AWS bedrock-agentcore medium security documentation change
Summary
Updated ping response format and added session management warnings
Security assessment
The changes include explicit warnings about session quota exhaustion risks from improper 'time_of_last_update' implementation. By documenting how misconfiguration could bypass idle timeouts and exhaust resources, this addresses availability/DoS security concerns.
Diff
diff --git a/bedrock-agentcore/latest/devguide/runtime-long-run.md b/bedrock-agentcore/latest/devguide/runtime-long-run.md index aeee78f5b..19dfe17f3 100644 --- a//bedrock-agentcore/latest/devguide/runtime-long-run.md +++ b//bedrock-agentcore/latest/devguide/runtime-long-run.md @@ -35 +35 @@ Agent code communicates its processing status using the "/ping" endpoint health - {"status": "Healthy", "time_of_last_update": 1715000000} + {"status": "HealthyBusy"} @@ -37 +37 @@ Agent code communicates its processing status using the "/ping" endpoint health -The response contains two required fields: +The response contains a required field and an optional field: @@ -39 +39 @@ The response contains two required fields: - * `status` — either `"Healthy"` (idle, waiting for requests) or `"HealthyBusy"` (processing background tasks) + * `status` (required) — either `"Healthy"` (idle, waiting for requests) or `"HealthyBusy"` (processing background tasks). The platform uses this field to determine whether the session is still active. @@ -41 +41 @@ The response contains two required fields: - * `time_of_last_update` — Unix timestamp in seconds indicating when the status was last updated. The platform uses this field to determine whether the session is still active. Without it, the idle timeout fires even when the status is `HealthyBusy`. + * `time_of_last_update` (optional) — Unix timestamp in seconds of when the `status` last changed. Set it only on an actual status change, not on every ping. @@ -46 +46,5 @@ The response contains two required fields: -A session in idle state (`"Healthy"`) for 15 minutes gets automatically terminated. A session returning `"HealthyBusy"` with a recent `time_of_last_update` value remains alive beyond the idle timeout. +A session in idle state (`"Healthy"`) for 15 minutes gets automatically terminated. A session returning `"HealthyBusy"` remains alive beyond the idle timeout. + +###### Warning + +If you include `time_of_last_update`, do not set it to the current time on every ping. A timestamp that advances on every ping signals a continuous status change, which prevents the idle session timeout from ever firing — sessions then persist until `MaxLifetime` and can exhaust your session quota. Omit the field (the platform tracks status changes on its own) or update it only when the status actually changes. If you use the Bedrock AgentCore SDK, this is handled for you.