AWS Security ChangesHomeSearch

AWS bedrock-agentcore medium security documentation change

Service: bedrock-agentcore · 2026-05-22 · Security-related medium

File: bedrock-agentcore/latest/devguide/harness-operations.md

Summary

Added CloudTrail logging documentation detailing harness management and data events

Security assessment

Documents CloudTrail integration for auditing harness operations, enabling security monitoring of critical actions like CreateHarness/DeleteHarness and data plane invocations. This directly supports security best practices for activity logging.

Diff

diff --git a/bedrock-agentcore/latest/devguide/harness-operations.md b/bedrock-agentcore/latest/devguide/harness-operations.md
index 186d339da..c1c3f3c32 100644
--- a//bedrock-agentcore/latest/devguide/harness-operations.md
+++ b//bedrock-agentcore/latest/devguide/harness-operations.md
@@ -7 +7 @@
-ObservabilityControl cost with limitsTags
+ObservabilityCloudTrailControl cost with limitsTags
@@ -43,0 +44,17 @@ Learn more: [Observability overview](https://docs.aws.amazon.com/bedrock-agentco
+## CloudTrail
+
+Harness operations are logged to AWS CloudTrail as management events (control plane) and data events (data plane). In CloudTrail, harness resources appear under the `AWS::BedrockAgentCore::Runtime` resource type rather than a harness-specific type. Harness is a managed abstraction over AgentCore Runtime, and CloudTrail events reflect the underlying runtime resource for consistency.
+
+All harness CloudTrail events use `resources.type` = `AWS::BedrockAgentCore::Runtime`. The event names are:
+
+  * `CreateHarness`, `UpdateHarness`, `DeleteHarness`, `GetHarness`, `ListHarnesses` (management events)
+
+  * `InvokeAgentRuntime`, `InvokeAgentRuntimeCommand` (data events)
+
+
+
+
+###### Note
+
+Data plane operations appear as `InvokeAgentRuntime` and `InvokeAgentRuntimeCommand` in CloudTrail, matching the underlying Runtime API. The `resources.ARN` field contains the harness ARN for control plane events and the runtime ARN for data plane events.
+
@@ -61 +78 @@ Set hard caps so a runaway agent can’t burn through resources:
-All limits are optional; omit them to use service defaults.
+All limits are optional; omit them to use service defaults. Because harness is backed by AgentCore Runtime, harness invocations are also subject to Runtime service quotas. For more information, see [AgentCore harness Service Quotas](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.html#harness-service-limits) and [AgentCore Runtime Service Quotas](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.html#runtime-service-limits).