AWS Security ChangesHomeSearch

AWS bedrock-agentcore documentation change

Service: bedrock-agentcore · 2026-04-01 · Documentation low

File: bedrock-agentcore/latest/devguide/gateway-quick-start.md

Summary

Updated quick start guide to use AgentCore CLI instead of Python starter toolkit, changed installation from Python virtual environment to Node.js/npm, simplified gateway creation process with CLI commands and TUI wizard, removed Python SDK code examples, and changed default authentication from OAuth/Cognito to NONE for simplicity

Security assessment

This is a documentation update changing the recommended tooling from Python SDK to CLI. The change removes OAuth/Cognito authentication as the default (now uses NONE authorizer for simplicity) but still documents JWT authentication as an option. No evidence of addressing a specific security vulnerability or incident. The change simplifies the quick start but potentially reduces security by defaulting to no authentication.

Diff

diff --git a/bedrock-agentcore/latest/devguide/gateway-quick-start.md b/bedrock-agentcore/latest/devguide/gateway-quick-start.md
index 947b43502..424ed5e3c 100644
--- a//bedrock-agentcore/latest/devguide/gateway-quick-start.md
+++ b//bedrock-agentcore/latest/devguide/gateway-quick-start.md
@@ -5 +5 @@
-PrerequisitesStep 1: Setup and installStep 2: Create gateway setup scriptStep 3: Run the setupStep 4: Use the gateway with an agentWhat you've builtTroubleshootingQuick validationCleanupNext steps
+PrerequisitesStep 1: Setup and installStep 2: Create gatewayStep 3: Run the setupStep 4: Use the gateway with an agentWhat you've builtTroubleshootingQuick validationCleanupNext steps
@@ -9 +9 @@ PrerequisitesStep 1: Setup and installStep 2: Create gateway setup scriptStep 3:
-In this quick start guide you'll learn how to set up a gateway and integrate it into your agents using the AgentCore starter toolkit. For more comprehensive guides and examples, see the [Amazon Bedrock AgentCore Gateway GitHub repository](https://github.com/awslabs/amazon-bedrock-agentcore-samples/tree/main/01-tutorials/02-AgentCore-gateway).
+In this quick start guide you'll learn how to set up a gateway and integrate it into your agents using the AgentCore CLI. For more comprehensive guides and examples, see the [Amazon Bedrock AgentCore Gateway GitHub repository](https://github.com/awslabs/amazon-bedrock-agentcore-samples/tree/main/01-tutorials/02-AgentCore-gateway).
@@ -13 +13 @@ In this quick start guide you'll learn how to set up a gateway and integrate it
-The AgentCore starter toolkit abstracts the AWS Python SDK (Boto3) into simplified methods and is intended to help developers get started quickly. For a more comprehensive set of operations, you should use an AWS SDK such as Boto3. For more information on Boto3 operations for AgentCore, see [AgentCore Control Plane operations](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/bedrock-agentcore-control.html).
+The AgentCore CLI provides both commands and an interactive TUI wizard for managing AgentCore Gateway resources. For the full AWS SDK API reference, see [AgentCore Control Plane operations](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/bedrock-agentcore-control.html).
@@ -21 +21 @@ The AgentCore starter toolkit abstracts the AWS Python SDK (Boto3) into simplifi
-  * Step 2: Create gateway setup script
+  * Step 2: Create gateway
@@ -46 +46,3 @@ Before starting, make sure you have the following:
-  * **Python 3.10+** installed.
+  * **Node.js 18+** installed (for the AgentCore CLI).
+
+  * **Python 3.10+** installed (for the agent script).
@@ -57 +59 @@ Before starting, make sure you have the following:
-Run the following in a terminal to set up the virtual environment in which to install the dependencies.
+Install the AgentCore CLI globally:
@@ -60,4 +62 @@ Run the following in a terminal to set up the virtual environment in which to in
-    mkdir agentcore-gateway-quickstart
-    cd agentcore-gateway-quickstart
-    python3 -m venv .venv
-    source .venv/bin/activate  # On Windows: .venv\Scripts\activate
+    npm install -g @aws/agentcore
@@ -65 +64 @@ Run the following in a terminal to set up the virtual environment in which to in
-Then, run the following to install the dependencies
+Create a new AgentCore project with an agent and a gateway:
@@ -66,0 +66 @@ Then, run the following to install the dependencies
+AgentCore CLI
@@ -68,3 +67,0 @@ Then, run the following to install the dependencies
-    pip install boto3
-    pip install bedrock-agentcore-starter-toolkit
-    pip install strands-agents
@@ -72 +68,0 @@ Then, run the following to install the dependencies
-## Step 2: Create gateway setup script
@@ -74 +70 @@ Then, run the following to install the dependencies
-You can create a gateway using either the AgentCore starter toolkit Python SDK or the AgentCore starter toolkit CLI. Choose your preferred approach:
+    agentcore create --name MyGatewayAgent --defaults
@@ -76 +72 @@ You can create a gateway using either the AgentCore starter toolkit Python SDK o
-###### Note
+The `--defaults` flag creates a project with a default Python Strands agent. Alternatively, omit `--defaults` and `--name` to use the interactive wizard to select your preferred framework.
@@ -78 +74 @@ You can create a gateway using either the AgentCore starter toolkit Python SDK o
-The AgentCore starter toolkit CLI is separate from the AWS CLI. For a complete CLI reference, see the [AgentCore starter toolkit CLI reference](https://aws.github.io/bedrock-agentcore-starter-toolkit/api-reference/cli.html).
+Interactive
@@ -80 +75,0 @@ The AgentCore starter toolkit CLI is separate from the AWS CLI. For a complete C
-Python SDK
@@ -81,0 +77 @@ Python SDK
+You can also run `agentcore create` without flags to use the interactive wizard. The wizard guides you through selecting a project name, agent framework, model provider, and other options.
@@ -83 +79 @@ Python SDK
-Create a new file called `setup_gateway.py` and insert the following complete code into it:
+## Step 2: Create gateway
@@ -84,0 +81 @@ Create a new file called `setup_gateway.py` and insert the following complete co
+Add a gateway and a target to your project using the AgentCore CLI:
@@ -86,4 +83 @@ Create a new file called `setup_gateway.py` and insert the following complete co
-    """
-    Setup script to create Gateway with Lambda target and save configuration
-    Run this first: python setup_gateway.py
-    """
+AgentCore CLI
@@ -91,60 +84,0 @@ Create a new file called `setup_gateway.py` and insert the following complete co
-    from bedrock_agentcore_starter_toolkit.operations.gateway.client import GatewayClient
-    import json
-    import logging
-    import time
-    
-    def setup_gateway():
-        # Configuration
-        region = "us-east-1"  # Change to your preferred region
-    
-        print("🚀 Setting up AgentCore Gateway...")
-        print(f"Region: {region}\n")
-    
-        # Initialize client
-        client = GatewayClient(region_name=region)
-        client.logger.setLevel(logging.INFO)
-    
-        # Step 2.1: Create OAuth authorizer
-        print("Step 2.1: Creating OAuth authorization server...")
-        cognito_response = client.create_oauth_authorizer_with_cognito("TestGateway")
-        print("✓ Authorization server created\n")
-    
-        # Step 2.2: Create Gateway
-        print("Step 2.2: Creating Gateway...")
-        gateway = client.create_mcp_gateway(
-            # the name of the Gateway - if you don't set one, one will be generated.
-            name=None,
-            # the role arn that the Gateway will use - if you don't set one, one will be created.
-            # NOTE: if you are using your own role make sure it has a trust policy that trusts bedrock-agentcore.amazonaws.com
-            role_arn=None,
-            # the OAuth authorization server details. If you are providing your own authorization server,
-            # then pass an input of the following form: {"customJWTAuthorizer": {"allowedClients": ["<INSERT CLIENT ID>"], "discoveryUrl": "<INSERT DISCOVERY URL>"}}
-            authorizer_config=cognito_response["authorizer_config"],
-            # enable semantic search
-            enable_semantic_search=True,
-        )
-        print(f"✓ Gateway created: {gateway['gatewayUrl']}\n")
-    
-        # If role_arn was not provided, fix IAM permissions
-        # NOTE: This is handled internally by the toolkit when no role is provided
-        client.fix_iam_permissions(gateway)
-        print("⏳ Waiting 30s for IAM propagation...")
-        time.sleep(30)
-        print("✓ IAM permissions configured\n")
-    
-        # Step 2.3: Add Lambda target
-        print("Step 2.3: Adding Lambda target...")
-        lambda_target = client.create_mcp_gateway_target(
-            # the gateway created in the previous step
-            gateway=gateway,
-            # the name of the Target - if you don't set one, one will be generated.
-            name=None,
-            # the type of the Target
-            target_type="lambda",
-            # the target details - set this to define your own lambda if you pre-created one.
-            # Otherwise leave this None and one will be created for you.
-            target_payload=None,
-            # you will see later in the tutorial how to use this to connect to APIs using API keys and OAuth credentials.
-            credentials=None,
-        )
-        print("✓ Lambda target added\n")
@@ -152,7 +85,0 @@ Create a new file called `setup_gateway.py` and insert the following complete co
-        # Step 2.4: Save configuration for agent
-        config = {
-            "gateway_url": gateway["gatewayUrl"],
-            "gateway_id": gateway["gatewayId"],
-            "region": region,
-            "client_info": cognito_response["client_info"]
-        }
@@ -160,2 +87,2 @@ Create a new file called `setup_gateway.py` and insert the following complete co
-        with open("gateway_config.json", "w") as f:
-            json.dump(config, f, indent=2)
+    # Add a gateway with no inbound auth (simplest for getting started)
+    agentcore add gateway --name TestGateway --authorizer-type NONE --runtimes MyGatewayAgent
@@ -163,7 +90,5 @@ Create a new file called `setup_gateway.py` and insert the following complete co
-        print("=" * 60)
-        print("✅ Gateway setup complete!")
-        print(f"Gateway URL: {gateway['gatewayUrl']}")
-        print(f"Gateway ID: {gateway['gatewayId']}")
-        print("\nConfiguration saved to: gateway_config.json")
-        print("\nNext step: Run 'python run_agent.py' to test your Gateway")
-        print("=" * 60)
+    # Add a Lambda function target
+    agentcore add gateway-target --name TestLambdaTarget --type lambda-function-arn \
+      --lambda-arn <YOUR_LAMBDA_ARN> \
+      --tool-schema-file tools.json \
+      --gateway TestGateway
@@ -171 +96 @@ Create a new file called `setup_gateway.py` and insert the following complete co
-        return config
+Interactive
@@ -173,2 +97,0 @@ Create a new file called `setup_gateway.py` and insert the following complete co
-    if __name__ == "__main__":
-        setup_gateway()
@@ -176 +99 @@ Create a new file called `setup_gateway.py` and insert the following complete co
-CLI
+Run `agentcore` to open the TUI, then select **add** and choose **Gateway** :
@@ -177,0 +101 @@ CLI
+  1. Enter the gateway name:
@@ -179 +103 @@ CLI
-Use the CLI commands to create your gateway directly:
+![Gateway wizard: enter name](/images/bedrock-agentcore/latest/devguide/images/tui/gateway-add-name.png)
@@ -180,0 +105 @@ Use the CLI commands to create your gateway directly:
+  2. Select the authorizer type. For this quickstart, choose **NONE** :
@@ -182,5 +107 @@ Use the CLI commands to create your gateway directly:
-    # Create a gateway with semantic search enabled
-    bedrock-agentcore gateway create-mcp-gateway \
-      --name TestGateway \
-      --region us-east-1 \
-      --enable_semantic_search
+![Gateway wizard: select NONE authorizer](/images/bedrock-agentcore/latest/devguide/images/tui/gateway-add-auth-none.png)
@@ -188 +109 @@ Use the CLI commands to create your gateway directly:
-Replace the placeholders with the actual values returned from the first command.
+  3. Configure advanced options or accept the defaults:
@@ -189,0 +111 @@ Replace the placeholders with the actual values returned from the first command.
+![Gateway wizard: advanced configuration](/images/bedrock-agentcore/latest/devguide/images/tui/gateway-add-advanced.png)
@@ -191,7 +113 @@ Replace the placeholders with the actual values returned from the first command.
-    # Create a Lambda target for the gateway
-    bedrock-agentcore gateway create-mcp-gateway-target \
-      --gateway-arn <GATEWAY_ARN_FROM_PREVIOUS_COMMAND> \
-      --gateway-url <GATEWAY_URL_FROM_PREVIOUS_COMMAND> \
-      --role-arn <ROLE_ARN_FROM_PREVIOUS_COMMAND> \
-      --name TestLambdaTarget \
-      --target-type lambda
+  4. Review the configuration and press **Enter** to confirm:
@@ -199 +115 @@ Replace the placeholders with the actual values returned from the first command.
-Expand the following section for a step-by-step understanding of each component.
+![Gateway wizard: review configuration](/images/bedrock-agentcore/latest/devguide/images/tui/gateway-add-confirm.png)
@@ -201 +116,0 @@ Expand the following section for a step-by-step understanding of each component.
-The following topics explain what happns in each part of the setup script:
@@ -203 +117,0 @@ The following topics explain what happns in each part of the setup script:
-###### Topics
@@ -205 +118,0 @@ The following topics explain what happns in each part of the setup script:
-  * Import required libraries
@@ -207 +120 @@ The following topics explain what happns in each part of the setup script:
-  * Create the Setup Function