RuntimeProps

class aws_cdk.aws_bedrockagentcore.RuntimeProps(*, agent_runtime_artifact, authorizer_configuration=None, description=None, environment_variables=None, execution_role=None, lifecycle_configuration=None, logging_configs=None, manage_delivery_resource_policy=None, network_configuration=None, protocol_configuration=None, request_header_configuration=None, runtime_name=None, tags=None, tracing_enabled=None)

Bases: object

Properties for creating a Bedrock Agent Core Runtime resource.

Parameters:

  • agent_runtime_artifact (AgentRuntimeArtifact) – The artifact configuration for the agent runtime Contains the container configuration with ECR URI.

  • authorizer_configuration (Optional[RuntimeAuthorizerConfiguration]) – Authorizer configuration for the agent runtime Use RuntimeAuthorizerConfiguration static methods to create the configuration. Default: - RuntimeAuthorizerConfiguration.iam() (IAM authentication)

  • description (Optional[str]) – Optional description for the agent runtime. Default: - No description Length Minimum: 1 , Maximum: 1200

  • environment_variables (Optional[Mapping[str, str]]) – Environment variables for the agent runtime - Maximum 50 environment variables - Key: Must be 1-100 characters, start with letter or underscore, contain only letters, numbers, and underscores - Value: Must be 0-2048 characters (per CloudFormation specification). Default: - No environment variables

  • execution_role (Optional[IRole]) – The IAM role that provides permissions for the agent runtime If not provided, a role will be created automatically. Default: - A new role will be created

  • lifecycle_configuration (Union[LifecycleConfiguration, Dict[str, Any], None]) – The life cycle configuration for the AgentCore Runtime. Default: - No lifecycle configuration

  • logging_configs (Optional[Sequence[Union[LoggingConfig, Dict[str, Any]]]]) – Logging configuration for the runtime. Allows sending APPLICATION_LOGS and USAGE_LOGS to CloudWatch Logs, S3, or Kinesis Data Firehose. Default: - No logging configured

  • manage_delivery_resource_policy (Optional[bool]) – Whether to create resource policies for log/trace delivery. When false, the AWS::Logs::ResourcePolicy and AWS::XRay::ResourcePolicy are not created. This is useful when deploying many runtimes per account/Region, as each resource policy consumes an account-level quota slot (CloudWatch Logs: 10, X-Ray: lower). Setting false means you are responsible for ensuring delivery permissions exist. There are two safe ways to use this: - Same-account delivery to a /aws/vendedlogs/ log group, where the log-delivery service-linked role grants write access implicitly. - Attaching the delivery resource policy yourself. Otherwise delivery silently fails: synthesis and deploy succeed, but nothing is delivered. Per the vended-logs delivery docs, a resource policy is required for CloudWatch Logs delivery outside the /aws/vendedlogs/ same-account case. Default: true

  • network_configuration (Optional[RuntimeNetworkConfiguration]) – Network configuration for the agent runtime. Default: - RuntimeNetworkConfiguration.usingPublicNetwork()

  • protocol_configuration (Optional[ProtocolType]) – Protocol configuration for the agent runtime. Default: - ProtocolType.HTTP

  • request_header_configuration (Union[RequestHeaderConfiguration, Dict[str, Any], None]) – Configuration for HTTP request headers that will be passed through to the runtime. Default: - No request headers configured

  • runtime_name (Optional[str]) – The name of the agent runtime Valid characters are a-z, A-Z, 0-9, _ (underscore) Must start with a letter and can be up to 48 characters long Pattern: ^[a-zA-Z][a-zA-Z0-9_]{0,47}$. Default: - auto generate

  • tags (Optional[Mapping[str, str]]) – Tags for the agent runtime A list of key:value pairs of tags to apply to this Runtime resource. Default: {} - no tags

  • tracing_enabled (Optional[bool]) – Whether to enable X-Ray tracing for this runtime. When enabled, traces will be delivered to AWS X-Ray. Default: false

ExampleMetadata:

fixture=default infused

Example:

# S3 bucket containing the agent core
code_bucket = s3.Bucket(self, "AgentCode",
    bucket_name="my-code-bucket",
    removal_policy=RemovalPolicy.DESTROY
)

# the bucket above needs to contain the agent code

agent_runtime_artifact = agentcore.AgentRuntimeArtifact.from_s3(s3.Location(
    bucket_name=code_bucket.bucket_name,
    object_key="deployment_package.zip"
), agentcore.AgentCoreRuntime.PYTHON_3_12, ["opentelemetry-instrument", "main.py"])

runtime_instance = agentcore.Runtime(self, "MyAgentRuntime",
    runtime_name="myAgent",
    agent_runtime_artifact=agent_runtime_artifact
)

Attributes

agent_runtime_artifact

The artifact configuration for the agent runtime Contains the container configuration with ECR URI.

authorizer_configuration

Authorizer configuration for the agent runtime Use RuntimeAuthorizerConfiguration static methods to create the configuration.

Default:

  • RuntimeAuthorizerConfiguration.iam() (IAM authentication)

description

Optional description for the agent runtime.

Default:

  • No description

Length Minimum: 1 , Maximum: 1200

environment_variables

Must be 0-2048 characters (per CloudFormation specification).

Default:

  • No environment variables

Type:

Environment variables for the agent runtime - Maximum 50 environment variables - Key

Type:

Must be 1-100 characters, start with letter or underscore, contain only letters, numbers, and underscores - Value

execution_role

The IAM role that provides permissions for the agent runtime If not provided, a role will be created automatically.

Default:

  • A new role will be created

lifecycle_configuration

The life cycle configuration for the AgentCore Runtime.

Default:

  • No lifecycle configuration

logging_configs

Logging configuration for the runtime.

Allows sending APPLICATION_LOGS and USAGE_LOGS to CloudWatch Logs, S3, or Kinesis Data Firehose.

Default:

  • No logging configured

See:

https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability.html

manage_delivery_resource_policy

Whether to create resource policies for log/trace delivery.

When false, the AWS::Logs::ResourcePolicy and AWS::XRay::ResourcePolicy are not created. This is useful when deploying many runtimes per account/Region, as each resource policy consumes an account-level quota slot (CloudWatch Logs: 10, X-Ray: lower).

Setting false means you are responsible for ensuring delivery permissions exist. There are two safe ways to use this:

  • Same-account delivery to a /aws/vendedlogs/ log group, where the log-delivery service-linked role grants write access implicitly.

  • Attaching the delivery resource policy yourself.

Otherwise delivery silently fails: synthesis and deploy succeed, but nothing is delivered. Per the vended-logs delivery docs, a resource policy is required for CloudWatch Logs delivery outside the /aws/vendedlogs/ same-account case.

Default:

true

See:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/cloudwatch_limits_cwl.html

network_configuration

Network configuration for the agent runtime.

Default:

  • RuntimeNetworkConfiguration.usingPublicNetwork()

protocol_configuration

Protocol configuration for the agent runtime.

Default:

  • ProtocolType.HTTP

request_header_configuration

Configuration for HTTP request headers that will be passed through to the runtime.

Default:

  • No request headers configured

runtime_name

^[a-zA-Z][a-zA-Z0-9_]{0,47}$.

Default:

  • auto generate

Type:

The name of the agent runtime Valid characters are a-z, A-Z, 0-9, _ (underscore) Must start with a letter and can be up to 48 characters long Pattern

tags

value pairs of tags to apply to this Runtime resource.

Default:

{} - no tags

Type:

Tags for the agent runtime A list of key

tracing_enabled

Whether to enable X-Ray tracing for this runtime.

When enabled, traces will be delivered to AWS X-Ray.

Default:

false

See:

https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability.html