AWS bedrock-agentcore medium security documentation change
Summary
Made 'time_of_last_update' optional in ping response and added resource exhaustion warning
Security assessment
The added warning describes how improper timestamp implementation could circumvent idle session timeouts, potentially causing session quota exhaustion. This documents a security control against resource depletion attacks by clarifying proper timestamp usage.
Diff
diff --git a/bedrock-agentcore/latest/devguide/runtime-http-protocol-contract.md b/bedrock-agentcore/latest/devguide/runtime-http-protocol-contract.md index 51a07dcbc..df1fe8525 100644 --- a//bedrock-agentcore/latest/devguide/runtime-http-protocol-contract.md +++ b//bedrock-agentcore/latest/devguide/runtime-http-protocol-contract.md @@ -340,2 +340 @@ If your agent needs to process background tasks, you can indicate it with the `/ - "status": "<status_value>", - "time_of_last_update": <unix_timestamp> + "status": "<status_value>" @@ -344 +343 @@ If your agent needs to process background tasks, you can indicate it with the `/ -**status** +**status** (required) @@ -349 +348 @@ If your agent needs to process background tasks, you can indicate it with the `/ -`HealthyBusy` \- System is operational but currently busy with async tasks +`HealthyBusy` \- System is operational but currently busy with async tasks. While the status is `HealthyBusy`, the runtime session is considered active and is kept alive. @@ -351 +350 @@ If your agent needs to process background tasks, you can indicate it with the `/ -**time_of_last_update** +**time_of_last_update** (optional) @@ -354 +353,5 @@ If your agent needs to process background tasks, you can indicate it with the `/ -Used to determine how long the system has been in its current state +Unix timestamp (in seconds) of when the `status` last changed. Set it only on an actual status change. + +###### Warning + +Do not set `time_of_last_update` to the current time on every ping. A timestamp that advances on every ping signals a continuous status change, which prevents the idle session timeout from ever firing — sessions then persist until `MaxLifetime` and can exhaust your session quota. If you omit the field, the platform tracks status changes on its own. If you use the Bedrock AgentCore SDK, the ping response is handled for you.