AWS bedrock-agentcore documentation change
Summary
Added resource limits section for AgentCore Identity with adjustable quotas, replaced workload identity limits with detailed API throttling limits, changed 'spans per evaluation job' to 'sessions per evaluation job', and increased configuration bundle limits
Security assessment
Changes focus on service quotas and operational limits without addressing vulnerabilities. The throttling limits help prevent abuse but are standard rate-limiting controls rather than fixes for specific security flaws. No evidence of vulnerability remediation.
Diff
diff --git a/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.md b/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.md index bd7137ba2..5889a2492 100644 --- a//bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.md +++ b//bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.md @@ -175,0 +176,15 @@ When working with AgentCore Identity, you need to be aware of the service limits +### Resource limits + +The following table describes the resource limits for AgentCore Identity. You can request increases for some quotas using the Service Quotas console. + +Limit | Default Value | Adjustable | Notes +---|---|---|--- +Workload identities | 11,000 | Yes | The maximum number of workload identities that you can create in this account in the current Region. +Resource OAuth2 credential providers | 50 | Yes | The maximum number of OAuth2 credential providers for egress resources that you can create in this account in the current Region. +Resource API key credential providers | 50 | Yes | The maximum number of API key credential providers for egress resources that you can create in this account in the current Region. +Resource Payment credential providers | 50 | Yes | The maximum number of payment credential providers for egress resources that you can create in this account in the current Region. + +### Throttling limits + +The following table describes the rate limits for AgentCore Identity APIs after which you will be throttled. You can request increases for some quotas using the Service Quotas console. + @@ -178,3 +193,29 @@ Limit | Value | Adjustable | Notes -Workload identities | 1,000 | No | The maximum number of workload identities that you can create in this account in the current Region. -Resource OAuth2 credential providers | 50 | No | The maximum number of OAuth2 credential providers for egress resources that you can create in this account in the current Region. -Resource API key credential providers | 50 | No | The maximum number of API key credential providers for egress resources that you can create in this account in the current Region. +CreateWorkloadIdentity API rate | 20 TPS | Yes | Transactions per second per account +GetWorkloadIdentity API rate | 20 TPS | Yes | Transactions per second per account +UpdateWorkloadIdentity API rate | 20 TPS | Yes | Transactions per second per account +DeleteWorkloadIdentity API rate | 20 TPS | Yes | Transactions per second per account +ListWorkloadIdentities API rate | 20 TPS | Yes | Transactions per second per account +GetWorkloadAccessToken API rate | 200 TPS | Yes | Transactions per second per account +GetWorkloadAccessTokenForJWT API rate | 200 TPS | Yes | Transactions per second per account +GetWorkloadAccessTokenForUserId API rate | 200 TPS | Yes | Transactions per second per account +CreateOauth2CredentialProvider API rate | 20 TPS | Yes | Transactions per second per account +GetOauth2CredentialProvider API rate | 20 TPS | Yes | Transactions per second per account +UpdateOauth2CredentialProvider API rate | 20 TPS | Yes | Transactions per second per account +DeleteOauth2CredentialProvider API rate | 20 TPS | Yes | Transactions per second per account +ListOauth2CredentialProviders API rate | 20 TPS | Yes | Transactions per second per account +CreateApiKeyCredentialProvider API rate | 20 TPS | Yes | Transactions per second per account +GetApiKeyCredentialProvider API rate | 20 TPS | Yes | Transactions per second per account +UpdateApiKeyCredentialProvider API rate | 20 TPS | Yes | Transactions per second per account +DeleteApiKeyCredentialProvider API rate | 20 TPS | Yes | Transactions per second per account +ListApiKeyCredentialProviders API rate | 20 TPS | Yes | Transactions per second per account +CreatePaymentCredentialProvider API rate | 20 TPS | Yes | Transactions per second per account +GetPaymentCredentialProvider API rate | 20 TPS | Yes | Transactions per second per account +UpdatePaymentCredentialProvider API rate | 20 TPS | Yes | Transactions per second per account +DeletePaymentCredentialProvider API rate | 20 TPS | Yes | Transactions per second per account +ListPaymentCredentialProviders API rate | 20 TPS | Yes | Transactions per second per account +GetResourceOauth2Token API rate | 200 TPS | Yes | Transactions per second per account +GetResourceApiKey API rate | 200 TPS | Yes | Transactions per second per account +GetResourcePaymentToken API rate | 200 TPS | Yes | Transactions per second per account +CompleteResourceTokenAuth API rate | 100 TPS | Yes | Transactions per second per account + +For more information about service quotas and how to request increases, see [Requesting a quota increase](https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.html) in the _Service Quotas User Guide_. @@ -399 +440 @@ Maximum batch evaluations per account | 2,000 | No | Total batch evaluations -Spans per evaluation job | 500 | No | Maximum number of spans per batch evaluation job +Sessions per evaluation job | 500 | No | Maximum number of sessions per batch evaluation job @@ -474,3 +515,2 @@ Limit | Value | Adjustable | Notes -Maximum configuration bundles per account | 100 | No | -Maximum bundle versions per account | 1,000 | No | -Branches per bundle | 20 | No | +Maximum configuration bundles per account | 1,000 | No | +Maximum bundle versions per account | 10,000 | No |