AWS bedrock-agentcore documentation change
Summary
Completely restructured the document to replace 'Agent Skills' section with detailed 'Filesystem' documentation. Added persistent storage options (session storage, EFS, S3 Files), removed skill management features, and reorganized content around environment configuration.
Security assessment
The changes focus on feature updates (persistent filesystems) and content reorganization without addressing security vulnerabilities. No security weaknesses or incidents are mentioned. Security notes about execution roles and VPCs are routine best practices.
Diff
diff --git a/bedrock-agentcore/latest/devguide/harness-environment.md b/bedrock-agentcore/latest/devguide/harness-environment.md index 2876a67dc..1bb057508 100644 --- a//bedrock-agentcore/latest/devguide/harness-environment.md +++ b//bedrock-agentcore/latest/devguide/harness-environment.md @@ -7 +7 @@ -Run commands on the environmentCustom environment (container images)Environment variablesAgent Skills +Run commands on the environmentCustom environment (container images)Environment variablesFilesystem @@ -9 +9,3 @@ Run commands on the environmentCustom environment (container images)Environment -# Environment and Skills +# Environment and filesystem + +Every harness session runs in an isolated microVM with its own filesystem and shell. This page covers configuring the execution environment (default or custom container), running commands directly on the VM, setting environment variables, and mounting persistent filesystems. @@ -30,18 +31,0 @@ Use it to: -AgentCore CLI - - - - # Install dependencies before the agent starts - agentcore invoke --exec --harness my-agent --session-id "$(uuidgen)" \ - "pip install pandas matplotlib" - - # After the agent finishes, inspect what it created - agentcore invoke --exec --harness my-agent --session-id "$(uuidgen)" \ - "ls -la /tmp && cat /tmp/results.csv" - -###### Note - -The base environment includes Python and bash. For tools like `git`, `node`, or other runtimes, install them at session start (e.g. `apt-get install -y git`) or use a custom environment. - -In the TUI, press `!` to enter exec mode and run commands inline. - @@ -68,0 +53,18 @@ AWS CLI/boto3 +AgentCore CLI + + + + # Install dependencies before the agent starts + agentcore invoke --exec --harness my-agent --session-id "$(uuidgen)" \ + "pip install pandas matplotlib" + + # After the agent finishes, inspect what it created + agentcore invoke --exec --harness my-agent --session-id "$(uuidgen)" \ + "ls -la /tmp && cat /tmp/results.csv" + +###### Note + +The base environment includes Python and bash. For tools like `git`, `node`, or other runtimes, install them at session start (e.g. `apt-get install -y git`) or use a custom environment. + +In the TUI, press `!` to enter exec mode and run commands inline. + @@ -84,0 +87,12 @@ The harness overrides your container’s `ENTRYPOINT` and `CMD` to keep it runni +AWS CLI/boto3 + + + + aws bedrock-agentcore-control create-harness \ + --harness-name "CodingAgent" \ + --execution-role-arn "arn:aws:iam::123456789012:role/MyHarnessRole" \ + --environment-artifact '{"containerConfiguration": {"containerUri": "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-dev-env:latest"}}' \ + --system-prompt '[{"text": "You are an expert TypeScript developer."}]' + +The execution role needs ECR pull permissions. See the [execution role policy](./harness-security.html#harness-execution-role-policy) for details. + @@ -103,2 +117 @@ Or reference a pre-built image: -AWS CLI/boto3 - +## Environment variables @@ -105,0 +119 @@ AWS CLI/boto3 +Set environment variables that are passed to the runtime container. Environment variables are available to the agent and any custom container running in the session. @@ -107,5 +121 @@ AWS CLI/boto3 - aws bedrock-agentcore-control create-harness \ - --harness-name "CodingAgent" \ - --execution-role-arn "arn:aws:iam::123456789012:role/MyHarnessRole" \ - --environment-artifact '{"optionalValue": {"containerConfiguration": {"containerUri": "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-dev-env:latest"}}}' \ - --system-prompt '[{"text": "You are an expert TypeScript developer."}]' +###### Example @@ -113 +123 @@ AWS CLI/boto3 -The execution role needs ECR pull permissions. See the [execution role policy](./harness-security.html#harness-execution-role-policy) for details. +AWS CLI/boto3 @@ -115 +124,0 @@ The execution role needs ECR pull permissions. See the [execution role policy](. -## Environment variables @@ -117 +125,0 @@ The execution role needs ECR pull permissions. See the [execution role policy](. -Set environment variables that are passed to the runtime container. Environment variables are available to the agent and any custom container running in the session. @@ -119 +127,4 @@ Set environment variables that are passed to the runtime container. Environment -###### Example + aws bedrock-agentcore-control create-harness \ + --harness-name "MyHarness" \ + --execution-role-arn "arn:aws:iam::123456789012:role/MyHarnessRole" \ + --environment-variables '{"MY_API_URL": "https://api.example.com", "LOG_LEVEL": "debug"}' @@ -136 +147 @@ Run `agentcore deploy` to apply. -AWS CLI/boto3 +## Filesystem @@ -137,0 +149 @@ AWS CLI/boto3 +The harness mounts persistent storage at paths you specify. Files written to these mounts survive session termination and are visible to later invocations. @@ -138,0 +151 @@ AWS CLI/boto3 +A harness supports three filesystem types: @@ -140,6 +153 @@ AWS CLI/boto3 - aws bedrock-agentcore-control create-harness \ - --harness-name "MyHarness" \ - --execution-role-arn "arn:aws:iam::123456789012:role/MyHarnessRole" \ - --environment-variables '{"MY_API_URL": "https://api.example.com", "LOG_LEVEL": "debug"}' - -## Agent Skills + * **Session storage** \- service-managed, per-session storage that persists across stop/resume cycles for the same `runtimeSessionId`. No VPC required. @@ -147 +155 @@ AWS CLI/boto3 -[Agent Skills](https://strandsagents.com/docs/user-guide/concepts/plugins/skills/) are bundles of markdown and scripts that give the agent domain knowledge on demand (e.g. how to work with Excel files, how to use a specific API). Each entry in the `skills` list is either a `path` to a skill already in the harness environment, or an `s3` or `git` source that the harness fetches for you at invocation time. You can set `skills` as a default on the harness, or override it per invocation. + * **Amazon EFS access point** \- bring-your-own EFS file system, shared across sessions and agents. VPC required. @@ -149 +157 @@ AWS CLI/boto3 -### Fetch a skill from S3 or Git + * **Amazon S3 Files access point** \- bring-your-own S3 Files file system that syncs bidirectionally with an S3 bucket. VPC required. @@ -151 +158,0 @@ AWS CLI/boto3 -Instead of placing a skill in the environment yourself, point the harness at a skill stored in Amazon S3 or a Git repository and the harness fetches it for you - no image rebuild and no session setup required. @@ -153 +159,0 @@ Instead of placing a skill in the environment yourself, point the harness at a s - * **Amazon S3** \- set `s3.uri` to the skill directory (for example, `s3://my-skills-bucket/skills/company-style/`). The harness downloads it with the execution role, which needs `s3:GetObject` and `s3:ListBucket` on the bucket (see [Security and access controls](./harness-security.html)). @@ -155 +160,0 @@ Instead of placing a skill in the environment yourself, point the harness at a s - * **Git over HTTPS** \- set `git.url` to the repository URL, and `git.path` to pull a single skill from a subdirectory. For a private repository, set `git.auth.credentialArn` to an [AgentCore Identity](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity.html) credential provider holding a personal access token (`git.auth.username` is optional, default `oauth2`). @@ -156,0 +162 @@ Instead of placing a skill in the environment yourself, point the harness at a s +For prerequisites (VPC networking, IAM permissions, security groups), type comparison, limits, and lifecycle behavior, see [File system configurations for AgentCore Runtime](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-filesystem-configurations.html). The same requirements apply to harnesses. @@ -157,0 +164 @@ Instead of placing a skill in the environment yourself, point the harness at a s +### Session storage @@ -158,0 +166 @@ Instead of placing a skill in the environment yourself, point the harness at a s +Files written to the mount path persist across stop/resume cycles when you invoke with the same `runtimeSessionId`. @@ -162,15 +170 @@ Instead of placing a skill in the environment yourself, point the harness at a s -boto3 - - -Attach a skill from S3 and a skill from a public Git repository for a single invocation: - - - response = client.invoke_harness( - harnessArn=HARNESS_ARN, - runtimeSessionId=SESSION_ID, - skills=[ - {"s3": {"uri": "s3://my-skills-bucket/skills/company-style/"}}, - {"git": {"url": "https://github.com/anthropics/skills", "path": "skills/docx"}}, - ], - messages=[{"role": "user", "content": [{"text": "Draft a one-paragraph summary of this report."}]}], - ) +AWS CLI/boto3 @@ -178 +171,0 @@ Attach a skill from S3 and a skill from a public Git repository for a single inv -To fetch a skill from a private Git repository, add `auth` with the ARN of a credential provider that holds a personal access token: @@ -181,11 +174,3 @@ To fetch a skill from a private Git repository, add `auth` with the ARN of a cre - skills=[ - { - "git": { - "url": "https://github.com/my-org/internal-skills", - "path": "excel", - "auth": { - "credentialArn": "arn:aws:bedrock-agentcore:us-west-2:123456789012:token-vault/default/apikeycredentialprovider/my-github-pat" - }, - } - } - ] + aws bedrock-agentcore-control update-harness \ + --harness-id "MyHarness-UuFdkQoXSL" \ + --environment '{"agentCoreRuntimeEnvironment": {"filesystemConfigurations": [{"sessionStorage": {"mountPath": "/mnt/data/"}}]}}' @@ -193 +178 @@ To fetch a skill from a private Git repository, add `auth` with the ARN of a cre -The harness fetches each skill on the first invocation of a session and re-fetches it when a new session starts, so the agent always gets the current version. Each source must contain a `SKILL.md`, an S3 skill must be 1 GB or smaller, and a Git fetch must complete within 60 seconds; otherwise the invocation fails with a descriptive error. +AgentCore CLI @@ -195 +179,0 @@ The harness fetches each skill on the first invocation of a session and re-fetch -S3 sources need no internet access; Git (HTTPS) sources require internet egress, the same as pulling a custom container image or reaching a remote MCP server. @@ -197 +180,0 @@ S3 sources need no internet access; Git (HTTPS) sources require internet egress, -### Getting skills into the environment @@ -199 +182,2 @@ S3 sources need no internet access; Git (HTTPS) sources require internet egress, -**Bake into the container image** \- include the skill directory in your custom image at a known path (e.g. `.agents/skills/xlsx`). Available to all invocations automatically. This is the recommended approach for production. + # At create time + agentcore create --name myagent --session-storage /mnt/data/ @@ -201 +185,3 @@ S3 sources need no internet access; Git (HTTPS) sources require internet egress, -**Install at session start** \- use `InvokeAgentRuntimeCommand` to install skills after the session begins, before invoking the agent: + # Or add to an existing harness + agentcore add harness --name my-agent --session-storage /mnt/data/ + agentcore deploy @@ -202,0 +189 @@ S3 sources need no internet access; Git (HTTPS) sources require internet egress, +### Amazon EFS access point @@ -204,4 +191 @@ S3 sources need no internet access; Git (HTTPS) sources require internet egress, - agentcore invoke --exec --harness my-agent --session-id "$(uuidgen)" \ - "npx @anthropic-ai/agent-skills add xlsx github" - -### Pointing the harness at installed skills +Attach an EFS access point ARN at a mount path under `/mnt`. Data persists in your account and can be shared with other harnesses or agent runtimes that mount the same access point. @@ -211 +195,2 @@ S3 sources need no internet access; Git (HTTPS) sources require internet egress, -AgentCore CLI +AWS CLI/boto3 + @@ -214 +199,22 @@ AgentCore CLI -Persist skills on the harness: + aws bedrock-agentcore-control create-harness \ + --harness-name "SharedToolsAgent" \ + --execution-role-arn "arn:aws:iam::123456789012:role/MyHarnessRole" \ + --environment '{ + "agentCoreRuntimeEnvironment": { + "networkConfiguration": { + "networkMode": "VPC", + "networkModeConfig": { + "subnets": ["subnet-abc123", "subnet-def456"], + "securityGroups": ["sg-abc123"] + } + }, + "filesystemConfigurations": [ + {