AWS solutions documentation change
Summary
Expanded CloudFormation template options from 2 to 6 use cases, added detailed architecture documentation for Bedrock Agent, MCP Server, Agent Builder, and Workflow Builder components
Security assessment
The changes add documentation about authentication mechanisms (Cognito, Lambda authorizers) and IAM policies, but there's no evidence of addressing specific security vulnerabilities. The security-related content describes existing security features rather than patching issues.
Diff
diff --git a/solutions/latest/generative-ai-application-builder-on-aws/architecture-overview.md b/solutions/latest/generative-ai-application-builder-on-aws/architecture-overview.md index 3f1ce6560..6625c7a96 100644 --- a//solutions/latest/generative-ai-application-builder-on-aws/architecture-overview.md +++ b//solutions/latest/generative-ai-application-builder-on-aws/architecture-overview.md @@ -9 +9 @@ Architecture diagrams -This section provides two reference implementation architecture diagrams for the components deployed with this solution. +This section provides reference implementation architecture diagrams for the components deployed with this solution. @@ -13 +13 @@ This section provides two reference implementation architecture diagrams for the -To support multiple use cases and business needs, this solution provides two AWS CloudFormation templates: +To support multiple use cases and business needs, this solution provides six AWS CloudFormation templates: @@ -18,0 +19,8 @@ To support multiple use cases and business needs, this solution provides two AWS + 3. **Bedrock Agent use case** \- The Bedrock Agent use case enables the use of existing Bedrock Agents to complete tasks or automate repeated workflows. + + 4. **MCP Server** \- The MCP Server use case enables deployment and management of Model Context Protocol servers that provide standardized tool and resource access to AI applications. Supports both gateway methods for wrapping existing Lambda functions and APIs, and runtime methods for deploying custom containerized MCP servers. + + 5. **Agent Builder** \- The Agent Builder enables creation and deployment of production-ready AI agents on Amazon Bedrock AgentCore with full configuration control, MCP server integration, and memory management capabilities. + + 6. **Workflow Builder** \- The Workflow Builder enables creation of supervisor agents that orchestrate multiple Agent Builder agents using the Agents as Tools delegation pattern for complex multi-agent workflows. + @@ -113 +121 @@ If you choose to deploy this solution in an Amazon VPC, the data will be routed -### Agent use case +### Bedrock Agent use case @@ -115 +123 @@ If you choose to deploy this solution in an Amazon VPC, the data will be routed -**Depicts Agent use case architecture (when deployed with VPC option disabled)** +**Depicts Bedrock Agent use case architecture (when deployed with VPC option disabled)** @@ -119 +127 @@ If you choose to deploy this solution in an Amazon VPC, the data will be routed -**Depicts Agent use case architecture (when deployed with VPC option enabled)** +**Depicts Bedrock Agent use case architecture (when deployed with VPC option enabled)** @@ -153,0 +162,110 @@ If you choose to deploy this solution in an Amazon VPC, data will be routed with +### MCP Server use case + +**Depicts MCP Server use case architecture** + + + +The MCP Server use case enables deployment and management of Model Context Protocol servers on Amazon Bedrock AgentCore. MCP servers provide a standardized interface for AI applications to access tools, resources, and enterprise data sources. + +The solution supports two deployment methods: + + * **Gateway method** : Wraps existing Lambda functions or REST APIs as MCP tools, handling protocol translation automatically + + * **Runtime method** : Deploys custom containerized MCP servers from Amazon ECR images + + + + +The high-level process flow for MCP Server deployment is as follows: + + 1. Admin users deploy the MCP Server use case using the Deployment Dashboard, selecting either Gateway or Runtime deployment method. + + 2. This action is authenticated with Amazon Cognito. + + 3. For the Gateway deployment, the solution creates an Amazon Bedrock AgentCore Gateway that transforms existing Lambda functions or APIs into MCP-compliant tools. For the Runtime deployment, the solution deploys containerized MCP servers on Amazon Bedrock AgentCore Runtime using provided ECR images. + + 4. Gateway deployments retrieve the necessary API/Lambda/Smithy schemas from their uploaded location in Amazon S3. + + 5. Runtime deployments retrieve the containerized MCP server provided by the user from Amazon Elastic Container Registry (ECR) + + 6. The MCP Server is instrumented with an Amazon Bedrock AgentCore Identity OAuth client + + 7. The MCP Server makes the associated tools available at the /mcp endpoint for Agents to discover. + + 8. Amazon CloudWatch collects operational metrics and logs from MCP server deployments for monitoring and troubleshooting. + + + + +### Agent Builder use case + +**Depicts Agent Builder architecture** + + + +The high-level process flow for the Agent Builder components deployed with the AWS CloudFormation template is as follows: + + 1. Admin users deploy the use case using the Deployment Dashboard. [Business users](./concepts-and-definitions.html) sign in to the use case UI. + + 2. CloudFront delivers the web UI which is hosted in an S3 bucket. + + 3. The web UI leverages a WebSocket integration built using API Gateway. The API Gateway is backed by a custom Lambda authorizer function, which returns the appropriate [AWS Identity and Access Management](https://aws.amazon.com/iam/)(IAM) policy based on the Amazon Cognito group the authenticating user belongs to. The policy is stored in DynamoDB. + + 4. Amazon Cognito authenticates users and backs both the CloudFront web UI and API Gateway. + + 5. Incoming requests from the business user are passed from API Gateway to an [Amazon SQS queue](https://aws.amazon.com/sqs/) and then to the AWS Lambda function. The queue enables the asynchronous operation of the API Gateway to Lambda integration. The queue passes connection information to the Lambda function which will then post results directly back to the API Gateway websocket connection to support long running inference calls. + + 6. The AWS Lambda function retrieves the agent configuration from DynamoDB. + + 7. Using the user input and any relevant use case configurations, the AWS Lambda function builds and sends a request payload to the agent, running on [Amazon Bedrock AgentCore Runtime](https://aws.amazon.com/bedrock/agentcore/). + + 8. The agent connects to associated MCP servers and registers the tools to the strands agent instance. The agent then autonomously selects and performs actions based on tool descriptions and task requirements. + + 9. When the response comes back from the Amazon Bedrock AgentCore runtime, the Lambda function streams the response back through the API Gateway WebSocket to be consumed by the client application. + + + + +###### Note + + * Agent processing is limited to Lambda execution timeout (15 minutes). + + + + +### Workflow Builder use case + +**Depicts Workflow Builder architecture** + + + +The high-level process flow for the Workflow Builder components deployed with the AWS CloudFormation template is as follows: + + 1. Admin users deploy the workflow using the Deployment Dashboard, selecting Agent Builder agents to include as specialized agents. + + 2. CloudFront delivers the web UI which is hosted in an S3 bucket. + + 3. The web UI leverages a WebSocket integration built using API Gateway. The API Gateway is backed by a custom Lambda authorizer function, which returns the appropriate [AWS Identity and Access Management](https://aws.amazon.com/iam/) (IAM) policy based on the Amazon Cognito group the authenticating user belongs to. The policy is stored in DynamoDB. + + 4. Amazon Cognito authenticates users and backs both the CloudFront web UI and API Gateway. + + 5. Incoming requests from the business user are passed from API Gateway to an [Amazon SQS queue](https://aws.amazon.com/sqs/) and then to the AWS Lambda function. The queue enables the asynchronous operation of the API Gateway to Lambda integration. + + 6. The AWS Lambda function retrieves workflow configuration from DynamoDB, including the list of specialized Agent Builder agents. + + 7. Using the user input and workflow configuration, Lambda sends requests to the [Amazon Bedrock AgentCore Runtime](https://aws.amazon.com/bedrock/agentcore/) hosting the supervisor agent. + + 8. The supervisor agent creates local instances of all specialized Agent Builder agents within the AgentCore Runtime environment. These specialized agents are registered as tools using the Agents as Tools pattern. The supervisor then autonomously selects and delegates work to specialized agents based on agent descriptions and task requirements. + + 9. The supervisor agent aggregates results from specialized agents and formulates the final response, returning it to the Lambda to be streamed back to the client application through the API Gateway Websocket. + + + + +###### Note + + * Workflow processing is limited to Lambda execution timeout (15 minutes). + + + +