Skip to content

RFC 797: Bedrock AgentCore Tools 1P L2 construct#797

Merged
alvazjor merged 38 commits intoaws:mainfrom
dineshSajwan:main
Oct 21, 2025
Merged

RFC 797: Bedrock AgentCore Tools 1P L2 construct#797
alvazjor merged 38 commits intoaws:mainfrom
dineshSajwan:main

Conversation

@dineshSajwan
Copy link
Copy Markdown
Contributor

@dineshSajwan dineshSajwan commented Sep 12, 2025

This is a request for Amazon Bedrock AgentCore L2 construct that simplifies the deployment and management of AI agents at scale by wrapping the AgentCore L1 constructs. It provides a high-level, object-oriented approach to creating and managing Amazon Bedrock AgentCore resources. This enables developers to deploy highly effective agents securely using any framework and model. The package will provide constructs for the following primitives:

AgentCore tools

See # Issue 785 for
additional details.

APIs are signed off by @alvazjor


By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache-2.0 license

@dineshSajwan dineshSajwan changed the title Bedrock AgentCore L2 construct RFC: Bedrock AgentCore L2 construct Sep 12, 2025
import {
Runtime,
NetworkMode,
} from "@krokoko/agentcore-cdk-constructs/lib/cdk-lib/bedrock-agentcore/runtime/runtime";
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know where this is coming from, but lets remember to change them before we remove the draft mode on the RFC

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack - a493146


For more details please refer here [Amazon Bedrock AgentCore Documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/what-is-bedrock-agentcore.html).

## AgentCore Runtime
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

General comment:
We are missing here a table of properties and attributes this resource will need/return, but I think it can be added once the L1s are ready.
Additionally, there are some support and helper methods that will target runtime directly, but that don't provide a good explanation and use case example on why they are needed, and how can they be used. For example, the code snippets below explaining how to create the runtime are good, but they suddenly also add a endpoint to it, but we don't explain why or what use case will be solved by doing that. Adding additional sections explaining this helper methods, specially for people that are not fully knowledgable on AgentCore specifics, will give a better understanding of how we want this L2 to work and why

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack , Added some details for versioning and endpoint. - a493146

});
```

### Invoking the Runtime
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if we need to add this code snippets here, as they can add confusion since this is not really CDK related. If we want to keep them, lets please add a one paragraph explanation, clarifying that his is just an example how you will use the runtime later, once deployed.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack, removed this snippet to avoid any confusion.

console.log(new TextDecoder().decode(event));
}
```

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are no mentions of Runtime versioning. Is this something we don't plan to support initially?

Copy link
Copy Markdown
Contributor Author

@dineshSajwan dineshSajwan Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Runtime versioning is an implicit behaviour of runtime, added some notes for versioning. a493146

@dineshSajwan dineshSajwan marked this pull request as ready for review September 23, 2025 14:12
or production environments. For example, you might keep a "production" endpoint on a stable version while testing newer versions
through a "staging" endpoint. This separation allows you to test changes thoroughly before promoting them
to production by simply updating the endpoint to point to the newer version.
The "DEFAULT" endpoint automatically points to the latest version of your agent runtime.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a good explanation. Can we also add examples how this multi endpoint setup will look like in code?
I am trying to understand how this method will work. From what I can see, and correct me if I am wrong, addEndpoint will assign the endpoint to the latest runtime. But lets say I update that runtime at some point in the future, because I modified something in the configuration. How will the original endpoint be preserved and accessed through CDK? What I imagining that will happen is that since the runtime changed, then we will end up also creating a new endpoint (the "DEFAULT" one) that is targeting the new version of the runtime which is ok, but makes me wonder how can people access or modify the old endpoint.

Copy link
Copy Markdown
Contributor Author

@dineshSajwan dineshSajwan Sep 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When you create an endpoint with addEndpoint(), it captures the version at that moment. If you specify a version explicitly, it uses that; otherwise, it uses the runtime's current version. You can use version to point to old endpoint.
I will add some example to RFC.

const publicEndpoint = agentRuntime.addEndpoint('public_endpoint_auth', {
      description: 'Public endpoint for AgentCore runtime access',
      version:"2"
    });
export interface AddEndpointOptions {
  /**
   * Description for the endpoint
   * @default - No description
   */
  readonly description?: string;
  /**
   * Override the runtime version for this endpoint
   * @default - Uses the runtime's version
   */
  readonly version?: string;
}

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On a second thought, do you think we should add a function in l2 construct to list all the old versions of a runtime.
boto3 has this -

response = client.list_agent_runtime_versions(
    agentRuntimeId='string',
    maxResults=123,
    nextToken='string'
)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was confused by this, but now, an also with the table provided above, I get it better. Due to the nature of cdk, listing the version itself in the L2 construct wont work, since this call will be made probably during deployment and at that point you cannot control choosing which version to use, you already made that decision. But lets add this to the documentation both in the JSDoc and in the README file of the module itself, so we let our customers know how to look for existing versions so they can use a diff one than the latest if they need to. But after understanding this, I think this implementation is good enough as it is, we just need to expand the documentation around it

| `authorizerConfiguration` | `AuthorizerConfigurationRuntime` | No | Authorizer configuration for the agent runtime |
| `concurrencyConfiguration` | `ConcurrencyConfiguration` | No | Concurrency configuration for the agent runtime |
| `environmentVariables` | `{ [key: string]: string }` | No | Environment variables for the agent runtime |
| `clientToken` | `string` | No | A unique identifier to ensure idempotency of the request |
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I could be wrong, but I think this clientToken is needed for the initial custom resource implementation, and wont be needed for the L1s. That property is normally needed in direct API calls, but I dont see anything similar now that the L1s for this resource are available

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct, it has been removed from the current implementation which uses cfn resources, we will update the RFC with the changes

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, It is not in CFN anymore, will remove it. Same with concurrencyConfiguration, will remove that too.

### Runtime Versioning

Amazon Bedrock AgentCore automatically manages runtime versioning to ensure safe deployments and rollback capabilities.
When you create an agent runtime, AgentCore automatically creates version 1 (V1). Each subsequent update to the
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just out of curiosity, can you give a name to the version that is generated, or is it always autogenerated by the service ?

Copy link
Copy Markdown
Contributor Author

@dineshSajwan dineshSajwan Sep 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes runtime versions are automatically generated when you update the runtime's configuration.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like this explanation

Screenshot 2025-09-25 at 11 20 58 AM

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a very nice table. Does this DEFAULT endpoint exists when the moment you create the runtime? lets say I create the runtime in cdk without any specific endpoint, will this default one be created by the create runtime call? and can customers use it to invoke the runtime? In any case, this is good information and explain well the scenario, lets add it to the notes of the README in the alpha module PR if not there already, it will help customers to understand how they can manage their resources

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, the DEFAULT endpoint gets created with runtime and you can use it to invoke too.
Screenshot 2025-09-26 at 12 23 05 PM

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, makes sense, lets add notes on this, mostly in the readme notes of the alpha module, once the PR of this resource is implemented

memory.addMemoryStrategy(MemoryStrategy.BUILT_IN_SEMANTIC);
```

## Browser Tool
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lets add some paragraphs explaining what is this construct for, and some usecases explaining how it can be used, The examples below are great, so lets add a bit of explanation here, to help the user understand when they could use each of them

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done in the local repo and will update the rfc

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack.

- Supports GATEWAY_IAM_ROLE credential provider only
- Ideal for custom serverless function integration

## Code Interpreter
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as in the Browser tool section, lets add some paragraphs explaining what is this construct for, and some usecases explaining how it can be used, The examples below are great, so lets add a bit of explanation here, to help the user understand when they could use each of them. And lets bring up the Network Modes explanation before the code examples

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack

### Runtime Versioning

Amazon Bedrock AgentCore automatically manages runtime versioning to ensure safe deployments and rollback capabilities.
When you create an agent runtime, AgentCore automatically creates version 1 (V1). Each subsequent update to the
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a very nice table. Does this DEFAULT endpoint exists when the moment you create the runtime? lets say I create the runtime in cdk without any specific endpoint, will this default one be created by the create runtime call? and can customers use it to invoke the runtime? In any case, this is good information and explain well the scenario, lets add it to the notes of the README in the alpha module PR if not there already, it will help customers to understand how they can manage their resources

or production environments. For example, you might keep a "production" endpoint on a stable version while testing newer versions
through a "staging" endpoint. This separation allows you to test changes thoroughly before promoting them
to production by simply updating the endpoint to point to the newer version.
The "DEFAULT" endpoint automatically points to the latest version of your agent runtime.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was confused by this, but now, an also with the table provided above, I get it better. Due to the nature of cdk, listing the version itself in the L2 construct wont work, since this call will be made probably during deployment and at that point you cannot control choosing which version to use, you already made that decision. But lets add this to the documentation both in the JSDoc and in the README file of the module itself, so we let our customers know how to look for existing versions so they can use a diff one than the latest if they need to. But after understanding this, I think this implementation is good enough as it is, we just need to expand the documentation around it

@alvazjor alvazjor changed the title RFC: Bedrock AgentCore L2 construct RFC 797: Bedrock AgentCore L2 construct Sep 29, 2025
});

// Later, update to a new version
endpoint.updateRuntimeVersion("2");
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure this method adds value. What is the use case we are trying to solve with it? It seems weird to have a constructor for a resource with a param and then call a method to change that param. Considering that in CDK code everything happens at synth time, is this going to create just 1 resource (targeting v2) or is this going to create 2 endpoints, one per each version?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are right , forgot to remove this, it was there as per the initial plan, but we don't need it now.

@dineshSajwan dineshSajwan changed the title RFC 797: Bedrock AgentCore L2 construct RFC 797: Bedrock AgentCore Tools 1P L2 construct Oct 9, 2025
@dineshSajwan
Copy link
Copy Markdown
Contributor Author

Refactored the RFC. This RFC is now only for Agent Core Tools. We will raise separate RFC for runtime , memory , gateway and other agent core modules. This makes it easy for everyone to follow on RFC and Code changes for individual bedrock agent core modules.

@alvazjor alvazjor self-assigned this Oct 10, 2025
@alvazjor
Copy link
Copy Markdown
Contributor

After all the changes that were implemented, I am signing off this RFC. Will keep it open for the final comments period

@alvazjor alvazjor added status/api-approved API Bar Raiser signed-off the API of this RFC pr/do-not-merge Let mergify know not to auto merge labels Oct 10, 2025
@alvazjor alvazjor merged commit 4a6d084 into aws:main Oct 21, 2025
2 checks passed
@alvazjor alvazjor removed the pr/do-not-merge Let mergify know not to auto merge label Oct 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status/api-approved API Bar Raiser signed-off the API of this RFC

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants