AWS bedrock-agentcore documentation change
Summary
Updated instructions for OpenTelemetry instrumentation: Added AWS Lambda Layer guidance, environment variables for Lambda, removed notebook reference, clarified instrumentation scope, and added ADOT Collector limitation.
Security assessment
Changes focus on observability implementation details (telemetry collection and instrumentation methods) without addressing vulnerabilities, security controls, or security incidents. Added environment variables configure telemetry export formats but don't relate to access control, encryption, or security policies.
Diff
diff --git a/bedrock-agentcore/latest/devguide/observability-get-started.md b/bedrock-agentcore/latest/devguide/observability-get-started.md index e59ec13d1..e99a0ed4a 100644 --- a//bedrock-agentcore/latest/devguide/observability-get-started.md +++ b//bedrock-agentcore/latest/devguide/observability-get-started.md @@ -40 +40 @@ Before starting, make sure you have: - * **(Non-runtime agents only) Add the OpenTelemetry library** – Include `aws-opentelemetry-distro` (ADOT) in your requirements.txt file. If you deploy using the AgentCore CLI, the runtime automatically instruments your agent and this step is not required. + * **(Non-runtime agents only) Add the OpenTelemetry library** – Include `aws-opentelemetry-distro` (ADOT) in your requirements.txt file. If you host your agent on AWS Lambda, use the [AWS Lambda Layer for OpenTelemetry](https://aws-otel.github.io/docs/getting-started/lambda) on the AWS Distro for OpenTelemetry website instead. @@ -194 +194 @@ For agents running outside of the Amazon Bedrock AgentCore runtime, you can deli -For a complete example, refer to this [notebook](https://github.com/awslabs/amazon-bedrock-agentcore-samples/blob/main/01-tutorials/06-AgentCore-observability/02-Agent-not-hosted-on-runtime/Strands/Strands_Observability.ipynb) +For a complete example, see the [Agents on Amazon EKS sample](https://github.com/awslabs/agentcore-samples/tree/main/03-integrations/agents-hosted-outside-runtime/agents-on-eks) on the GitHub website. @@ -218,0 +219,3 @@ Create a log group and log stream for your agent in Amazon CloudWatch which you + export OTEL_AWS_APPLICATION_SIGNALS_ENABLED=false # AWS Lambda Layer for OpenTelemetry only: disables Application Signals + export OTEL_LOGS_EXPORTER=otlp # AWS Lambda Layer for OpenTelemetry only: exports logs over OTLP + export OTEL_METRICS_EXPORTER=awsemf # AWS Lambda Layer for OpenTelemetry only: exports metrics as CloudWatch EMF @@ -260 +263 @@ Replace `<YOUR-AGENT-NAME>` with a unique name to identify this agent in the Gen -With aws-opentelemetry-distro in your requirements.txt, the `opentelemetry-instrument` command will: +With `aws-opentelemetry-distro` in your requirements.txt, the `opentelemetry-instrument` command will: @@ -264 +267 @@ With aws-opentelemetry-distro in your requirements.txt, the `opentelemetry-instr - * Automatically instrument Strands, Amazon Bedrock calls, agent tool and databases, and other requests made by agent + * Automatically instrument Strands, Amazon Bedrock calls, agent tools and databases, and other requests made by the agent @@ -272,0 +276,2 @@ With aws-opentelemetry-distro in your requirements.txt, the `opentelemetry-instr +Use the following command to run your agent with automatic instrumentation: + @@ -275,0 +281,6 @@ With aws-opentelemetry-distro in your requirements.txt, the `opentelemetry-instr +If you host your agent on AWS Lambda, use the [AWS Lambda Layer for OpenTelemetry](https://aws-otel.github.io/docs/getting-started/lambda) on the AWS Distro for OpenTelemetry website. Add the layer to your function, and then set the `AWS_LAMBDA_EXEC_WRAPPER` environment variable to `/opt/otel-instrument`. The layer then auto-instruments your function. With this approach, you don’t need to add the `aws-opentelemetry-distro` package or run the `opentelemetry-instrument` command described earlier. + +###### ADOT Collector not supported for agent observability + +The ADOT Collector is not supported for agent observability. To send telemetry from an agent hosted outside of AgentCore runtime, you must use either the ADOT SDK or the AWS Lambda Layer for OpenTelemetry. + @@ -284,5 +294,0 @@ To correlate traces across multiple agent runs, you can associate a session ID w -Run the session-enabled version following command, complete implementation provided in the [notebook](https://github.com/awslabs/amazon-bedrock-agentcore-samples/blob/main/01-tutorials/06-AgentCore-observability/02-Agent-not-hosted-on-runtime/Strands/Strands_Observability.ipynb) : - - - opentelemetry-instrument python strands_travel_agent_with_session.py --session-id "user-session-123" -