AWS bedrock-agentcore documentation change
Summary
Added new 'AgentCore Policy Service Quotas' section with resource limits and throttling limits for Policy APIs
Security assessment
This adds documentation about service quotas and rate limits for policy-related APIs. While rate limiting can help prevent abuse, this appears to be routine documentation of service limits rather than addressing a specific security vulnerability. The change documents security-relevant throttling limits but doesn't indicate a security issue was fixed.
Diff
diff --git a/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.md b/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.md index fc0bb9b54..6d268612d 100644 --- a//bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.md +++ b//bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.md @@ -7 +7 @@ -AgentCore Runtime Service QuotasAgentCore Memory Service QuotasAgentCore Identity Service QuotasAgentCore Gateway Service QuotasAgentCore Browser Service QuotasAgentCore Code Interpreter Service QuotasAgentCore Evaluations Service QuotasAgentCore Resource Based PoliciesAWS Agent Registry Service Quotas +AgentCore Runtime Service QuotasAgentCore Memory Service QuotasAgentCore Identity Service QuotasAgentCore Gateway Service QuotasAgentCore Browser Service QuotasAgentCore Code Interpreter Service QuotasAgentCore Evaluations Service QuotasAgentCore Policy Service QuotasAgentCore Resource Based PoliciesAWS Agent Registry Service Quotas @@ -30,0 +31,2 @@ To request a quota increase, contact AWS support. + * AgentCore Policy Service Quotas + @@ -352,0 +355,36 @@ Active online evaluation configurations per account | 100 | No | Evaluators p +## AgentCore Policy Service Quotas + +When working with AgentCore Policy, you need to be aware of the service limits that apply to your account. These limits help ensure service stability and availability for all users. + +### Resource limits + +Quota | Default value | Adjustable | Notes +---|---|---|--- +Policy engines per account per Region | 1,000 | No | +Policies per policy engine | 1,000 | No | +Generated policies (7-day rolling window) per policy engine | 50,000 | No | +Maximum policy size | 10 KB | No | Per individual policy +Maximum total policy size per resource | 200 KB | No | Combined size of all policies per resource within a policy engine +Cedar schema size | 100 KB | No | Per policy engine schema + +### Throttling limits + +The following table describes the rate limits for AgentCore Policy APIs after which you will be throttled. + +Limit | Value | Adjustable | Notes +---|---|---|--- +CreatePolicyEngine API rate | 1 TPS | No | Transactions per second per account +GetPolicyEngine API rate | 5 TPS | No | Transactions per second per account +UpdatePolicyEngine API rate | 1 TPS | No | Transactions per second per account +ListPolicyEngines API rate | 5 TPS | No | Transactions per second per account +DeletePolicyEngine API rate | 1 TPS | No | Transactions per second per account +CreatePolicy API rate | 5 TPS | No | Transactions per second per account +GetPolicy API rate | 5 TPS | No | Transactions per second per account +UpdatePolicy API rate | 5 TPS | No | Transactions per second per account +ListPolicies API rate | 5 TPS | No | Transactions per second per account +DeletePolicy API rate | 5 TPS | No | Transactions per second per account +StartPolicyGeneration API rate | 1 TPS | No | Transactions per second per account +GetPolicyGeneration API rate | 5 TPS | No | Transactions per second per account +ListPolicyGenerations API rate | 5 TPS | No | Transactions per second per account +ListPolicyGenerationAssets API rate | 5 TPS | No | Transactions per second per account +