latest/devguide/observability-gateway-metrics.md +++ b//bedrock-agentcore/latest/devguide/observability-gateway-metrics.md @@ -28 +28,32 @@ To enable service-provided logs for AgentCore gateways, you need to configure th -Invocations +Gateway publishes invocation and usage metrics to CloudWatch. You can view these metrics and also set up alarms to alert you when certain metrics exceed thresholds. To learn more, select a topic: + +###### Topics + + * Invocation metrics + + * Usage metrics + + * View gateway CloudWatch metrics + + * Setting up CloudWatch alarms + + + + +### Invocation metrics + +These metrics provide information about API invocations, performance, and errors. + +For these metrics, the following dimensions are used: + + * **Operation** – The name of the API operation (ex. InvokeGateway). + + * **Protocol** – The name of the protocol (ex. MCP). + + * **Method** – Represents the MCP operation being invoked (ex. tools/list). + + * **Resource** – Represents the identifier of the resource (ex. gateway ARN). + + * **Name** – Represents the name of the tool. + + @@ -31 +62,9 @@ Invocations -The total number of requests made to each Data Plane API. Each API call counts as one invocation regardless of the response status. +Metric | Description | Statistics | Units +---|---|---|--- +Invocations | The total number of requests made to each Data Plane API. Each API call counts as one invocation regardless of the response status. | Sum | Count +Throttles | The number of requests throttled (status code 429) by the service. | Sum | Count +SystemErrors | The number of requests which failed with 5xx status code. | Sum | Count +UserErrors | The number of requests which failed with 4xx status code except 429. | Sum | Count +Latency | The time elapsed between when the service receives the request and when it begins sending the first response token. In other words, initial response time. | Average, Minimum, Maximum, p50, p90, p99 | Milliseconds +Duration | The total time elapsed between receiving the request and sending the final response token. Represents complete end-to-end processing time of the request. | Average, Minimum, Maximum, p50, p90, p99 | Milliseconds +TargetExecutionTime | The total time taken to execute the target over Lambda / OpenAPI / etc. This helps determine the contribution of the target to the total Latency. | Average, Minimum, Maximum, p50, p90, p99 | Milliseconds @@ -33 +72 @@ The total number of requests made to each Data Plane API. Each API call counts a -Throttles [429] +### Usage metrics @@ -34,0 +74 @@ Throttles [429] +These metrics provide information about how your gateway is being used. @@ -36 +76,3 @@ Throttles [429] -The number of requests throttled (status code 429) by the service. +Metric | Description | Statistics | Units +---|---|---|--- +TargetType | The total number of requests served by each type of target (MCP, Lambda, OpenAPI). | Sum | Count @@ -38 +80 @@ The number of requests throttled (status code 429) by the service. -SystemErrors [5xx] +### View gateway CloudWatch metrics @@ -39,0 +82 @@ SystemErrors [5xx] +For more information about viewing CloudWatch metrics, see [View available metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/viewing_metrics_with_cloudwatch.html) in the [Amazon CloudWatch User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/). The following procedure shows you how to view metrics for your gateways: @@ -41 +84 @@ SystemErrors [5xx] -The number of requests which failed with 5xx status code. +###### To view gateway metrics in the console @@ -43 +86 @@ The number of requests which failed with 5xx status code. -UserErrors [4xx] + 1. Open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/). @@ -44,0 +88 @@ UserErrors [4xx] + 2. In the left navigation pane, choose **All metrics** under the **Metrics** section. @@ -46 +90 @@ UserErrors [4xx] -The number of requests which failed with 4xx status codes other than 429. + 3. Under **Browse** , from the dropdown menu that displays the current AWS Region, select the Region for which you want metrics. @@ -48 +92 @@ The number of requests which failed with 4xx status codes other than 429. -Latency + 4. Choose the **Bedrock-AgentCore** namespace. @@ -49,0 +94 @@ Latency + 5. Choose a dimension (ex. **Operation**) or combination of dimensions (ex. **Method, Operation, Protocol**) to view the metrics for it. @@ -51 +96 @@ Latency -The time elapsed between when the service receives the request and when it begins sending the first response token. + 6. To add a metric to the CloudWatch graph, select the checkbox next to it. @@ -53 +97,0 @@ The time elapsed between when the service receives the request and when it begin -Duration @@ -56 +99,0 @@ Duration -The total time elapsed between receiving the request and sending the final response token. Represents complete end-to-end processing time of the request. @@ -58 +101 @@ The total time elapsed between receiving the request and sending the final respo -TargetExecutionTime +### Setting up CloudWatch alarms @@ -59,0 +103 @@ TargetExecutionTime +You can use the [PutMetricAlarm](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricAlarm.html) API operation to set up CloudWatch alarms to alert you when certain metrics exceed thresholds. For example, you might want to be notified when the error rate exceeds 5% or when the latency exceeds 1 second. @@ -61 +105 @@ TargetExecutionTime -The total time take to execute the target over Lambda, OpenAPI, etc. This metric helps you to determine the contribution of the target to the total Latency. +The following example shows you how to create an alarm for high error rates using the AWS CLI: @@ -63 +106,0 @@ The total time take to execute the target over Lambda, OpenAPI, etc. This metric -TargetType @@ -64,0 +108,12 @@ TargetType + aws cloudwatch put-metric-alarm \ + --alarm-name "HighErrorRate" \ + --alarm-description "Alarm when error rate exceeds 5%" \ + --metric-name "SystemErrors" \ + --namespace "Bedrock-AgentCore" \ + --statistic "Sum" \ + --dimensions "Name=Resource,Value=my-gateway-arn" \ + --period 300 \ + --evaluation-periods 1 \ + --threshold 5 \ + --comparison-operator "GreaterThanThreshold" \ + --alarm-actions "arn:aws:sns:us-west-2:123456789012:my-topic" @@ -66 +121 @@ TargetType -The total number of requests served by each type of target (MCP, Lambda, OpenAPI). +This alarm will trigger when the number of system errors exceeds 5 in a 5-minute period. When the alarm triggers, it will send a notification to the specified SNS topic. @@ -129 +184 @@ Sample log with response body: -AgentCore now supports OTEL compliant vended spans that you can use to track invocations across different primitives that are being used. +AgentCore supports OTEL compliant vended spans that you can use to track invocations across different primitives that are being used.