AWS solutions medium security documentation change
Summary
Added multimodal input configuration details including file handling constraints, S3 storage lifecycle, and security validation status tracking
Security assessment
The change introduces security validation checks for uploaded files (marked as 'invalid' status for security validation failures) and implements automatic deletion policies. This directly addresses potential security risks from file uploads by enforcing validation and data retention controls.
Diff
diff --git a/solutions/latest/generative-ai-application-builder-on-aws/step-3-deploy-a-use-case-using-deployment-dashboard-wizard.md b/solutions/latest/generative-ai-application-builder-on-aws/step-3-deploy-a-use-case-using-deployment-dashboard-wizard.md index d62c5aead..8486cca82 100644 --- a//solutions/latest/generative-ai-application-builder-on-aws/step-3-deploy-a-use-case-using-deployment-dashboard-wizard.md +++ b//solutions/latest/generative-ai-application-builder-on-aws/step-3-deploy-a-use-case-using-deployment-dashboard-wizard.md @@ -13 +13 @@ In the Deployment dashboard wizard, you must choose between the following: - * Agent use case \- Uses Amazon Bedrock Agents to complete tasks or automate repeated workflows + * Bedrock Agent use case \- Uses Amazon Bedrock Agents to complete tasks or automate repeated workflows @@ -14,0 +15 @@ In the Deployment dashboard wizard, you must choose between the following: + * Agent Builder \- Build and deploy custom agents on AgentCore with MCP integration and memory management @@ -15,0 +17 @@ In the Deployment dashboard wizard, you must choose between the following: + * Workflow Builder \- Orchestrate multiple Agent Builder agents using hierarchical delegation @@ -18 +20,3 @@ In the Deployment dashboard wizard, you must choose between the following: -**Shows two options: Create Text use case or Create Agent use case.** + + +**Shows five options: Create Text use case, Create Bedrock Agent use case, Create MCP Server Use Case, Create Agent Builder Use Case, or Create Workflow Use Case.** @@ -148,0 +153,57 @@ For more information, see [Configuring your prompts](./configuring-your-prompts. +#### Enable multimodal input + +This step allows you to enable multimodal input capabilities for your use case. When enabled, users can upload and send images and documents along with their text queries. + +**Supported file types and constraints:** + + * **Images:** Up to 20 images per message. Each image must be no more than 3.75 MB in size and 8,000 px in height and width. Supported formats: png, jpeg, gif, webp + + * **Documents:** Up to 5 documents per message. Each document must be no more than 4.5 MB in size. Supported formats: pdf, csv, doc, docx, xls, xlsx, html, txt, md + + + + +**How to use multimodal input:** + + 1. Enable the **MultimodalEnabled** parameter during use case deployment + + 2. In the chat interface, users can upload files in two ways: + + * Clicking the upload button in the chat input box, or + + * Dragging and dropping files directly into the chat interface + + 3. Files are uploaded to Amazon S3 and processed by the selected model + + 4. Uploaded files are automatically deleted after 48 hours + + + + +**File status tracking:** + +DevOps users can monitor file metadata in DynamoDB, which includes upload time and processing status. Files can have the following statuses: + + * **pending** \- File upload has been initiated but not yet completed. This is the initial status when a presigned URL is generated. + + * **uploaded** \- File has been successfully uploaded to S3 and is ready for processing by the model. + + * **deleted** \- File has been deleted by the user and should no longer be accessible for processing. + + * **invalid** \- File failed validation checks (for example, file type mismatch or security validation failure). + + + + +Files in **pending** status that are never uploaded will be automatically cleaned up when their TTL expires. Only files with **uploaded** status can be processed by the model. + +The S3 multimodal bucket and DynamoDB metadata table is available in the Deployment Dashboard outputs with the keys `MultimodalDataBucketName` and `MultimodalDataMetadataTable`, respectively. + +###### Note + +Not all models support multimodal input. Ensure your selected model supports image and document processing before enabling this feature. Refer to the [Supported foundation models in Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/models-supported.html) documentation to check which model support Image as an input modality. + +###### Important + +Files uploaded by users are stored in Amazon S3 with a 48-hour lifecycle policy. Metadata about uploaded files is stored in Amazon DynamoDB with a 24-hour TTL for conversation history. + @@ -153 +214 @@ After this step, review the settings you selected and choose **Deploy Use Case** -### Step 3b: Deploy an Agent use case +### Step 3b: Deploy a Bedrock Agent use case @@ -155 +216 @@ After this step, review the settings you selected and choose **Deploy Use Case** -The Agent use case provides a powerful and secure mechanism for invoking Amazon Bedrock Agents within your use cases. This feature allows developers to seamlessly integrate the capabilities of AI-powered autonomous agents that can orchestrate and execute multi-step tasks across various foundation models, data sources, software applications, and user conversations while maintaining robust security measures. +The Bedrock Agent use case provides a powerful and secure mechanism for invoking Amazon Bedrock Agents within your use cases. This feature allows developers to seamlessly integrate the capabilities of AI-powered autonomous agents that can orchestrate and execute multi-step tasks across various foundation models, data sources, software applications, and user conversations while maintaining robust security measures. @@ -181 +242 @@ Refer to the [Create and configure agent manually](https://docs.aws.amazon.com/b -After you successfully create an Amazon Bedrock agent, you can proceed to the Generative AI Application Builder on AWS Agent use case wizard flow. To do so, choose **Deploy a new use case** on the Deployment dashboard and select **Create Agent Use Case**. Follow the wizard and use the following steps to configure the use case. +After you successfully create an Amazon Bedrock agent, you can proceed to the Generative AI Application Builder on AWS Bedrock Agent use case wizard flow. To do so, choose **Deploy a new use case** on the Deployment dashboard and select **Create Bedrock Agent Use Case**. Follow the wizard and use the following steps to configure the use case. @@ -194,0 +256,310 @@ In this step, you must provide the **Agent ID** and **Alias ID** of the Amazon B +### Step 3c: Deploy an MCP Server use case + +The MCP (Model Context Protocol) Server use case enables you to deploy and manage MCP servers that can be integrated with AI models and agents. MCP servers provide a standardized way to expose tools, resources, and capabilities to AI applications. You can either create MCP servers from existing Lambda functions and APIs, or host custom MCP servers using container images. + +#### Prerequisites + +Before deploying an MCP Server use case, ensure that you have the following: + + 1. The AWS account where Generative AI Application Builder on AWS is deployed. + + 2. Appropriate IAM permissions to create and manage Amazon Bedrock AgentCore resources. + + 3. Depending on your chosen creation method: + + * **For Gateway method (Lambda/API)** : Lambda functions or API endpoints with their corresponding schema files (JSON format for Lambda, OpenAPI/Smithy for APIs) + + * **For Runtime method (ECR)** : A Docker container image pushed to Amazon ECR containing your MCP server implementation + + + + +#### MCP Server creation methods + +The solution supports two methods for creating MCP servers: + +**Create from Lambda or API (Gateway method)** + +This method creates an MCP gateway that wraps existing Lambda functions or REST APIs, making them accessible as MCP tools. The gateway handles protocol translation between MCP and your existing services. + + * **Lambda targets** : Integrate existing Lambda functions by providing the function ARN and a JSON schema file describing the function’s input/output format + + * **OpenAPI targets** : Integrate REST APIs using OpenAPI specifications (JSON or YAML format) with support for OAuth 2.0 or API Key authentication + + * **Smithy targets** : Integrate APIs defined using Smithy model files (.smithy or .json format) + + + + +You can configure multiple targets (up to 10) within a single MCP gateway, each representing a different tool or capability. + +**Hosting from ECR Image (Runtime method)** + +This method deploys a containerized MCP server from an Amazon ECR image. Use this approach when you have a custom MCP server implementation that needs to run as a standalone service. + + * Provide the ECR image URI (must include a tag, e.g., `:latest` or `:v1.0.0`) + + * Optionally configure environment variables to pass configuration to your container + + * The container must implement the MCP protocol and expose the required endpoints + + + + +#### Deploying an MCP Server + +To deploy an MCP Server use case, choose **Deploy a new use case** on the Deployment dashboard and select **Create MCP Server Use Case**. Follow the wizard and use the following steps to configure the use case. + +##### Select use case + +This step is the same as the Text use case described previously. + +##### Select network configuration + +Currently only public access is enabled and VPC is not supported for netwrok configuation. + +##### Create MCP Server + +In this step, you configure your MCP server deployment: + +**MCP server creation method** + +Choose between the two creation methods: + + * **Create from Lambda or API** : Create an MCP gateway from existing Lambda functions or API specifications + + * **Hosting from ECR Image** : Deploy a custom MCP server from a container image + + + + +###### Note + +The creation method cannot be changed after deployment. If you need to switch methods, you must deploy a new MCP Server use case. + +**Gateway Configuration (for Lambda/API method)** + +If you selected the Gateway method, configure one or more targets: + + 1. **Target name** (required): A friendly name to identify this target configuration + + 2. **Target description** (optional): A brief description of what this target does + + 3. **Target Type** : Select the type of target to configure: + + * **Lambda** : For AWS Lambda functions + + * **OpenAPI** : For REST APIs with OpenAPI specifications + + * **Smithy** : For APIs with Smithy model definitions + + 4. **Schema File** (required): Upload the schema file that describes your target: + + * For Lambda: JSON schema file describing input/output format. For details on creating Lambda tool schemas, see [Lambda tool schema](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-add-target-lambda.html#gateway-lambda-tool-schema) in the _Amazon Bedrock AgentCore Developer Guide_. + + * For OpenAPI: OpenAPI specification file (JSON or YAML). For details on OpenAPI schema requirements, see [OpenAPI schema](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-schema-openapi.html) in the _Amazon Bedrock AgentCore Developer Guide_. + + * For Smithy: Smithy model file (.smithy or .json). For details on building Smithy targets, see [Building Smithy targets](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-building-smithy-targets.html) in the _Amazon Bedrock AgentCore Developer Guide_. + + 5. **Lambda Function ARN** (required for Lambda targets): The ARN of the Lambda function to integrate + + 6. **Outbound Authentication** (required for OpenAPI targets): Configure authentication for REST API calls: + + * **Authentication Type** : Choose OAuth 2.0 or API Key + + * **Outbound Auth Provider ARN** : The ARN of the credential provider in Amazon Bedrock AgentCore token vault +