AWS bedrock-agentcore documentation change

Service: bedrock-agentcore · 2026-06-22 · Documentation medium

File: bedrock-agentcore/latest/devguide/harness-environment.md

Summary

Added CLI configuration examples for harness environments and filesystems, including VPC networking and storage mounts.

Security assessment

The change documents secure configuration practices for VPC isolation, security groups, and storage access controls. While it enhances security documentation, there's no evidence it addresses a specific vulnerability.

Diff

diff --git a/bedrock-agentcore/latest/devguide/harness-environment.md b/bedrock-agentcore/latest/devguide/harness-environment.md
index 1bb057508..fe7c18223 100644
--- a//bedrock-agentcore/latest/devguide/harness-environment.md
+++ b//bedrock-agentcore/latest/devguide/harness-environment.md
@@ -163,0 +164,38 @@ For prerequisites (VPC networking, IAM permissions, security groups), type compa
+### Configure the environment and filesystem in the AgentCore CLI
+
+###### Example
+
+Interactive
+    
+
+Run `agentcore` in a project directory to open the TUI, select **add** , then choose **Harness** . The wizard walks you through the execution environment and, in **Advanced settings** , the persistent filesystem.
+
+  1. On the **Custom environment** step, keep the default environment or choose a pre-built container image (ECR URI) or a Dockerfile.
+
+![Add Harness wizard: custom environment](/images/bedrock-agentcore/latest/devguide/images/tui/harness-env-01-custom-environment.png)
+
+  2. Filesystem mounts require VPC mode, so on **Advanced settings** enable both **Network** and **Filesystem Storage** with **Space** , then press **Enter** .
+
+![Advanced settings with Network and Filesystem Storage enabled](/images/bedrock-agentcore/latest/devguide/images/tui/harness-env-02-advanced.png)
+
+  3. Choose **VPC** network mode, then provide the subnets and security groups for the harness.
+
+![Select VPC network mode](/images/bedrock-agentcore/latest/devguide/images/tui/harness-env-03-network.png)
+
+  4. Set the session storage mount path (under `/mnt`).
+
+![Enter the session storage mount path](/images/bedrock-agentcore/latest/devguide/images/tui/harness-env-04-fs-type.png)
+
+  5. To attach an Amazon EFS file system, enter the EFS access point ARN (and its mount path on the next step).
+
+![Enter the EFS access point ARN](/images/bedrock-agentcore/latest/devguide/images/tui/harness-env-05-efs.png)
+
+  6. To attach Amazon S3 Files, enter the S3 Files access point ARN (and its mount path).
+
+![Enter the S3 Files access point ARN](/images/bedrock-agentcore/latest/devguide/images/tui/harness-env-06-s3.png)
+
+
+
+
+Confirm the wizard, then run `agentcore deploy` to apply.
+
@@ -183 +221 @@ AgentCore CLI
-    agentcore create --name myagent --session-storage /mnt/data/
+    agentcore create --name myagent --session-storage-mount-path /mnt/data/
@@ -221,0 +260,17 @@ AWS CLI/boto3
+AgentCore CLI
+    
+
+Attach an EFS access point with `--efs-access-point` as `<accessPointArn>:<mountPath>`. EFS requires VPC network mode:
+    
+    
+    agentcore add harness --name shared-tools-agent \
+      --network-mode VPC \
+      --subnets subnet-abc123,subnet-def456 \
+      --security-groups sg-abc123 \
+      --efs-access-point arn:aws:elasticfilesystem:us-west-2:123456789012:access-point/fsap-0123456789abcdef0:/mnt/efs
+    agentcore deploy
+
+###### Note
+
+The mount path must be under `/mnt`. The flag is repeatable (up to 2 EFS mounts); `--network-mode VPC` with `--subnets` and `--security-groups` is required for EFS and S3 Files mounts.
+
@@ -254,0 +310,17 @@ AWS CLI/boto3
+AgentCore CLI
+    
+
+Attach an S3 Files access point with `--s3-access-point` as `<accessPointArn>:<mountPath>`. S3 Files requires VPC network mode:
+    
+    
+    agentcore add harness --name data-agent \
+      --network-mode VPC \
+      --subnets subnet-abc123,subnet-def456 \
+      --security-groups sg-abc123 \
+      --s3-access-point arn:aws:s3files:us-west-2:123456789012:file-system/fs-0123456789abcdef0/access-point/fsap-0123456789abcdef0:/mnt/s3data
+    agentcore deploy
+
+###### Note
+
+The access point ARN itself contains colons; the mount path is taken from the segment after the final colon. The flag is repeatable (up to 2 S3 Files mounts).
+