AWS bedrock-agentcore medium security documentation change
Summary
Added CloudTrail logging documentation detailing harness management and data events
Security assessment
Documents CloudTrail integration for auditing harness operations, enabling security monitoring of critical actions like CreateHarness/DeleteHarness and data plane invocations. This directly supports security best practices for activity logging.
Diff
diff --git a/bedrock-agentcore/latest/devguide/harness-operations.md b/bedrock-agentcore/latest/devguide/harness-operations.md index 186d339da..c1c3f3c32 100644 --- a//bedrock-agentcore/latest/devguide/harness-operations.md +++ b//bedrock-agentcore/latest/devguide/harness-operations.md @@ -7 +7 @@ -ObservabilityControl cost with limitsTags +ObservabilityCloudTrailControl cost with limitsTags @@ -43,0 +44,17 @@ Learn more: [Observability overview](https://docs.aws.amazon.com/bedrock-agentco +## CloudTrail + +Harness operations are logged to AWS CloudTrail as management events (control plane) and data events (data plane). In CloudTrail, harness resources appear under the `AWS::BedrockAgentCore::Runtime` resource type rather than a harness-specific type. Harness is a managed abstraction over AgentCore Runtime, and CloudTrail events reflect the underlying runtime resource for consistency. + +All harness CloudTrail events use `resources.type` = `AWS::BedrockAgentCore::Runtime`. The event names are: + + * `CreateHarness`, `UpdateHarness`, `DeleteHarness`, `GetHarness`, `ListHarnesses` (management events) + + * `InvokeAgentRuntime`, `InvokeAgentRuntimeCommand` (data events) + + + + +###### Note + +Data plane operations appear as `InvokeAgentRuntime` and `InvokeAgentRuntimeCommand` in CloudTrail, matching the underlying Runtime API. The `resources.ARN` field contains the harness ARN for control plane events and the runtime ARN for data plane events. + @@ -61 +78 @@ Set hard caps so a runaway agent can’t burn through resources: -All limits are optional; omit them to use service defaults. +All limits are optional; omit them to use service defaults. Because harness is backed by AgentCore Runtime, harness invocations are also subject to Runtime service quotas. For more information, see [AgentCore harness Service Quotas](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.html#harness-service-limits) and [AgentCore Runtime Service Quotas](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.html#runtime-service-limits).