AWS bedrock-agentcore high security documentation change

Service: bedrock-agentcore · 2026-03-04 · Security-related high

File: bedrock-agentcore/latest/devguide/getting-started-custom.md

Summary

Added session lifecycle configuration parameters and 'Stop runtime session' section with timeout controls

Security assessment

The addition of configurable idle timeouts (300s/5min) and maximum session lifetime (1800s/30min) directly addresses potential security risks from long-running sessions. Explicit documentation for stopping sessions helps prevent unauthorized prolonged access and resource exhaustion attacks.

Diff

diff --git a/bedrock-agentcore/latest/devguide/getting-started-custom.md b/bedrock-agentcore/latest/devguide/getting-started-custom.md
index ff03b4a8d..b832a0679 100644
--- a//bedrock-agentcore/latest/devguide/getting-started-custom.md
+++ b//bedrock-agentcore/latest/devguide/getting-started-custom.md
@@ -5 +5 @@
-Quick start setupAgent contract requirementsProject structureComplete strands agent exampleTest locallyCreate dockerfileBuild and deploy ARM64 imageDeploy agent runtimeInvoke your agentExpected response formatAmazon Bedrock AgentCore requirements summaryConclusion
+Quick start setupAgent contract requirementsProject structureComplete strands agent exampleTest locallyCreate dockerfileBuild and deploy ARM64 imageDeploy agent runtimeInvoke your agentExpected response formatStop runtime sessionAmazon Bedrock AgentCore requirements summaryConclusion
@@ -283 +283,5 @@ Create a file named `deploy_agent.py` with the following content:
-        roleArn='arn:aws:iam::account-id:role/AgentRuntimeRole'
+        roleArn='arn:aws:iam::account-id:role/AgentRuntimeRole',
+        lifecycleConfiguration={
+            'idleRuntimeSessionTimeout': 300,  # 5 min, configurable
+            'maxLifetime': 1800                # 30 minutes, configurable
+        },
@@ -352,0 +357,19 @@ When you invoke your agent, you'll receive a response like this:
+## Stop runtime session
+
+To stop the running session before the configurable `IdleRuntimeSessionTimeout` (defaulted at 15 minutes) and save on any potential runaway costs, execute: `stop_runtime_session`
+
+Create a file named `stop_runtime_session.py` with the following content:
+
+###### Example stop_runtime_session.py
+    
+    
+    import boto3
+    
+    agent_core_client = boto3.client('bedrock-agentcore', region_name='us-west-2')
+    response = agent_core_client.stop_runtime_session(
+        agentRuntimeArn='arn:aws:bedrock-agentcore:us-west-2:account-id:runtime/myStrandsAgent-suffix',
+        runtimeSessionId='dfmeoagmreaklgmrkleafremoigrmtesogmtrskhmtkrlshmt',
+        qualifier="DEFAULT"
+    )
+                
+
@@ -387,0 +411,2 @@ In this guide, you've learned how to:
+  * Stop agent runtime session
+