AWS bedrock-agentcore documentation change
Summary
Updated quick start guide to use AgentCore CLI instead of Python starter toolkit, changed installation from Python virtual environment to Node.js/npm, simplified gateway creation process with CLI commands and TUI wizard, removed Python SDK code examples, and changed default authentication from OAuth/Cognito to NONE for simplicity
Security assessment
This is a documentation update changing the recommended tooling from Python SDK to CLI. The change removes OAuth/Cognito authentication as the default (now uses NONE authorizer for simplicity) but still documents JWT authentication as an option. No evidence of addressing a specific security vulnerability or incident. The change simplifies the quick start but potentially reduces security by defaulting to no authentication.
Diff
diff --git a/bedrock-agentcore/latest/devguide/gateway-quick-start.md b/bedrock-agentcore/latest/devguide/gateway-quick-start.md index 947b43502..424ed5e3c 100644 --- a//bedrock-agentcore/latest/devguide/gateway-quick-start.md +++ b//bedrock-agentcore/latest/devguide/gateway-quick-start.md @@ -5 +5 @@ -PrerequisitesStep 1: Setup and installStep 2: Create gateway setup scriptStep 3: Run the setupStep 4: Use the gateway with an agentWhat you've builtTroubleshootingQuick validationCleanupNext steps +PrerequisitesStep 1: Setup and installStep 2: Create gatewayStep 3: Run the setupStep 4: Use the gateway with an agentWhat you've builtTroubleshootingQuick validationCleanupNext steps @@ -9 +9 @@ PrerequisitesStep 1: Setup and installStep 2: Create gateway setup scriptStep 3: -In this quick start guide you'll learn how to set up a gateway and integrate it into your agents using the AgentCore starter toolkit. For more comprehensive guides and examples, see the [Amazon Bedrock AgentCore Gateway GitHub repository](https://github.com/awslabs/amazon-bedrock-agentcore-samples/tree/main/01-tutorials/02-AgentCore-gateway). +In this quick start guide you'll learn how to set up a gateway and integrate it into your agents using the AgentCore CLI. For more comprehensive guides and examples, see the [Amazon Bedrock AgentCore Gateway GitHub repository](https://github.com/awslabs/amazon-bedrock-agentcore-samples/tree/main/01-tutorials/02-AgentCore-gateway). @@ -13 +13 @@ In this quick start guide you'll learn how to set up a gateway and integrate it -The AgentCore starter toolkit abstracts the AWS Python SDK (Boto3) into simplified methods and is intended to help developers get started quickly. For a more comprehensive set of operations, you should use an AWS SDK such as Boto3. For more information on Boto3 operations for AgentCore, see [AgentCore Control Plane operations](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/bedrock-agentcore-control.html). +The AgentCore CLI provides both commands and an interactive TUI wizard for managing AgentCore Gateway resources. For the full AWS SDK API reference, see [AgentCore Control Plane operations](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/bedrock-agentcore-control.html). @@ -21 +21 @@ The AgentCore starter toolkit abstracts the AWS Python SDK (Boto3) into simplifi - * Step 2: Create gateway setup script + * Step 2: Create gateway @@ -46 +46,3 @@ Before starting, make sure you have the following: - * **Python 3.10+** installed. + * **Node.js 18+** installed (for the AgentCore CLI). + + * **Python 3.10+** installed (for the agent script). @@ -57 +59 @@ Before starting, make sure you have the following: -Run the following in a terminal to set up the virtual environment in which to install the dependencies. +Install the AgentCore CLI globally: @@ -60,4 +62 @@ Run the following in a terminal to set up the virtual environment in which to in - mkdir agentcore-gateway-quickstart - cd agentcore-gateway-quickstart - python3 -m venv .venv - source .venv/bin/activate # On Windows: .venv\Scripts\activate + npm install -g @aws/agentcore @@ -65 +64 @@ Run the following in a terminal to set up the virtual environment in which to in -Then, run the following to install the dependencies +Create a new AgentCore project with an agent and a gateway: @@ -66,0 +66 @@ Then, run the following to install the dependencies +AgentCore CLI @@ -68,3 +67,0 @@ Then, run the following to install the dependencies - pip install boto3 - pip install bedrock-agentcore-starter-toolkit - pip install strands-agents @@ -72 +68,0 @@ Then, run the following to install the dependencies -## Step 2: Create gateway setup script @@ -74 +70 @@ Then, run the following to install the dependencies -You can create a gateway using either the AgentCore starter toolkit Python SDK or the AgentCore starter toolkit CLI. Choose your preferred approach: + agentcore create --name MyGatewayAgent --defaults @@ -76 +72 @@ You can create a gateway using either the AgentCore starter toolkit Python SDK o -###### Note +The `--defaults` flag creates a project with a default Python Strands agent. Alternatively, omit `--defaults` and `--name` to use the interactive wizard to select your preferred framework. @@ -78 +74 @@ You can create a gateway using either the AgentCore starter toolkit Python SDK o -The AgentCore starter toolkit CLI is separate from the AWS CLI. For a complete CLI reference, see the [AgentCore starter toolkit CLI reference](https://aws.github.io/bedrock-agentcore-starter-toolkit/api-reference/cli.html). +Interactive @@ -80 +75,0 @@ The AgentCore starter toolkit CLI is separate from the AWS CLI. For a complete C -Python SDK @@ -81,0 +77 @@ Python SDK +You can also run `agentcore create` without flags to use the interactive wizard. The wizard guides you through selecting a project name, agent framework, model provider, and other options. @@ -83 +79 @@ Python SDK -Create a new file called `setup_gateway.py` and insert the following complete code into it: +## Step 2: Create gateway @@ -84,0 +81 @@ Create a new file called `setup_gateway.py` and insert the following complete co +Add a gateway and a target to your project using the AgentCore CLI: @@ -86,4 +83 @@ Create a new file called `setup_gateway.py` and insert the following complete co - """ - Setup script to create Gateway with Lambda target and save configuration - Run this first: python setup_gateway.py - """ +AgentCore CLI @@ -91,60 +84,0 @@ Create a new file called `setup_gateway.py` and insert the following complete co - from bedrock_agentcore_starter_toolkit.operations.gateway.client import GatewayClient - import json - import logging - import time - - def setup_gateway(): - # Configuration - region = "us-east-1" # Change to your preferred region - - print("🚀 Setting up AgentCore Gateway...") - print(f"Region: {region}\n") - - # Initialize client - client = GatewayClient(region_name=region) - client.logger.setLevel(logging.INFO) - - # Step 2.1: Create OAuth authorizer - print("Step 2.1: Creating OAuth authorization server...") - cognito_response = client.create_oauth_authorizer_with_cognito("TestGateway") - print("✓ Authorization server created\n") - - # Step 2.2: Create Gateway - print("Step 2.2: Creating Gateway...") - gateway = client.create_mcp_gateway( - # the name of the Gateway - if you don't set one, one will be generated. - name=None, - # the role arn that the Gateway will use - if you don't set one, one will be created. - # NOTE: if you are using your own role make sure it has a trust policy that trusts bedrock-agentcore.amazonaws.com - role_arn=None, - # the OAuth authorization server details. If you are providing your own authorization server, - # then pass an input of the following form: {"customJWTAuthorizer": {"allowedClients": ["<INSERT CLIENT ID>"], "discoveryUrl": "<INSERT DISCOVERY URL>"}} - authorizer_config=cognito_response["authorizer_config"], - # enable semantic search - enable_semantic_search=True, - ) - print(f"✓ Gateway created: {gateway['gatewayUrl']}\n") - - # If role_arn was not provided, fix IAM permissions - # NOTE: This is handled internally by the toolkit when no role is provided - client.fix_iam_permissions(gateway) - print("⏳ Waiting 30s for IAM propagation...") - time.sleep(30) - print("✓ IAM permissions configured\n") - - # Step 2.3: Add Lambda target - print("Step 2.3: Adding Lambda target...") - lambda_target = client.create_mcp_gateway_target( - # the gateway created in the previous step - gateway=gateway, - # the name of the Target - if you don't set one, one will be generated. - name=None, - # the type of the Target - target_type="lambda", - # the target details - set this to define your own lambda if you pre-created one. - # Otherwise leave this None and one will be created for you. - target_payload=None, - # you will see later in the tutorial how to use this to connect to APIs using API keys and OAuth credentials. - credentials=None, - ) - print("✓ Lambda target added\n") @@ -152,7 +85,0 @@ Create a new file called `setup_gateway.py` and insert the following complete co - # Step 2.4: Save configuration for agent - config = { - "gateway_url": gateway["gatewayUrl"], - "gateway_id": gateway["gatewayId"], - "region": region, - "client_info": cognito_response["client_info"] - } @@ -160,2 +87,2 @@ Create a new file called `setup_gateway.py` and insert the following complete co - with open("gateway_config.json", "w") as f: - json.dump(config, f, indent=2) + # Add a gateway with no inbound auth (simplest for getting started) + agentcore add gateway --name TestGateway --authorizer-type NONE --runtimes MyGatewayAgent @@ -163,7 +90,5 @@ Create a new file called `setup_gateway.py` and insert the following complete co - print("=" * 60) - print("✅ Gateway setup complete!") - print(f"Gateway URL: {gateway['gatewayUrl']}") - print(f"Gateway ID: {gateway['gatewayId']}") - print("\nConfiguration saved to: gateway_config.json") - print("\nNext step: Run 'python run_agent.py' to test your Gateway") - print("=" * 60) + # Add a Lambda function target + agentcore add gateway-target --name TestLambdaTarget --type lambda-function-arn \ + --lambda-arn <YOUR_LAMBDA_ARN> \ + --tool-schema-file tools.json \ + --gateway TestGateway @@ -171 +96 @@ Create a new file called `setup_gateway.py` and insert the following complete co - return config +Interactive @@ -173,2 +97,0 @@ Create a new file called `setup_gateway.py` and insert the following complete co - if __name__ == "__main__": - setup_gateway() @@ -176 +99 @@ Create a new file called `setup_gateway.py` and insert the following complete co -CLI +Run `agentcore` to open the TUI, then select **add** and choose **Gateway** : @@ -177,0 +101 @@ CLI + 1. Enter the gateway name: @@ -179 +103 @@ CLI -Use the CLI commands to create your gateway directly: + @@ -180,0 +105 @@ Use the CLI commands to create your gateway directly: + 2. Select the authorizer type. For this quickstart, choose **NONE** : @@ -182,5 +107 @@ Use the CLI commands to create your gateway directly: - # Create a gateway with semantic search enabled - bedrock-agentcore gateway create-mcp-gateway \ - --name TestGateway \ - --region us-east-1 \ - --enable_semantic_search + @@ -188 +109 @@ Use the CLI commands to create your gateway directly: -Replace the placeholders with the actual values returned from the first command. + 3. Configure advanced options or accept the defaults: @@ -189,0 +111 @@ Replace the placeholders with the actual values returned from the first command. + @@ -191,7 +113 @@ Replace the placeholders with the actual values returned from the first command. - # Create a Lambda target for the gateway - bedrock-agentcore gateway create-mcp-gateway-target \ - --gateway-arn <GATEWAY_ARN_FROM_PREVIOUS_COMMAND> \ - --gateway-url <GATEWAY_URL_FROM_PREVIOUS_COMMAND> \ - --role-arn <ROLE_ARN_FROM_PREVIOUS_COMMAND> \ - --name TestLambdaTarget \ - --target-type lambda + 4. Review the configuration and press **Enter** to confirm: @@ -199 +115 @@ Replace the placeholders with the actual values returned from the first command. -Expand the following section for a step-by-step understanding of each component. + @@ -201 +116,0 @@ Expand the following section for a step-by-step understanding of each component. -The following topics explain what happns in each part of the setup script: @@ -203 +117,0 @@ The following topics explain what happns in each part of the setup script: -###### Topics @@ -205 +118,0 @@ The following topics explain what happns in each part of the setup script: - * Import required libraries @@ -207 +120 @@ The following topics explain what happns in each part of the setup script: - * Create the Setup Function