* fix: resolve cfn-nag failures in CloudFormation templates - customer_support_lambda.yaml: add cfn_nag suppression metadata (F3, F38, W11) to GatewayAgentCoreRole; wildcard policy is intentional for this tutorial sample - bearer-token-injection/cognito.yaml: MfaConfiguration OFF -> OPTIONAL - strands-agents/cognito.yaml: MfaConfiguration OFF -> OPTIONAL - typescript_mastra/github-source.yaml: fix YAML indentation on ImageScanningConfiguration (was at col 0, causing parse error) - java_adk/github-source.yaml: same YAML indentation fix Fixes 6 cfn-nag failures (F3, F38 x1, F78 x2, FATAL x2) across 5 templates. * fix: correct agentcore-map.png image path in 01-features README * fix: resolve cdk-nag warnings across features and workshops * chore: add cfn-nag suppression metadata to 12 CloudFormation templates Adds cfn_nag rules_to_suppress Metadata blocks to suppress expected warnings in tutorial/demo templates: - W60 (VPC flow logs): 10 templates — demo VPCs don't require flow logs - W33 (MapPublicIpOnLaunch): 8 templates — public subnets need auto-IP for tutorial accessibility - W40/W5 (SG open egress/ingress): 8 templates — intentional open egress in AgentCore SGs and browser-firewall SGs (filtered by Network Firewall); broad rules in demo ALB/web server SGs - W2/W9 (SG SSH from 0.0.0.0/0): 2 templates — development EC2 instances use SSM but SSH open for tutorial convenience - W56 (ALB HTTP listener): cluster.yaml — demo uses HTTP; HTTPS requires ACM certificate - W59 (API Gateway no auth): infrastructure_all.yaml — AgentCore Gateway handles authentication upstream Files modified (12): 01-features/.../01-claude-code-with-s3-files/cfn-vpc.yaml 01-features/.../02-claude-code-with-efs/cfn-vpc.yaml 01-features/.../05-domain-filtering/agentcore-browser-firewall.yaml 03-integrations/.../common/01-network.yaml 03-integrations/.../ecs/cluster.yaml 06-workshops/.../01-claude-code-with-s3-files/cfn-vpc.yaml 06-workshops/.../02-claude-code-with-efs/cfn-vpc.yaml 06-workshops/.../07-bearer-token-injection/.../infrastructure_all.yaml 06-workshops/.../07-connecting-public-browser-.../cfn-browser.yaml 06-workshops/.../08-Interacting-with-vpc-.../cfn-vpc-browser.yaml 06-workshops/.../09-browser-with-domain-filtering/agentcore-browser-firewall.yaml 06-workshops/.../11-browser-with-proxy/agentcore-browser-proxy.yaml * fix: move suppression comments after Python syntax tokens Misplaced # pragma: allowlist secret comments were placed before trailing commas and closing braces, causing those tokens to be treated as comment text rather than Python syntax. Moved all commas and closing brace/comma sequences before the comment in 21 files, resolving all ruff invalid-syntax errors reported by CI. * fix: restore missing Python files in 04-entra-obo-mcp-runtime * style: apply ruff formatting to all PR-touched Python files * style: apply ruff formatting to pre-existing unformatted Python files 12 files with pre-existing formatting issues were surfaced by the CI ruff format check because they appear in this PR's changed-files list. Applied ruff format to bring them into compliance.
Java Google ADK Agent example for Amazon Bedrock AgentCore Runtime
This project implements the HTTP protocol contract for Amazon Bedrock AgentCore Runtime using Java Spring Boot. It provides a foundation for integrating Java Google's Agent Development Kit (ADK) with Amazon Bedrock AgentCore Runtime.
| Information | Details |
|---|---|
| Agent type | Synchronous |
| Agentic Framework | Java Google ADK |
| LLM model | Gemini 2.0 Flash |
| Components | AgentCore Runtime |
| Example complexity | Easy |
Overview
Amazon Bedrock AgentCore Runtime provides a secure, serverless hosting environment for deploying AI agents. This implementation creates REST API endpoints that comply with the AgentCore HTTP protocol contract.
Prerequisites
- Java 17 or higher, download
- Maven 3.6+, download
- AWS account: You need an active AWS account with appropriate permissions
- AWS CLI: Install and configure AWS CLI with your credentials
- Google AI API key (for the Gemini model), docs
Project Structure
java_adk/
├── src/
│ ├── main/
│ │ ├── java/com/agentswithek/GoogleADKAgentCore/
│ │ │ ├── controllers/
│ │ │ │ └── AgentCoreRuntimeController.java # REST endpoints
│ │ │ ├── entities/
│ │ │ │ ├── InvocationRequest.java # Request DTO
│ │ │ │ ├── InvocationResponse.java # Response DTO
│ │ │ │ └── PingResponse.java # Health check DTO
│ │ │ └── GoogleAdkAgentCoreApplication.java # Main application
│ │ └── resources/
│ │ └── application.properties # Configuration
│ └── test/
├── Dockerfile # ARM64 Docker build
├── pom.xml # Maven dependencies
└── README.md # This file
Local Development & Testing
git clone https://github.com/awslabs/amazon-bedrock-agentcore-samples.git
cd 03-integrations/agentic-frameworks/java_adk
Google API Key
Important
Make sure to replace
<ValidAPIKey>with valid API key from Google.
export GOOGLE_API_KEY="<ValidAPIKey>"
Build and Run
# Run with Maven
mvn spring-boot:run
The application will start on http://localhost:8080
Test the Endpoints
Test /invocations:
curl -X POST http://localhost:8080/invocations \
-H "Content-Type: application/json" \
-H "X-Amzn-Bedrock-AgentCore-Runtime-Session-Id: gfmeoagmreaklgmrkleafremoigrmtesogmtrskhmtkrlshmt" \
-d '{"prompt": "Hello, how are you?"}'
Test /ping:
curl http://localhost:8080/ping
Deploy to AgentCore Runtime Using AWS CloudFormation
Step 1: Deploy CloudFormation Stack
Important
Make sure to replace
<ValidAPIKey>with valid API key from Google.
# Deploy the CloudFormation stack
aws cloudformation create-stack \
--stack-name java-adk-agent \
--template-body file://cloudformation/github-source.yaml \
--capabilities CAPABILITY_IAM \
--parameters \
ParameterKey=AgentName,ParameterValue=adkjavaagent \
ParameterKey=GoogleApiKey,ParameterValue=<ValidAPIKey>
# Wait for stack creation to complete
aws cloudformation wait stack-create-complete \
--stack-name java-adk-agent
# Get stack outputs
aws cloudformation describe-stacks \
--stack-name java-adk-agent \
--query "Stacks[0].Outputs" \
--output table
Step 2: Testing
Once your agent is deployed, you can test it using the integration tests.
Step 1: Get Agent Runtime ARN from SSM Parameter Store
# Export the ARN directly (replace 'adkjavaagent' with your agent name)
export AGENT_RUNTIME_ARN=$(aws ssm get-parameter \
--name "/hostagent/agentcore/adkjavaagent/runtime-arn" \
--query "Parameter.Value" \
--output text )
# Verify it's set
echo $AGENT_RUNTIME_ARN
export AWS_REGION="us-west-2"
Step 2: Run Integration Tests
# Run all tests
mvn test -Dtest=AgentRuntimeInvokerTest
Cleanup
To delete all resources created by the CloudFormation stack:
# Delete the CloudFormation stack
aws cloudformation delete-stack \
--stack-name java-adk-agent
# Wait for stack deletion to complete
aws cloudformation wait stack-delete-complete \
--stack-name java-adk-agent
# Verify deletion
aws cloudformation describe-stacks \
--stack-name java-adk-agent | grep -q "does not exist" && echo "Stack successfully deleted"