1
0
mirror of synced 2026-05-22 22:53:35 +00:00
Files
amazon-bedrock-agentcore-sa…/04-infrastructure-as-code/cdk/python/basic-runtime
Jerad 8bb4db3009 feat(cdk): reorganize CDK samples into python/ and typescript/ folders and add TypeScript CDK sample (#923)
* feat(cdk): reorganize CDK samples into python/ and typescript/ folders

- Move existing Python CDK samples to cdk/python/
- Add TypeScript CDK samples folder with knowledge-base-rag-agent
- Update cdk/README.md with language comparison table
- Update parent README with new paths and TypeScript mention
- Add cdk/python/README.md for Python-specific guidance

🤖 Assisted by Amazon Q Developer

* docs: add Jerad Engebreth to CONTRIBUTORS.md

🤖 Assisted by Amazon Q Developer

* fix(cdk/typescript): document known vulnerabilities and fix npm workspaces build

- Add Known Dependency Vulnerabilities section to README documenting
  upstream issues in aws-amplify (fast-xml-parser, lodash)
- Add build/test scripts to Lambda layer package.json to fix npm
  workspaces build command

🤖 Assisted by Amazon Q Developer

* fix(security): add HEALTHCHECK and non-root USER to Dockerfile

- Add HEALTHCHECK instruction for container orchestration
- Create non-root appuser for security best practices
- Addresses CKV_DOCKER_2, CKV_DOCKER_3 security findings

* fix(security): address CodeQL findings for insecure randomness and HTML sanitization

- Replace Math.random() with crypto.randomBytes() for session ID generation
- Use iterative sanitization loop to handle nested/obfuscated HTML tags
- Addresses CodeQL insecure randomness and incomplete sanitization findings

* fix(security): improve HTML sanitization to address CodeQL findings

- Handle closing tags with spaces like </script >
- Add data: and vbscript: URL scheme blocking
- Use tag-based approach instead of content-matching regex
- Add more dangerous tags (form, input, button, etc.)

* remove unused import

* fix(lint): fix import ordering and remove extra blank lines

- Sort imports alphabetically (logging before os)
- Remove extra blank line in knowledge_base.py
- Consistent import grouping (stdlib, then third-party)

* fix(security): use HTML entity encoding instead of regex-based sanitization

- Replace regex-based tag stripping with HTML entity encoding
- Encode all special characters (&, <, >, ", ', /, `, =)
- This approach is CodeQL-compliant and more secure
- Regex-based HTML filtering is inherently flawed

* fix(lint): add __all__ to fix F401 unused import warnings

- Add __all__ exports to infra_utils/__init__.py files
- Explicitly declares AgentCoreRole as public API

* style: apply ruff formatting to all Python files in 04-infrastructure-as-code

- Format 32 Python files with ruff
- Includes CDK Python samples, Terraform samples, and TypeScript agent code

* refactor: rename project from bedrock-agentcore-template to knowledge-base-rag-agent

- Update package.json names for root and infrastructure packages
- Update README and docs with new project name and paths
- Update CloudWatch, SNS, KMS, and Cognito resource names
- Regenerate package-lock.json with new package names

* refactor: complete project rename to knowledge-base-rag-agent

- Update README title and all documentation headers
- Update TypeScript stack descriptions and resource names
- Update Python agent module docstrings
- Update Dockerfile header comment
- Update Lambda function package description
- Rename runtime to knowledge_base_rag_agent
- Rename memory to knowledge_base_rag_agent_memory
- Rename API to Knowledge Base RAG Agent API
- Update Secrets Manager secret name

* fix: correct Docker references and fix Lambda bundling

- Update README and docs to clarify Docker is for AgentCore Runtime container, not Lambda bundling
- Add @aws-lambda-powertools/logger dependency for Lambda function
- Add esbuild as dev dependency for NodejsFunction bundling
- Fix S3 bucket deployment to use single deployment with auto content-type detection
- Deploy config.json separately with prune:false to preserve other files

---------

Co-authored-by: Jerad Engebreth <awsjerad@amazon.com>
2026-02-05 10:32:37 -06:00
..

Basic AgentCore Runtime - CDK

This CDK stack deploys a basic Amazon Bedrock AgentCore Runtime with a simple Strands agent. This is the simplest possible AgentCore deployment, perfect for getting started and understanding the core concepts without additional complexity.

Table of Contents

Overview

This CDK stack creates a minimal AgentCore deployment that includes:

  • AgentCore Runtime: Hosts a simple Strands agent
  • ECR Repository: Stores the Docker container image
  • IAM Roles: Provides necessary permissions
  • CodeBuild Project: Automatically builds the ARM64 Docker image
  • Lambda Functions: Custom resources for automation

This makes it ideal for:

  • Learning AgentCore basics
  • Quick prototyping
  • Understanding the core deployment pattern
  • Building a foundation before adding complexity

Architecture

Basic AgentCore Runtime Architecture

The architecture consists of:

  • User: Sends questions to the agent and receives responses
  • AWS CodeBuild: Builds the ARM64 Docker container image with the agent code
  • Amazon ECR Repository: Stores the container image
  • AgentCore Runtime: Hosts the Basic Agent container
    • Basic Agent: Simple Strands agent that processes user queries
    • Invokes Amazon Bedrock LLMs to generate responses
  • IAM Roles:
    • IAM role for CodeBuild (builds and pushes images)
    • IAM role for Agent Execution (runtime permissions)

Prerequisites

AWS Account Setup

  1. AWS Account: You need an active AWS account with appropriate permissions

  2. AWS CLI: Install and configure AWS CLI with your credentials

    aws configure
    
  3. Python 3.10+ and AWS CDK v2 installed

    # Install CDK
    npm install -g aws-cdk
    
    # Verify installation
    cdk --version
    
  4. CDK version 2.220.0 or later (for BedrockAgentCore support)

  5. Bedrock Model Access: Enable access to Amazon Bedrock models in your AWS region

  6. Required Permissions: Your AWS user/role needs permissions for:

    • CloudFormation stack operations
    • ECR repository management
    • IAM role creation
    • Lambda function creation
    • CodeBuild project creation
    • BedrockAgentCore resource creation

Deployment

CDK vs CloudFormation

This is the CDK version of the basic AgentCore runtime. If you prefer CloudFormation, see the CloudFormation version.

# Install dependencies
pip install -r requirements.txt

# Bootstrap CDK (first time only)
cdk bootstrap

# Deploy
cdk deploy

Option 2: Step by Step

# 1. Create and activate Python virtual environment
python3 -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

# 2. Install Python dependencies
pip install -r requirements.txt

# 3. Bootstrap CDK in your account/region (first time only)
cdk bootstrap

# 4. Synthesize the CloudFormation template (optional)
cdk synth

# 5. Deploy the stack
cdk deploy --require-approval never

# 6. Get outputs
cdk list

Deployment Time

  • Expected Duration: 8-12 minutes
  • Main Steps:
    • Stack creation: ~2 minutes
    • Docker image build (CodeBuild): ~5-8 minutes
    • Runtime provisioning: ~1-2 minutes

Testing

Using AWS CLI

# Get the Runtime ARN from CDK outputs
RUNTIME_ARN=$(aws cloudformation describe-stacks \
  --stack-name BasicAgentDemo \
  --region us-east-1 \
  --query 'Stacks[0].Outputs[?OutputKey==`AgentRuntimeArn`].OutputValue' \
  --output text)

# Invoke the agent
aws bedrock-agentcore invoke-agent-runtime \
  --agent-runtime-arn $RUNTIME_ARN \
  --qualifier DEFAULT \
  --payload $(echo '{"prompt": "Hello, how are you?"}' | base64) \
  response.json

# View the response
cat response.json

Using AWS Console

  1. Navigate to Bedrock AgentCore Console
  2. Go to "Runtimes" in the left navigation
  3. Find your runtime (name starts with BasicAgentDemo_)
  4. Click on the runtime name
  5. Click "Test" button
  6. Enter test payload:
    {
      "prompt": "Hello, how are you?"
    }
    
  7. Click "Invoke"

Sample Queries

Try these queries to test your basic agent:

  1. Simple Greeting:

    {"prompt": "Hello, how are you?"}
    
  2. Question Answering:

    {"prompt": "What is the capital of France?"}
    
  3. Creative Writing:

    {"prompt": "Write a short poem about clouds"}
    
  4. Problem Solving:

    {"prompt": "How do I bake a chocolate cake?"}
    

Cleanup

cdk destroy

Using AWS CLI

aws cloudformation delete-stack \
  --stack-name BasicAgentDemo \
  --region us-east-1

# Wait for deletion to complete
aws cloudformation wait stack-delete-complete \
  --stack-name BasicAgentDemo \
  --region us-east-1

Using AWS Console

  1. Navigate to CloudFormation Console
  2. Select the BasicAgentDemo stack
  3. Click "Delete"
  4. Confirm deletion

Cost Estimate

Monthly Cost Breakdown (us-east-1)

Service Usage Monthly Cost
AgentCore Runtime 1 runtime, minimal usage ~$5-10
ECR Repository 1 repository, <1GB storage ~$0.10
CodeBuild Occasional builds ~$1-2
Lambda Custom resource executions ~$0.01
CloudWatch Logs Agent logs ~$0.50
Bedrock Model Usage Pay per token Variable*

Estimated Total: ~$7-13/month (excluding Bedrock model usage)

*Bedrock costs depend on your usage patterns and chosen models. See Bedrock Pricing for details.

Cost Optimization Tips

  • Delete when not in use: Use cdk destroy to remove all resources
  • Monitor usage: Set up CloudWatch billing alarms
  • Choose efficient models: Select appropriate Bedrock models for your use case

Troubleshooting

CDK Bootstrap Required

If you see bootstrap errors:

cdk bootstrap aws://ACCOUNT-NUMBER/REGION

Permission Issues

Ensure your IAM user/role has:

  • CDKToolkit permissions or equivalent
  • Permissions to create all resources in the stack
  • iam:PassRole for service roles

Python Dependencies

Install dependencies in the project directory:

pip install -r requirements.txt

Build Failures

Check CodeBuild logs in the AWS Console:

  1. Go to CodeBuild console
  2. Find the build project (name contains "basic-agent-build")
  3. Check build history and logs

Runtime Issues

If the runtime fails to start:

  1. Check CloudWatch logs for the runtime
  2. Verify the Docker image was built successfully
  3. Ensure IAM permissions are correct

🤝 Contributing

We welcome contributions! Please see our Contributing Guide for details.

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.