* restructure 02-use-cases into three agent-type categories
Reorganizes all 27 use case samples into category subfolders aligned
with the AgentCore GTM workload definitions:
- 01-conversational-agents/ (19 samples): user-facing agents with
streaming, user OAuth, and session/long-term memory
- 02-automation-agents/ (4 samples): event-driven agents with service
identity and stateless execution
- 03-coding-assistants/ (3 samples): developer tools with sandboxed
execution and project-scoped memory
Other changes:
- Moves okta-auth-three-tier-end-to-end-demo to
01-features/05-authenticate-and-authorize (identity pattern, not a
use case)
- Adds 02-use-cases/README.md with category index and sample table
- Adds category README for each subfolder, aligned with GTM definitions,
no em-dashes
- Adds use-case-assessment.md with per-sample scoring, recommendations,
and a starter toolkit migration list (18 of 27 samples need migrating)
- Fixes all cross-folder relative links broken by the restructure
(LICENSE, LOCAL_DEVELOPMENT.md, AGENTCORE_DEPLOYMENT.md)
* cull low-quality conversational agent samples and reorganise identity demos
Reviewed all 19 conversational agent samples against actual AgentCore
feature usage, blog post references, and code quality. Removed 9 samples
that did not meet the bar and moved 2 identity-pattern demos to the
correct location.
Dropped from 01-conversational-agents/:
- gateway-schema-support-agent: misclassified coding agent, 82-line README,
only 1 real feature, no blog post
- slide-deck-generator-memory-agent: narrow use case, no blog post,
deprecated starter toolkit, 5 features
- local-prototype-to-agentcore: claimed 9 features, only 3 in code,
tutorial format belongs in 01-tutorials/
- role-based-hr-data-agent: no blog post, deprecated starter toolkit,
Cedar pattern needs full rebuild to be useful
- A2A-realestate-agentcore-multiagents: claimed 10 features, only 3 in
code (Runtime, Cognito, A2A), no blog post
- cost-optimization-agent: only Runtime in code, notebook-driven, no
blog post
- DB-performance-analyzer: only Gateway + Cognito in code, no blog post
- farm-management-advisor: notebook-only, mixed deprecated/native SDK,
191-line README, no blog post
Moved to 01-features/05-authenticate-and-authorize/:
- auth0-multi-agent-obo: RFC 8693 OBO token exchange is an identity
pattern, not a use case; sits alongside okta and entra OBO samples
- okta-auth-three-tier-end-to-end-demo: (previous commit)
Other changes:
- Rename 02-automation-agents/ to 02-workflow-automation-agents/
- Update use-case-assessment.md with DROPPED/MOVED entries for all
removed samples
- Update all README counts and sample tables
- Add auth0-multi-agent-obo to identity README folder table and
auth pattern quick reference
* update use-case-assessment with decisions, actual features, and authors contacted
* untrack use-case-assessment.md (local only)
* fix CONTRIBUTING.md relative paths broken by use-cases restructure
Samples moved one level deeper (into category subfolders) so
../../CONTRIBUTING.md no longer resolves to the repo root.
Updated to ../../../CONTRIBUTING.md in three files:
- 01-conversational-agents/customer-support-assistant/README.md
- 02-workflow-automation-agents/event-driven-claims-agent/README.md
- 03-coding-assistants/claude-code-gateway-mcp-server/README.md
* fix: address checkov security findings in CloudFormation templates
AWS-operations-agent mcp-tool-template.yaml and mcp-tool-template-zip.yaml:
- Scope IAM wildcard resources to account/region-specific ARNs
(lambda:InvokeFunction, iam:PassRole, s3:*, logs:*)
- Split S3 permissions into bucket-level and object-level statements
- Scope bedrock:InvokeModel to foundation-model ARN pattern
- Add KMS keys for Lambda env var encryption (CKV_AWS_173) and CloudWatch
log group encryption (CKV_AWS_158)
- Add SQS dead letter queue and DeadLetterQueue config (CKV_AWS_116)
- Add ReservedConcurrentExecutions (CKV_AWS_115)
- Add checkov:skip for VPC (CKV_AWS_117) - demo function, VPC not required
customer-support-assistant cognito.yaml:
- Scope logs resource to account/region ARN prefix
- Scope cognito-idp:AdminAddUserToGroup to UserPool ARN
- Add SQS DLQ and DeadLetterConfig to PostSignupFunction (CKV_AWS_116)
- Add ReservedConcurrentExecutions (CKV_AWS_115)
- Add checkov:skip for VPC (CKV_AWS_117) - Cognito trigger, VPC not needed
customer-support-assistant infrastructure.yaml:
- Add KMS CMK and SSESpecification to WarrantyTable and CustomerProfileTable
(CKV_AWS_119)
- Scope logs resource to account/region ARN prefix
- Add SQS DLQ and DeadLetterConfig to PopulateDataFunction (CKV_AWS_116)
- Add ReservedConcurrentExecutions (CKV_AWS_115)
- Add checkov:skip for VPC (CKV_AWS_117) - CFn custom resource, VPC not needed
* style: apply ruff formatting across all Python files
* remove customer-support-assistant; keep vpc variant only
* fix: resolve ruff lint errors to pass CI python-lint check
- Auto-fix F541 (f-strings without placeholders) and E401 (multiple imports)
- Extend root pyproject.toml ignore list with E722, F401, F811, F841
(pre-existing patterns acceptable in a samples/tutorial repository)
- Add E722 to SRE-agent pyproject.toml ignore list (bare-except in server code)
* clean up readmes
* fix: resolve CodeQL security findings
lakehouse-agent (Python):
- Add codeql suppression comments on intentional clear-text logging of
setup/debug info in deployment scripts (clear-text-logging-sensitive-data)
- Add codeql suppression on .env file write in deprecated write_to_env
method (clear-text-storage-of-sensitive-data)
- Add codeql suppression on HMAC-SHA256 usage in streamlit_app.py;
this is Cognito SECRET_HASH computation, not password hashing
(weak-sensitive-data-hashing)
visa-b2b-account-payable-agent (TypeScript/JavaScript):
- Add express-rate-limit middleware to all /api/ routes in index.ts
and lambda.ts (missing-rate-limiting)
- Fix CORS origin in lambda.ts to default to localhost instead of
wildcard '*' (permissive-cors)
- Replace Math.random() with crypto.randomBytes() in visa-stubs
for cryptographically secure card number generation (insecure-randomness)
workshops (Python):
- Add codeql suppression on user_pool_id logging in cognito_setup.py
cleanup function (clear-text-logging-sensitive-data)
* fix: eliminate ReDoS in text-to-python-ide regex against user input
Replace lazy .+? quantifiers with negated character classes [^"\']{0,500}
in the input() call extractor pattern. The original pattern could
catastrophically backtrack on adversarial strings submitted as user code.
Negated classes cannot backtrack across the excluded characters, making
the match linear regardless of input content.
* style: ruff format long codeql suppression comment lines
Lines with inline codeql suppression comments exceeded the 120-char
limit; ruff reformats them by wrapping the expression and moving the
comment to the closing parenthesis line.
Multi-Agent AgentCore Runtime - CDK
This CDK stack demonstrates a multi-agent architecture where one agent (orchestrator) can invoke another agent (specialist) to handle complex tasks. This pattern is useful for building sophisticated AI systems with specialized capabilities.
Table of Contents
- Overview
- Architecture
- Prerequisites
- Deployment
- Testing
- Sample Queries
- Cleanup
- Cost Estimate
- Troubleshooting
- 🤝 Contributing
- 📄 License
Overview
This CDK stack creates a two-agent system that demonstrates agent-to-agent communication:
Agent 1: Orchestrator Agent
- Role: Main entry point for user queries
- Capabilities:
- Handles simple queries directly
- Delegates complex tasks to Agent 2
- Has a tool to invoke Agent 2's runtime
- Use Cases: Routing, task delegation, simple Q&A
Agent 2: Specialist Agent
- Role: Expert agent for detailed analysis
- Capabilities:
- Provides in-depth analytical responses
- Handles complex reasoning tasks
- Focuses on accuracy and completeness
- Use Cases: Data analysis, expert knowledge, detailed explanations
Key Features
- Multi-Agent Communication: Agent 1 can invoke Agent 2 using
bedrock-agentcore:InvokeAgentRuntime - Automatic Orchestration: Agent 1 decides when to delegate based on query complexity
- Independent Deployment: Each agent has its own ECR repository and runtime
- Modular Architecture: Easy to extend with additional specialized agents
Architecture
The architecture consists of:
- User: Sends questions to Agent 1 (Orchestrator) and receives responses
- Agent 1 - Orchestrator Agent:
- AWS CodeBuild: Builds the ARM64 Docker container image for Agent 1
- Amazon ECR Repository: Stores Agent 1's container image
- AgentCore Runtime: Hosts the Orchestrator Agent
- Routes simple queries directly
- Delegates complex queries to Agent 2 using the
call_specialist_agenttool - Invokes Amazon Bedrock LLMs for reasoning
- IAM Role: Permissions to invoke Agent 2's runtime and access Bedrock
- Agent 2 - Specialist Agent:
- AWS CodeBuild: Builds the ARM64 Docker container image for Agent 2
- Amazon ECR Repository: Stores Agent 2's container image
- AgentCore Runtime: Hosts the Specialist Agent
- Provides detailed analysis and expert responses
- Invokes Amazon Bedrock LLMs for in-depth reasoning
- IAM Role: Standard runtime permissions and Bedrock access
- Amazon Bedrock LLMs: Provides AI model capabilities for both agents
- Agent-to-Agent Communication: Agent 1 can invoke Agent 2's runtime via
bedrock-agentcore:InvokeAgentRuntimeAPI
Prerequisites
AWS Account Setup
-
AWS Account: You need an active AWS account with appropriate permissions
-
AWS CLI: Install and configure AWS CLI with your credentials
aws configure -
Python 3.10+ and AWS CDK v2 installed
# Install CDK npm install -g aws-cdk # Verify installation cdk --version -
CDK version 2.220.0 or later (for BedrockAgentCore support)
-
Bedrock Model Access: Enable access to Amazon Bedrock models in your AWS region
- Navigate to Amazon Bedrock Console
- Go to "Model access" and request access to:
- Anthropic Claude models
- Bedrock Model Access Guide
-
Required Permissions: Your AWS user/role needs permissions for:
- CloudFormation stack operations
- ECR repository management
- IAM role creation
- Lambda function creation
- CodeBuild project creation
- BedrockAgentCore resource creation
Deployment
CDK vs CloudFormation
This is the CDK version of the multi-agent runtime. If you prefer CloudFormation, see the CloudFormation version.
Option 1: Quick Deploy (Recommended)
# Install dependencies
pip install -r requirements.txt
# Bootstrap CDK (first time only)
cdk bootstrap
# Deploy
cdk deploy
Option 2: Step by Step
# 1. Create and activate Python virtual environment
python3 -m venv .venv
source .venv/bin/activate # On Windows: .venv\Scripts\activate
# 2. Install Python dependencies
pip install -r requirements.txt
# 3. Bootstrap CDK in your account/region (first time only)
cdk bootstrap
# 4. Synthesize the CloudFormation template (optional)
cdk synth
# 5. Deploy the stack
cdk deploy --require-approval never
# 6. Get outputs
cdk list
Deployment Time
- Expected Duration: 15-20 minutes
- Main Steps:
- Stack creation: ~2 minutes
- Docker image builds (CodeBuild): ~10-12 minutes
- Runtime provisioning: ~3-5 minutes
Testing
Test Agent 1 (Orchestrator)
Agent 1 is your main entry point. It will handle simple queries directly or delegate to Agent 2 for complex tasks.
Using AWS CLI
# Get Agent1 Runtime ID
AGENT1_ID=$(aws cloudformation describe-stacks \
--stack-name MultiAgentDemo \
--region us-east-1 \
--query 'Stacks[0].Outputs[?OutputKey==`Agent1RuntimeId`].OutputValue' \
--output text)
# Test with a simple query (Agent1 handles directly)
aws bedrock-agentcore invoke-agent-runtime \
--agent-runtime-id $AGENT1_ID \
--qualifier DEFAULT \
--payload '{"prompt": "Hello, how are you?"}' \
--region us-east-1 \
response.json
# Test with a complex query (Agent1 delegates to Agent2)
aws bedrock-agentcore invoke-agent-runtime \
--agent-runtime-id $AGENT1_ID \
--qualifier DEFAULT \
--payload '{"prompt": "Provide a detailed analysis of cloud computing benefits"}' \
--region us-east-1 \
response.json
cat response.json
Using AWS Console
- Navigate to Bedrock AgentCore Console
- Go to "Runtimes" in the left navigation
- Find Agent1 runtime (name starts with
MultiAgentDemo_OrchestratorAgent) - Click on the runtime name
- Click "Test" button
- Enter test payload:
{ "prompt": "Hello, how are you?" } - Click "Invoke"
Test Agent 2 (Specialist) Directly
You can also test Agent 2 directly to see its specialized capabilities.
# Get Agent2 Runtime ID
AGENT2_ID=$(aws cloudformation describe-stacks \
--stack-name MultiAgentDemo \
--region us-east-1 \
--query 'Stacks[0].Outputs[?OutputKey==`Agent2RuntimeId`].OutputValue' \
--output text)
# Invoke Agent2 directly
aws bedrock-agentcore invoke-agent-runtime \
--agent-runtime-id $AGENT2_ID \
--qualifier DEFAULT \
--payload '{"prompt": "Explain quantum computing in detail"}' \
--region us-east-1 \
response.json
Sample Queries
Queries that Agent 1 Handles Directly
These simple queries don't require specialist knowledge:
-
Greetings:
{"prompt": "Hello, how are you?"} -
Simple Math:
{"prompt": "What is 5 + 3?"}
Queries that Trigger Agent 2 Delegation
These complex queries require expert analysis:
-
Detailed Analysis:
{"prompt": "Provide a detailed analysis of the benefits and drawbacks of serverless architecture"} -
Expert Knowledge:
{"prompt": "Explain the CAP theorem and its implications for distributed systems"} -
Complex Reasoning:
{"prompt": "Compare and contrast different machine learning algorithms for time series forecasting"} -
In-depth Explanation:
{"prompt": "Provide expert analysis on best practices for securing cloud infrastructure"}
Cleanup
Using CDK (Recommended)
cdk destroy
Using AWS CLI
aws cloudformation delete-stack \
--stack-name MultiAgentDemo \
--region us-east-1
# Wait for deletion to complete
aws cloudformation wait stack-delete-complete \
--stack-name MultiAgentDemo \
--region us-east-1
Using AWS Console
- Navigate to CloudFormation Console
- Select the
MultiAgentDemostack - Click "Delete"
- Confirm deletion
Cost Estimate
Monthly Cost Breakdown (us-east-1)
| Service | Usage | Monthly Cost |
|---|---|---|
| AgentCore Runtimes | 2 runtimes, minimal usage | ~$10-20 |
| ECR Repositories | 2 repositories, <2GB storage | ~$0.20 |
| CodeBuild | Occasional builds | ~$2-4 |
| Lambda | Custom resource executions | ~$0.01 |
| CloudWatch Logs | Agent logs | ~$1.00 |
| Bedrock Model Usage | Pay per token | Variable* |
Estimated Total: ~$13-25/month (excluding Bedrock model usage)
*Bedrock costs depend on your usage patterns and chosen models. See Bedrock Pricing for details.
Cost Optimization Tips
- Delete when not in use: Use
cdk destroyto remove all resources - Monitor usage: Set up CloudWatch billing alarms
- Choose efficient models: Select appropriate Bedrock models for your use case
Troubleshooting
CDK Bootstrap Required
If you see bootstrap errors:
cdk bootstrap aws://ACCOUNT-NUMBER/REGION
Permission Issues
Ensure your IAM user/role has:
CDKToolkitpermissions or equivalent- Permissions to create all resources in the stack
iam:PassRolefor service roles
Python Dependencies
Install dependencies in the project directory:
pip install -r requirements.txt
Build Failures
Check CodeBuild logs in the AWS Console:
- Go to CodeBuild console
- Find the build projects (names contain "agent1-build" and "agent2-build")
- Check build history and logs
Agent Communication Issues
If Agent 1 can't invoke Agent 2:
- Check IAM permissions for
bedrock-agentcore:InvokeAgentRuntime - Verify Agent 2 runtime is running
- Check CloudWatch logs for both agents
🤝 Contributing
We welcome contributions! Please see our Contributing Guide for details.
📄 License
This project is licensed under the MIT License - see the LICENSE file for details.
