AWS bedrock-agentcore high security documentation change
Summary
Added session lifecycle configuration and explicit session stopping procedures
Security assessment
The introduction of mandatory session timeouts and explicit cleanup procedures mitigates risks from orphaned sessions and potential credential misuse. The 15-minute default timeout reduction from previous implementations suggests an active security hardening measure.
Diff
diff --git a/bedrock-agentcore/latest/devguide/runtime-get-started-code-deploy.md b/bedrock-agentcore/latest/devguide/runtime-get-started-code-deploy.md index c7deaa244..56e6e4f8e 100644 --- a//bedrock-agentcore/latest/devguide/runtime-get-started-code-deploy.md +++ b//bedrock-agentcore/latest/devguide/runtime-get-started-code-deploy.md @@ -5 +5 @@ -PrerequisitesStep 1: Set up project and install dependenciesStep 2: Create your agent projectStep 3: Test locallyStep 4: Enable observability for your agentStep 5: Deploy to AgentCore Runtime and invokeStep 6: Update or cleanupDirect code deployment conceptsCommon Issues +PrerequisitesStep 1: Set up project and install dependenciesStep 2: Create your agent projectStep 3: Test locallyStep 4: Enable observability for your agentStep 5: Deploy to AgentCore Runtime and invokeStep 6: Stop session, update, or cleanupDirect code deployment conceptsCommon Issues @@ -29 +29 @@ Note that AgentCore Runtime uses POSIX file permissions, so you may need to [set - * Step 6: Update or cleanup + * Step 6: Stop session, update, or cleanup @@ -246 +246,5 @@ A ZIP archive containing Linux **arm64** dependencies needs to be uploaded to S3 - roleArn=f"arn:aws:iam::{account_id}:role/AmazonBedrockAgentCoreSDKRuntime-us-west-2" + roleArn=f"arn:aws:iam::{account_id}:role/AmazonBedrockAgentCoreSDKRuntime-us-west-2", + lifecycleConfiguration={ + 'idleRuntimeSessionTimeout': 300, # 5 min, configurable + 'maxLifetime': 1800 # 30 minutes, configurable + }, @@ -302 +306 @@ Your agent requires an execution role with appropriate permissions. For detailed -## Step 6: Update or cleanup +## Step 6: Stop session, update, or cleanup @@ -304 +308 @@ Your agent requires an execution role with appropriate permissions. For detailed -Update or cleanup your agent using one of the following methods: +Stop your runtime session, update, or cleanup your agent using one of the following methods: @@ -309 +313 @@ starter toolkit -To update previously deployed AgentCore Runtime execute: +To update previously deployed AgentCore Runtime, execute: @@ -314 +318,6 @@ To update previously deployed AgentCore Runtime execute: -To delete all resources related to a AgentCore Runtime execute: +To stop the running session before the configurable `IdleRuntimeSessionTimeout` (defaulted at 15 minutes) and save on any potential runaway costs, execute: + + + agentcore stop-session + +To delete all resources related to a AgentCore Runtime, execute: @@ -363,0 +373,12 @@ Following boto3 code will update an AgentCore Runtime. +To stop the running session before the configurable `IdleRuntimeSessionTimeout` (defaulted at 15 minutes) and save on any potential runaway costs, use the following boto3 code: + + + import boto3 + + agent_core_client = boto3.client('bedrock-agentcore', region_name='us-west-2') + response = agent_core_client.stop_runtime_session( + agentRuntimeArn='arn:aws:bedrock-agentcore:us-west-2:account-id:runtime/agent-name-suffix', + runtimeSessionId='your-session-id', + qualifier="DEFAULT" + ) +