2026/08/06 - Amazon Bedrock AgentCore Control - 12 new8 updated api methods
Changes Add support for capacity provider sessions in Amazon Bedrock AgentCore. Customers can now delete an active session running on a runtime instance launched through their capacity provider.
Updates a capacity provider. Only the description can be changed. To change other configuration, such as instance types, networking, or storage, create a new capacity provider.
See also: AWS API Documentation
Request Syntax
client.update_capacity_provider(
capacityProviderId='string',
description={
'optionalValue': 'string'
},
clientToken='string'
)
string
[REQUIRED]
The unique identifier of the capacity provider to update.
dict
The updated description of the capacity provider.
optionalValue (string) --
Represents an optional value that is used to update the human-readable description of the resource. If not specified, it will clear the current description of the resource.
string
A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If you don't specify this field, a value is randomly generated for you. If this token matches a previous request, the service ignores the request, but doesn't return an error. For more information, see Ensuring idempotency.
This field is autopopulated if not provided.
dict
Response Syntax
{
'capacityProviderId': 'string',
'capacityProviderArn': 'string',
'name': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED',
'createdAt': datetime(2015, 1, 1),
'lastUpdatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
capacityProviderId (string) --
The unique identifier of the capacity provider.
capacityProviderArn (string) --
The Amazon Resource Name (ARN) of the capacity provider.
name (string) --
The name of the capacity provider.
status (string) --
The current status of the capacity provider. For possible values, see CapacityProviderStatus.
createdAt (datetime) --
The timestamp when the capacity provider was created.
lastUpdatedAt (datetime) --
The timestamp when the capacity provider was last updated.
Lists all rate limits for a gateway. Results are paginated. Use the nextToken parameter to retrieve additional results.
See also: AWS API Documentation
Request Syntax
client.list_gateway_rate_limits(
gatewayIdentifier='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The unique identifier of the gateway.
integer
The maximum number of results to return in the response. If the total number of results is greater than this value, use the token returned in the response in the nextToken field when making another request to return the next batch of results.
string
The token to use to retrieve the next page of results. Use the value returned in a previous ListGatewayRateLimits response.
dict
Response Syntax
{
'rateLimits': [
{
'rateLimitId': 'string',
'gatewayIdentifier': 'string',
'description': 'string',
'dimensionKeys': [
'string',
],
'entries': [
{
'dimensions': {
'string': 'string'
},
'requests': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'tokens': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'connections': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
]
},
],
'status': 'CREATING'|'ACTIVE'|'UPDATING'|'DELETING',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
rateLimits (list) --
The list of rate limits for the gateway.
(dict) --
Shared fields for GatewayRateLimit responses
rateLimitId (string) --
Limit identifier. Optional on Create (system-generates if not provided by customer). Always present in responses.
gatewayIdentifier (string) --
The unique identifier of the gateway.
description (string) --
Optional human-readable description for this limit.
dimensionKeys (list) --
Ordered list of dimension key names defining the scope of a limit
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
entries (list) --
List of rule entries within a limit
(dict) --
A single rule entry within a limit, mapping dimension values to rate configurations
dimensions (dict) --
Map of dimension name to dimension value, matching the parent limit's dimensionKeys. Keys must exactly match the dimensionKeys. Values may be "" as a wildcard. "" may only appear at trailing positions (based on dimensionKeys ordering).
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
(string) --
A dimension value in a rule entry (exact value or "*" wildcard)
requests (list) --
Request rate limits (RPS or RPM). Limited to 1 entry for now.
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
tokens (list) --
Token rate limits (TPM). Limited to 1 entry for now. — P1
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
connections (list) --
Connection rate limits (per second only). Limited to 1 entry for now. — P2
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
status (string) --
Status of a gateway limit
createdAt (datetime) --
The timestamp when the rate limit was created.
updatedAt (datetime) --
The timestamp when the rate limit was last updated.
nextToken (string) --
The token for the next page of results. If this value is absent, there are no more results to retrieve.
Creates a rate limit for a gateway. Rate limits define throttling rules for each dimension that control request rates, token consumption rates, and concurrent connections through the gateway.
See also: AWS API Documentation
Request Syntax
client.create_gateway_rate_limit(
gatewayIdentifier='string',
clientToken='string',
rateLimitId='string',
description='string',
dimensionKeys=[
'string',
],
entries=[
{
'dimensions': {
'string': 'string'
},
'requests': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'tokens': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'connections': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
]
},
]
)
string
[REQUIRED]
The unique identifier of the gateway to create the rate limit for.
string
A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If you don't specify this field, a value is randomly generated for you. If this token matches a previous request, the service ignores the request, but doesn't return an error. For more information, see Ensuring idempotency.
This field is autopopulated if not provided.
string
Optional customer-defined limit ID. If not provided, system generates one.
string
Optional human-readable description for this limit.
list
[REQUIRED]
Ordered list of dimension names defining the scope of this limit. Unique per gateway — no two limits can share the same dimensionKeys.
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
list
[REQUIRED]
Rule entries mapping dimension values to rate configurations.
(dict) --
A single rule entry within a limit, mapping dimension values to rate configurations
dimensions (dict) -- [REQUIRED]
Map of dimension name to dimension value, matching the parent limit's dimensionKeys. Keys must exactly match the dimensionKeys. Values may be "" as a wildcard. "" may only appear at trailing positions (based on dimensionKeys ordering).
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
(string) --
A dimension value in a rule entry (exact value or "*" wildcard)
requests (list) --
Request rate limits (RPS or RPM). Limited to 1 entry for now.
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) -- [REQUIRED]
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) -- [REQUIRED]
Time period for rate limiting
tokens (list) --
Token rate limits (TPM). Limited to 1 entry for now. — P1
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) -- [REQUIRED]
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) -- [REQUIRED]
Time period for rate limiting
connections (list) --
Connection rate limits (per second only). Limited to 1 entry for now. — P2
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) -- [REQUIRED]
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) -- [REQUIRED]
Time period for rate limiting
dict
Response Syntax
{
'rateLimitId': 'string',
'gatewayIdentifier': 'string',
'description': 'string',
'dimensionKeys': [
'string',
],
'entries': [
{
'dimensions': {
'string': 'string'
},
'requests': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'tokens': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'connections': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
]
},
],
'status': 'CREATING'|'ACTIVE'|'UPDATING'|'DELETING',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Shared fields for GatewayRateLimit responses
rateLimitId (string) --
Limit identifier. Optional on Create (system-generates if not provided by customer). Always present in responses.
gatewayIdentifier (string) --
The unique identifier of the gateway.
description (string) --
Optional human-readable description for this limit.
dimensionKeys (list) --
Ordered list of dimension key names defining the scope of a limit
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
entries (list) --
List of rule entries within a limit
(dict) --
A single rule entry within a limit, mapping dimension values to rate configurations
dimensions (dict) --
Map of dimension name to dimension value, matching the parent limit's dimensionKeys. Keys must exactly match the dimensionKeys. Values may be "" as a wildcard. "" may only appear at trailing positions (based on dimensionKeys ordering).
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
(string) --
A dimension value in a rule entry (exact value or "*" wildcard)
requests (list) --
Request rate limits (RPS or RPM). Limited to 1 entry for now.
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
tokens (list) --
Token rate limits (TPM). Limited to 1 entry for now. — P1
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
connections (list) --
Connection rate limits (per second only). Limited to 1 entry for now. — P2
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
status (string) --
Status of a gateway limit
createdAt (datetime) --
The timestamp when the rate limit was created.
updatedAt (datetime) --
The timestamp when the rate limit was last updated.
Retrieves information about a capacity provider, including its status, permissions configuration, and compute configuration.
See also: AWS API Documentation
Request Syntax
client.get_capacity_provider(
capacityProviderId='string'
)
string
[REQUIRED]
The unique identifier of the capacity provider.
dict
Response Syntax
{
'capacityProviderId': 'string',
'capacityProviderArn': 'string',
'name': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED',
'description': 'string',
'statusCode': 'VALIDATION_ERROR'|'QUOTA_EXCEEDED'|'THROTTLED'|'INTERNAL_SERVER_EXCEPTION',
'statusReason': 'string',
'permissionsConfiguration': {
'capacityProviderOperatorRoleArn': 'string'
},
'computeConfiguration': {
'ec2Configuration': {
'launchTemplateSource': {
'launchParameters': {
'operatingSystem': 'LINUX_X86_64'|'LINUX_ARM64',
'instanceRequirements': {
'allowedInstanceTypes': [
'string',
]
},
'ephemeralVolumes': [
{
'deviceName': 'string',
'virtualName': 'string',
'ebs': {
'volumeType': 'standard'|'io1'|'io2'|'gp2'|'sc1'|'st1'|'gp3',
'iops': 123,
'throughput': 123,
'encrypted': True|False,
'kmsKeyId': 'string',
'snapshotId': 'string',
'volumeSize': 123,
'volumeInitializationRate': 123,
'ebsCardIndex': 123
}
},
],
'monitoring': 'BASIC'|'DETAILED',
'licenseSpecifications': [
{
'licenseConfigurationArn': 'string'
},
],
'capacityReservationSpecification': {
'capacityReservationPreference': 'capacity-reservations-only'|'open'|'none',
'capacityReservationTarget': {
'capacityReservationId': 'string',
'capacityReservationResourceGroupArn': 'string'
}
},
'sshKeyName': 'string',
'instanceProfileArn': 'string',
'propagatedTags': {
'string': 'string'
}
}
},
'vpcConfiguration': {
'subnets': [
'string',
],
'securityGroups': [
'string',
]
},
'volumes': [
{
'ebsConfiguration': {
'name': 'string',
'sizeGiB': 123,
'volumeType': 'standard'|'io1'|'io2'|'gp2'|'sc1'|'st1'|'gp3',
'iops': 123,
'throughput': 123,
'encrypted': True|False,
'kmsKeyId': 'string',
'snapshotId': 'string'
}
},
],
'lifecycleConfiguration': {
'idleInstanceTimeout': 123,
'maxLifetime': 123
},
'rootVolume': {
'volumeType': 'standard'|'io1'|'io2'|'gp2'|'sc1'|'st1'|'gp3',
'iops': 123,
'throughput': 123,
'encrypted': True|False,
'kmsKeyId': 'string',
'freeSpaceGiB': 123
}
}
},
'createdAt': datetime(2015, 1, 1),
'lastUpdatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
capacityProviderId (string) --
The unique identifier of the capacity provider.
capacityProviderArn (string) --
The Amazon Resource Name (ARN) of the capacity provider.
name (string) --
The name of the capacity provider.
status (string) --
The current status of the capacity provider. For possible values, see CapacityProviderStatus.
description (string) --
The description of the capacity provider, if one was provided.
statusCode (string) --
A reason code for a capacity provider that is not in the READY state. Use this code for programmatic error handling.
statusReason (string) --
A human-readable message that describes why the capacity provider is not in the READY state. Because these messages can change, use statusCode for programmatic error handling.
permissionsConfiguration (dict) --
The permissions configuration for the capacity provider.
capacityProviderOperatorRoleArn (string) --
The Amazon Resource Name (ARN) of the IAM role that AgentCore assumes to manage the capacity provider, including launching, tagging, and terminating instances and their network interfaces. We recommend scoping this role to the minimum permissions that your workloads require.
computeConfiguration (dict) --
The compute configuration for the capacity provider.
ec2Configuration (dict) --
The Amazon EC2 compute configuration for the capacity provider.
launchTemplateSource (dict) --
The source of the launch template configuration that defines how instances are launched.
launchParameters (dict) --
The parameters that AgentCore uses to create the launch template.
operatingSystem (string) --
The operating system and CPU architecture for the instances.
instanceRequirements (dict) --
The requirements that determine which instance types can be launched.
allowedInstanceTypes (list) --
The list of allowed instance types. You can specify up to 30 instance types.
(string) --
ephemeralVolumes (list) --
The block device mappings for instance store (ephemeral) volumes. You can specify up to five mappings.
(dict) --
A block device mapping for an instance store (ephemeral) volume.
deviceName (string) --
The device name, for example /dev/sdh or xvdh.
virtualName (string) --
The virtual device name ( ephemeralN). Instance store volumes are numbered starting from 0. The number of available instance store volumes depends on the instance type. After you connect to the instance, you must mount the volume.
ebs (dict) --
The shared Amazon EBS performance and encryption properties for a volume. These properties are common across the different volume configurations for a capacity provider.
volumeType (string) --
The Amazon EBS volume type. If you do not specify a type, the default is gp3.
iops (integer) --
The number of IOPS to provision. For gp3, io1, and io2 volumes, this is the number of IOPS provisioned for the volume. For gp2 volumes, this sets the baseline IOPS performance. It also controls the rate at which the volume accumulates I/O credits for bursting. Supported values: gp3, 3,000–80,000; io1, 100–64,000; io2, 100–256,000.
throughput (integer) --
The throughput to provision, in MiB/s. Valid only for gp3 volumes. Valid range: 125–2,000 MiB/s.
encrypted (boolean) --
Specifies whether to encrypt the volume. Encrypted volumes can be attached only to instances that support Amazon EBS encryption. If you create a volume from a snapshot, you cannot specify an encryption value.
kmsKeyId (string) --
The identifier (key ID, key alias, key ARN, or alias ARN) of the customer managed KMS key to use for Amazon EBS encryption.
snapshotId (string) --
The ID of the snapshot.
volumeSize (integer) --
The size of the volume, in GiB. You must specify either a snapshot ID or a volume size. Supported sizes: gp2, 1–16,384; gp3, 1–65,536; io1, 4–16,384; io2, 4–65,536.
volumeInitializationRate (integer) --
The rate at which the volume is initialized after creation, in MiB/s. Supported only for volumes created from snapshots. Valid range: 100–300 MiB/s.
ebsCardIndex (integer) --
The index of the Amazon EBS card. Applies to instances with multiple Amazon EBS cards.
monitoring (string) --
The monitoring level for the instances.
licenseSpecifications (list) --
The license configurations to associate with the instances. You can specify up to five configurations.
(dict) --
A license configuration to associate with the instances.
licenseConfigurationArn (string) --
The Amazon Resource Name (ARN) of the license configuration.
capacityReservationSpecification (dict) --
The Capacity Reservation targeting option for the instances.
capacityReservationPreference (string) --
The Capacity Reservation preference for the instances.
capacityReservationTarget (dict) --
The target Capacity Reservation or Capacity Reservation group for the instances.
capacityReservationId (string) --
The ID of the Capacity Reservation in which to run the instances.
capacityReservationResourceGroupArn (string) --
The Amazon Resource Name (ARN) of the Capacity Reservation resource group in which to run the instances.
sshKeyName (string) --
The name of the SSH key pair to configure on the instances for SSH connectivity.
instanceProfileArn (string) --
The Amazon Resource Name (ARN) of the IAM instance profile to associate with launched instances. If provided, this overrides the default instance profile.
propagatedTags (dict) --
The tags to propagate to all Amazon EC2 resources (instances, volumes, and network interfaces) that the capacity provider creates.
(string) --
(string) --
vpcConfiguration (dict) --
The VPC configuration for launching instances, including subnets and security groups.
subnets (list) --
The IDs of the subnets in which to launch instances. You must specify at least one subnet.
(string) --
securityGroups (list) --
The IDs of the security groups to associate with the instances. You must specify at least one security group.
(string) --
volumes (list) --
The named persistent Amazon EBS volumes for the capacity provider. A capacity provider can define up to five volumes.
(dict) --
The configuration for a persistent volume attached to a capacity provider. This structure defines the storage backing for the persistent volumes used by agents that run on capacity provider instances.
ebsConfiguration (dict) --
The configuration for an Amazon EBS-backed persistent volume.
name (string) --
The logical name of the volume. Use this name to reference the volume when you mount it into an agent runtime.
sizeGiB (integer) --
The size of the volume, in GiB.
volumeType (string) --
The Amazon EBS volume type. If you do not specify a type, the default is gp3.
iops (integer) --
The number of IOPS to provision. Valid only for gp3, io1, and io2 volumes.
throughput (integer) --
The throughput, in MiB/s. Valid only for gp3 volumes.
encrypted (boolean) --
Specifies whether to encrypt the volume. If true, the service encrypts the volume with the KMS key that you specify in kmsKeyId, or the default KMS key for Amazon EBS if you do not specify one. The default is true.
kmsKeyId (string) --
The identifier of the KMS key to use for encryption.
snapshotId (string) --
An optional Amazon EBS snapshot ID. If provided, the volume is initialized from this snapshot the first time it is created. On subsequent restarts, the existing volume is used and the snapshot is ignored.
lifecycleConfiguration (dict) --
The lifecycle configuration for instances in the capacity provider.
idleInstanceTimeout (integer) --
The number of seconds an instance can remain idle before it is stopped. An instance is considered idle when all of its agents are idle. The default is 900 seconds (15 minutes).
maxLifetime (integer) --
The maximum lifetime of an instance, in seconds. When an instance reaches this limit, the service terminates it regardless of activity. The default is 28800 seconds (8 hours). The maximum is 1209600 seconds (14 days).
rootVolume (dict) --
The configuration for the instance root volume. Specify the amount of free space to guarantee and, optionally, the Amazon EBS performance and encryption settings. The device name and delete-on-termination behavior are not configurable.
volumeType (string) --
The Amazon EBS volume type. If you do not specify a type, the default is gp3.
iops (integer) --
The number of IOPS to provision. For gp3, io1, and io2 volumes, this is the number of IOPS provisioned for the volume. For gp2 volumes, this sets the baseline IOPS performance. It also controls the rate at which the volume accumulates I/O credits for bursting. Supported values: gp3, 3,000–80,000; io1, 100–64,000; io2, 100–256,000.
throughput (integer) --
The throughput to provision, in MiB/s. Valid only for gp3 volumes. Valid range: 125–2,000 MiB/s.
encrypted (boolean) --
Specifies whether to encrypt the volume. Encrypted volumes can be attached only to instances that support Amazon EBS encryption. If you create a volume from a snapshot, you cannot specify an encryption value.
kmsKeyId (string) --
The identifier (key ID, key alias, key ARN, or alias ARN) of the customer managed KMS key to use for Amazon EBS encryption.
freeSpaceGiB (integer) --
The free space guaranteed on the root volume, in GiB. AgentCore adds the operating system overhead on top of this value. The default is 8 GiB.
createdAt (datetime) --
The timestamp when the capacity provider was created.
lastUpdatedAt (datetime) --
The timestamp when the capacity provider was last updated.
Atomically creates or updates multiple rate limits for a gateway. The operation updates existing limits with matching keys and creates new limits for new keys. If the operation fails, the service applies no changes. Retry the request after resolving the issue.
See also: AWS API Documentation
Request Syntax
client.batch_put_gateway_rate_limits(
gatewayIdentifier='string',
clientToken='string',
rateLimits=[
{
'rateLimitId': 'string',
'description': 'string',
'dimensionKeys': [
'string',
],
'entries': [
{
'dimensions': {
'string': 'string'
},
'requests': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'tokens': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'connections': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
]
},
]
},
]
)
string
[REQUIRED]
The unique identifier of the gateway.
string
A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If you don't specify this field, a value is randomly generated for you. If this token matches a previous request, the service ignores the request, but doesn't return an error. For more information, see Ensuring idempotency.
This field is autopopulated if not provided.
list
[REQUIRED]
Complete set of rate limits for this gateway. Replaces all existing limits atomically.
(dict) --
A limit definition within a BatchPut request (rateLimitId used for upsert matching)
rateLimitId (string) --
Optional — if provided, used for upsert matching against existing limits.
description (string) --
Optional human-readable description for this limit.
dimensionKeys (list) -- [REQUIRED]
Ordered list of dimension key names defining the scope of a limit
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
entries (list) -- [REQUIRED]
List of rule entries within a limit
(dict) --
A single rule entry within a limit, mapping dimension values to rate configurations
dimensions (dict) -- [REQUIRED]
Map of dimension name to dimension value, matching the parent limit's dimensionKeys. Keys must exactly match the dimensionKeys. Values may be "" as a wildcard. "" may only appear at trailing positions (based on dimensionKeys ordering).
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
(string) --
A dimension value in a rule entry (exact value or "*" wildcard)
requests (list) --
Request rate limits (RPS or RPM). Limited to 1 entry for now.
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) -- [REQUIRED]
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) -- [REQUIRED]
Time period for rate limiting
tokens (list) --
Token rate limits (TPM). Limited to 1 entry for now. — P1
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) -- [REQUIRED]
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) -- [REQUIRED]
Time period for rate limiting
connections (list) --
Connection rate limits (per second only). Limited to 1 entry for now. — P2
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) -- [REQUIRED]
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) -- [REQUIRED]
Time period for rate limiting
dict
Response Syntax
{
'rateLimits': [
{
'rateLimitId': 'string',
'gatewayIdentifier': 'string',
'description': 'string',
'dimensionKeys': [
'string',
],
'entries': [
{
'dimensions': {
'string': 'string'
},
'requests': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'tokens': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'connections': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
]
},
],
'status': 'CREATING'|'ACTIVE'|'UPDATING'|'DELETING',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
rateLimits (list) --
The resulting set of rate limits after the batch operation.
(dict) --
Shared fields for GatewayRateLimit responses
rateLimitId (string) --
Limit identifier. Optional on Create (system-generates if not provided by customer). Always present in responses.
gatewayIdentifier (string) --
The unique identifier of the gateway.
description (string) --
Optional human-readable description for this limit.
dimensionKeys (list) --
Ordered list of dimension key names defining the scope of a limit
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
entries (list) --
List of rule entries within a limit
(dict) --
A single rule entry within a limit, mapping dimension values to rate configurations
dimensions (dict) --
Map of dimension name to dimension value, matching the parent limit's dimensionKeys. Keys must exactly match the dimensionKeys. Values may be "" as a wildcard. "" may only appear at trailing positions (based on dimensionKeys ordering).
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
(string) --
A dimension value in a rule entry (exact value or "*" wildcard)
requests (list) --
Request rate limits (RPS or RPM). Limited to 1 entry for now.
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
tokens (list) --
Token rate limits (TPM). Limited to 1 entry for now. — P1
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
connections (list) --
Connection rate limits (per second only). Limited to 1 entry for now. — P2
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
status (string) --
Status of a gateway limit
createdAt (datetime) --
The timestamp when the rate limit was created.
updatedAt (datetime) --
The timestamp when the rate limit was last updated.
Retrieves information about a gateway rate limit.
See also: AWS API Documentation
Request Syntax
client.get_gateway_rate_limit(
gatewayIdentifier='string',
rateLimitId='string'
)
string
[REQUIRED]
The unique identifier of the gateway.
string
[REQUIRED]
The unique identifier of the rate limit to retrieve.
dict
Response Syntax
{
'rateLimitId': 'string',
'gatewayIdentifier': 'string',
'description': 'string',
'dimensionKeys': [
'string',
],
'entries': [
{
'dimensions': {
'string': 'string'
},
'requests': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'tokens': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'connections': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
]
},
],
'status': 'CREATING'|'ACTIVE'|'UPDATING'|'DELETING',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Shared fields for GatewayRateLimit responses
rateLimitId (string) --
Limit identifier. Optional on Create (system-generates if not provided by customer). Always present in responses.
gatewayIdentifier (string) --
The unique identifier of the gateway.
description (string) --
Optional human-readable description for this limit.
dimensionKeys (list) --
Ordered list of dimension key names defining the scope of a limit
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
entries (list) --
List of rule entries within a limit
(dict) --
A single rule entry within a limit, mapping dimension values to rate configurations
dimensions (dict) --
Map of dimension name to dimension value, matching the parent limit's dimensionKeys. Keys must exactly match the dimensionKeys. Values may be "" as a wildcard. "" may only appear at trailing positions (based on dimensionKeys ordering).
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
(string) --
A dimension value in a rule entry (exact value or "*" wildcard)
requests (list) --
Request rate limits (RPS or RPM). Limited to 1 entry for now.
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
tokens (list) --
Token rate limits (TPM). Limited to 1 entry for now. — P1
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
connections (list) --
Connection rate limits (per second only). Limited to 1 entry for now. — P2
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
status (string) --
Status of a gateway limit
createdAt (datetime) --
The timestamp when the rate limit was created.
updatedAt (datetime) --
The timestamp when the rate limit was last updated.
Deletes a gateway rate limit.
See also: AWS API Documentation
Request Syntax
client.delete_gateway_rate_limit(
gatewayIdentifier='string',
rateLimitId='string'
)
string
[REQUIRED]
The unique identifier of the gateway.
string
[REQUIRED]
The unique identifier of the rate limit to delete.
dict
Response Syntax
{
'rateLimitId': 'string',
'status': 'CREATING'|'ACTIVE'|'UPDATING'|'DELETING'
}
Response Structure
(dict) --
rateLimitId (string) --
Limit identifier. Optional on Create (system-generates if not provided by customer). Always present in responses.
status (string) --
Status of a gateway limit
Lists the capacity providers in your account and returns summary information for each one. To retrieve the full configuration for a specific capacity provider, use GetCapacityProvider. Results are paginated; use the nextToken parameter to retrieve additional results.
See also: AWS API Documentation
Request Syntax
client.list_capacity_providers(
maxResults=123,
nextToken='string'
)
integer
The maximum number of results to return in the response. If the total number of results is greater than this value, use the token returned in the response in the nextToken field when making another request to return the next batch of results.
string
If the total number of results is greater than the maxResults value provided in the request, enter the token returned in the nextToken field in the response in this field to return the next batch of results.
dict
Response Syntax
{
'capacityProviders': [
{
'capacityProviderId': 'string',
'capacityProviderArn': 'string',
'name': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED',
'lastUpdatedAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
capacityProviders (list) --
The list of capacity provider summaries.
(dict) --
A summary of a capacity provider, as returned by ListCapacityProviders. Each summary includes the capacity provider identifier, Amazon Resource Name (ARN), name, status, and last-updated timestamp.
capacityProviderId (string) --
The unique identifier of the capacity provider.
capacityProviderArn (string) --
The Amazon Resource Name (ARN) of the capacity provider.
name (string) --
The name of the capacity provider.
status (string) --
The current status of the capacity provider. For possible values, see CapacityProviderStatus.
lastUpdatedAt (datetime) --
The timestamp when the capacity provider was last updated.
nextToken (string) --
If the total number of results is greater than the maxResults value provided in the request, use this token when making another request in the nextToken field to return the next batch of results.
Updates the entries of a gateway rate limit. The dimension keys are immutable after creation.
See also: AWS API Documentation
Request Syntax
client.update_gateway_rate_limit(
gatewayIdentifier='string',
rateLimitId='string',
description='string',
entries=[
{
'dimensions': {
'string': 'string'
},
'requests': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'tokens': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'connections': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
]
},
]
)
string
[REQUIRED]
The unique identifier of the gateway.
string
[REQUIRED]
The unique identifier of the rate limit to update.
string
Optional human-readable description for this limit.
list
[REQUIRED]
Updated rule entries. key and dimensionKeys are immutable and cannot be changed.
(dict) --
A single rule entry within a limit, mapping dimension values to rate configurations
dimensions (dict) -- [REQUIRED]
Map of dimension name to dimension value, matching the parent limit's dimensionKeys. Keys must exactly match the dimensionKeys. Values may be "" as a wildcard. "" may only appear at trailing positions (based on dimensionKeys ordering).
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
(string) --
A dimension value in a rule entry (exact value or "*" wildcard)
requests (list) --
Request rate limits (RPS or RPM). Limited to 1 entry for now.
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) -- [REQUIRED]
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) -- [REQUIRED]
Time period for rate limiting
tokens (list) --
Token rate limits (TPM). Limited to 1 entry for now. — P1
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) -- [REQUIRED]
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) -- [REQUIRED]
Time period for rate limiting
connections (list) --
Connection rate limits (per second only). Limited to 1 entry for now. — P2
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) -- [REQUIRED]
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) -- [REQUIRED]
Time period for rate limiting
dict
Response Syntax
{
'rateLimitId': 'string',
'gatewayIdentifier': 'string',
'description': 'string',
'dimensionKeys': [
'string',
],
'entries': [
{
'dimensions': {
'string': 'string'
},
'requests': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'tokens': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
],
'connections': [
{
'rate': 123.0,
'period': 'second'|'minute'
},
]
},
],
'status': 'CREATING'|'ACTIVE'|'UPDATING'|'DELETING',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Shared fields for GatewayRateLimit responses
rateLimitId (string) --
Limit identifier. Optional on Create (system-generates if not provided by customer). Always present in responses.
gatewayIdentifier (string) --
The unique identifier of the gateway.
description (string) --
Optional human-readable description for this limit.
dimensionKeys (list) --
Ordered list of dimension key names defining the scope of a limit
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
entries (list) --
List of rule entries within a limit
(dict) --
A single rule entry within a limit, mapping dimension values to rate configurations
dimensions (dict) --
Map of dimension name to dimension value, matching the parent limit's dimensionKeys. Keys must exactly match the dimensionKeys. Values may be "" as a wildcard. "" may only appear at trailing positions (based on dimensionKeys ordering).
(string) --
A dimension key specifying the scope dimension for rate limiting. Allowed values: "targetName", "toolName", "qualifiedModelId", or context-path expressions: "$.context.iam.principal", "$.context.iam.sourceIdentity", "$.context.jwt." where is a JWT claim name (e.g., "$.context.jwt.sub"). Validated server-side to enforce allowed prefixes and patterns.
(string) --
A dimension value in a rule entry (exact value or "*" wildcard)
requests (list) --
Request rate limits (RPS or RPM). Limited to 1 entry for now.
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
tokens (list) --
Token rate limits (TPM). Limited to 1 entry for now. — P1
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
connections (list) --
Connection rate limits (per second only). Limited to 1 entry for now. — P2
(dict) --
Rate configuration for a metric (requests or tokens)
rate (float) --
The rate value for the limit. For request limits, this is the number of requests allowed per period. For token limits, this is the number of tokens allowed per period. For connection limits, this is the number of concurrent connections allowed.
period (string) --
Time period for rate limiting
status (string) --
Status of a gateway limit
createdAt (datetime) --
The timestamp when the rate limit was created.
updatedAt (datetime) --
The timestamp when the rate limit was last updated.
Deletes a capacity provider. Before you delete a capacity provider, disassociate all agent runtimes and runtime versions that reference it. If any references remain, the operation fails.
See also: AWS API Documentation
Request Syntax
client.delete_capacity_provider(
capacityProviderId='string',
clientToken='string'
)
string
[REQUIRED]
The unique identifier of the capacity provider to delete.
string
A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If you don't specify this field, a value is randomly generated for you. If this token matches a previous request, the service ignores the request, but doesn't return an error. For more information, see Ensuring idempotency.
This field is autopopulated if not provided.
dict
Response Syntax
{
'capacityProviderId': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED'
}
Response Structure
(dict) --
capacityProviderId (string) --
The unique identifier of the deleted capacity provider.
status (string) --
The current status of the capacity provider. For possible values, see CapacityProviderStatus.
Creates a capacity provider. A capacity provider defines the Amazon EC2 infrastructure for AgentCore Runtime, including the operating system, allowed instance types, networking, and storage. It also specifies the IAM permissions that AgentCore uses to manage those instances.
The capacity provider name must be unique within your account. After you create the capacity provider, it enters a CREATING state and transitions to READY when it is available for use.
See also: AWS API Documentation
Request Syntax
client.create_capacity_provider(
name='string',
description='string',
permissionsConfiguration={
'capacityProviderOperatorRoleArn': 'string'
},
clientToken='string',
tags={
'string': 'string'
},
computeConfiguration={
'ec2Configuration': {
'launchTemplateSource': {
'launchParameters': {
'operatingSystem': 'LINUX_X86_64'|'LINUX_ARM64',
'instanceRequirements': {
'allowedInstanceTypes': [
'string',
]
},
'ephemeralVolumes': [
{
'deviceName': 'string',
'virtualName': 'string',
'ebs': {
'volumeType': 'standard'|'io1'|'io2'|'gp2'|'sc1'|'st1'|'gp3',
'iops': 123,
'throughput': 123,
'encrypted': True|False,
'kmsKeyId': 'string',
'snapshotId': 'string',
'volumeSize': 123,
'volumeInitializationRate': 123,
'ebsCardIndex': 123
}
},
],
'monitoring': 'BASIC'|'DETAILED',
'licenseSpecifications': [
{
'licenseConfigurationArn': 'string'
},
],
'capacityReservationSpecification': {
'capacityReservationPreference': 'capacity-reservations-only'|'open'|'none',
'capacityReservationTarget': {
'capacityReservationId': 'string',
'capacityReservationResourceGroupArn': 'string'
}
},
'sshKeyName': 'string',
'instanceProfileArn': 'string',
'propagatedTags': {
'string': 'string'
}
}
},
'vpcConfiguration': {
'subnets': [
'string',
],
'securityGroups': [
'string',
]
},
'volumes': [
{
'ebsConfiguration': {
'name': 'string',
'sizeGiB': 123,
'volumeType': 'standard'|'io1'|'io2'|'gp2'|'sc1'|'st1'|'gp3',
'iops': 123,
'throughput': 123,
'encrypted': True|False,
'kmsKeyId': 'string',
'snapshotId': 'string'
}
},
],
'lifecycleConfiguration': {
'idleInstanceTimeout': 123,
'maxLifetime': 123
},
'rootVolume': {
'volumeType': 'standard'|'io1'|'io2'|'gp2'|'sc1'|'st1'|'gp3',
'iops': 123,
'throughput': 123,
'encrypted': True|False,
'kmsKeyId': 'string',
'freeSpaceGiB': 123
}
}
}
)
string
[REQUIRED]
The name of the capacity provider. The name must be unique within your account.
string
An optional description of the capacity provider. If you don't specify a description, the service creates the capacity provider without one.
dict
[REQUIRED]
The permissions configuration for the capacity provider. This specifies the IAM role that AgentCore uses to manage the Amazon EC2 instances on your behalf.
capacityProviderOperatorRoleArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the IAM role that AgentCore assumes to manage the capacity provider, including launching, tagging, and terminating instances and their network interfaces. We recommend scoping this role to the minimum permissions that your workloads require.
string
A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If you don't specify this field, a value is randomly generated for you. If this token matches a previous request, the service ignores the request, but doesn't return an error. For more information, see Ensuring idempotency.
This field is autopopulated if not provided.
dict
A map of tag keys and values to associate with the capacity provider. If you don't specify tags, the capacity provider is created with no tags.
(string) --
(string) --
dict
[REQUIRED]
The compute configuration for the capacity provider. This defines the Amazon EC2 compute resources used to launch instances: the operating system, allowed instance types, networking, and storage.
ec2Configuration (dict) --
The Amazon EC2 compute configuration for the capacity provider.
launchTemplateSource (dict) -- [REQUIRED]
The source of the launch template configuration that defines how instances are launched.
launchParameters (dict) --
The parameters that AgentCore uses to create the launch template.
operatingSystem (string) -- [REQUIRED]
The operating system and CPU architecture for the instances.
instanceRequirements (dict) -- [REQUIRED]
The requirements that determine which instance types can be launched.
allowedInstanceTypes (list) -- [REQUIRED]
The list of allowed instance types. You can specify up to 30 instance types.
(string) --
ephemeralVolumes (list) --
The block device mappings for instance store (ephemeral) volumes. You can specify up to five mappings.
(dict) --
A block device mapping for an instance store (ephemeral) volume.
deviceName (string) --
The device name, for example /dev/sdh or xvdh.
virtualName (string) --
The virtual device name ( ephemeralN). Instance store volumes are numbered starting from 0. The number of available instance store volumes depends on the instance type. After you connect to the instance, you must mount the volume.
ebs (dict) --
The shared Amazon EBS performance and encryption properties for a volume. These properties are common across the different volume configurations for a capacity provider.
volumeType (string) --
The Amazon EBS volume type. If you do not specify a type, the default is gp3.
iops (integer) --
The number of IOPS to provision. For gp3, io1, and io2 volumes, this is the number of IOPS provisioned for the volume. For gp2 volumes, this sets the baseline IOPS performance. It also controls the rate at which the volume accumulates I/O credits for bursting. Supported values: gp3, 3,000–80,000; io1, 100–64,000; io2, 100–256,000.
throughput (integer) --
The throughput to provision, in MiB/s. Valid only for gp3 volumes. Valid range: 125–2,000 MiB/s.
encrypted (boolean) --
Specifies whether to encrypt the volume. Encrypted volumes can be attached only to instances that support Amazon EBS encryption. If you create a volume from a snapshot, you cannot specify an encryption value.
kmsKeyId (string) --
The identifier (key ID, key alias, key ARN, or alias ARN) of the customer managed KMS key to use for Amazon EBS encryption.
snapshotId (string) --
The ID of the snapshot.
volumeSize (integer) --
The size of the volume, in GiB. You must specify either a snapshot ID or a volume size. Supported sizes: gp2, 1–16,384; gp3, 1–65,536; io1, 4–16,384; io2, 4–65,536.
volumeInitializationRate (integer) --
The rate at which the volume is initialized after creation, in MiB/s. Supported only for volumes created from snapshots. Valid range: 100–300 MiB/s.
ebsCardIndex (integer) --
The index of the Amazon EBS card. Applies to instances with multiple Amazon EBS cards.
monitoring (string) --
The monitoring level for the instances.
licenseSpecifications (list) --
The license configurations to associate with the instances. You can specify up to five configurations.
(dict) --
A license configuration to associate with the instances.
licenseConfigurationArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the license configuration.
capacityReservationSpecification (dict) --
The Capacity Reservation targeting option for the instances.
capacityReservationPreference (string) --
The Capacity Reservation preference for the instances.
capacityReservationTarget (dict) --
The target Capacity Reservation or Capacity Reservation group for the instances.
capacityReservationId (string) --
The ID of the Capacity Reservation in which to run the instances.
capacityReservationResourceGroupArn (string) --
The Amazon Resource Name (ARN) of the Capacity Reservation resource group in which to run the instances.
sshKeyName (string) --
The name of the SSH key pair to configure on the instances for SSH connectivity.
instanceProfileArn (string) --
The Amazon Resource Name (ARN) of the IAM instance profile to associate with launched instances. If provided, this overrides the default instance profile.
propagatedTags (dict) --
The tags to propagate to all Amazon EC2 resources (instances, volumes, and network interfaces) that the capacity provider creates.
(string) --
(string) --
vpcConfiguration (dict) -- [REQUIRED]
The VPC configuration for launching instances, including subnets and security groups.
subnets (list) -- [REQUIRED]
The IDs of the subnets in which to launch instances. You must specify at least one subnet.
(string) --
securityGroups (list) -- [REQUIRED]
The IDs of the security groups to associate with the instances. You must specify at least one security group.
(string) --
volumes (list) --
The named persistent Amazon EBS volumes for the capacity provider. A capacity provider can define up to five volumes.
(dict) --
The configuration for a persistent volume attached to a capacity provider. This structure defines the storage backing for the persistent volumes used by agents that run on capacity provider instances.
ebsConfiguration (dict) --
The configuration for an Amazon EBS-backed persistent volume.
name (string) -- [REQUIRED]
The logical name of the volume. Use this name to reference the volume when you mount it into an agent runtime.
sizeGiB (integer) -- [REQUIRED]
The size of the volume, in GiB.
volumeType (string) --
The Amazon EBS volume type. If you do not specify a type, the default is gp3.
iops (integer) --
The number of IOPS to provision. Valid only for gp3, io1, and io2 volumes.
throughput (integer) --
The throughput, in MiB/s. Valid only for gp3 volumes.
encrypted (boolean) --
Specifies whether to encrypt the volume. If true, the service encrypts the volume with the KMS key that you specify in kmsKeyId, or the default KMS key for Amazon EBS if you do not specify one. The default is true.
kmsKeyId (string) --
The identifier of the KMS key to use for encryption.
snapshotId (string) --
An optional Amazon EBS snapshot ID. If provided, the volume is initialized from this snapshot the first time it is created. On subsequent restarts, the existing volume is used and the snapshot is ignored.
lifecycleConfiguration (dict) --
The lifecycle configuration for instances in the capacity provider.
idleInstanceTimeout (integer) --
The number of seconds an instance can remain idle before it is stopped. An instance is considered idle when all of its agents are idle. The default is 900 seconds (15 minutes).
maxLifetime (integer) --
The maximum lifetime of an instance, in seconds. When an instance reaches this limit, the service terminates it regardless of activity. The default is 28800 seconds (8 hours). The maximum is 1209600 seconds (14 days).
rootVolume (dict) --
The configuration for the instance root volume. Specify the amount of free space to guarantee and, optionally, the Amazon EBS performance and encryption settings. The device name and delete-on-termination behavior are not configurable.
volumeType (string) --
The Amazon EBS volume type. If you do not specify a type, the default is gp3.
iops (integer) --
The number of IOPS to provision. For gp3, io1, and io2 volumes, this is the number of IOPS provisioned for the volume. For gp2 volumes, this sets the baseline IOPS performance. It also controls the rate at which the volume accumulates I/O credits for bursting. Supported values: gp3, 3,000–80,000; io1, 100–64,000; io2, 100–256,000.
throughput (integer) --
The throughput to provision, in MiB/s. Valid only for gp3 volumes. Valid range: 125–2,000 MiB/s.
encrypted (boolean) --
Specifies whether to encrypt the volume. Encrypted volumes can be attached only to instances that support Amazon EBS encryption. If you create a volume from a snapshot, you cannot specify an encryption value.
kmsKeyId (string) --
The identifier (key ID, key alias, key ARN, or alias ARN) of the customer managed KMS key to use for Amazon EBS encryption.
freeSpaceGiB (integer) --
The free space guaranteed on the root volume, in GiB. AgentCore adds the operating system overhead on top of this value. The default is 8 GiB.
dict
Response Syntax
{
'capacityProviderId': 'string',
'capacityProviderArn': 'string',
'name': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED'
}
Response Structure
(dict) --
capacityProviderId (string) --
The unique identifier of the created capacity provider.
capacityProviderArn (string) --
The Amazon Resource Name (ARN) of the capacity provider.
name (string) --
The name of the capacity provider.
status (string) --
The current status of the capacity provider. For possible values, see CapacityProviderStatus.
Lists the agent runtime versions that are associated with a capacity provider. Use this operation to identify the runtimes you must disassociate before you can delete the capacity provider. Results are paginated; use the nextToken parameter to retrieve additional results.
See also: AWS API Documentation
Request Syntax
client.list_agent_runtime_versions_by_capacity_provider(
capacityProviderId='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The unique identifier of the capacity provider.
integer
The maximum number of results to return in the response. If the total number of results is greater than this value, use the token returned in the response in the nextToken field when making another request to return the next batch of results.
string
If the total number of results is greater than the maxResults value provided in the request, enter the token returned in the nextToken field in the response in this field to return the next batch of results.
dict
Response Syntax
{
'agentRuntimes': [
{
'agentRuntimeArn': 'string',
'agentRuntimeVersion': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
agentRuntimes (list) --
The list of agent runtime versions that are associated with the capacity provider.
(dict) --
Summary information about an agent runtime version associated with a capacity provider. This is returned by ListAgentRuntimeVersionsByCapacityProvider.
agentRuntimeArn (string) --
The Amazon Resource Name (ARN) of the agent runtime.
agentRuntimeVersion (string) --
The version of the agent runtime.
status (string) --
The current status of the agent runtime version.
nextToken (string) --
If the total number of results is greater than the maxResults value provided in the request, use this token when making another request in the nextToken field to return the next batch of results.
{'capacityProviderConfiguration': {'capacityProviderArn': 'string'},
'filesystemConfigurations': {'capacityProviderVolume': {'mountPath': 'string',
'volumeName': 'string'}}}
Creates an Amazon Bedrock AgentCore Runtime.
See also: AWS API Documentation
Request Syntax
client.create_agent_runtime(
agentRuntimeName='string',
agentRuntimeArtifact={
'containerConfiguration': {
'containerUri': 'string'
},
'codeConfiguration': {
'code': {
's3': {
'bucket': 'string',
'prefix': 'string',
'versionId': 'string'
}
},
'runtime': 'PYTHON_3_10'|'PYTHON_3_11'|'PYTHON_3_12'|'PYTHON_3_13'|'PYTHON_3_14'|'NODE_22',
'entryPoint': [
'string',
]
}
},
roleArn='string',
networkConfiguration={
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
clientToken='string',
description='string',
authorizerConfiguration={
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
requestHeaderConfiguration={
'requestHeaderAllowlist': [
'string',
]
},
protocolConfiguration={
'serverProtocol': 'MCP'|'HTTP'|'A2A'|'AGUI'
},
lifecycleConfiguration={
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
environmentVariables={
'string': 'string'
},
filesystemConfigurations=[
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
],
capacityProviderConfiguration={
'capacityProviderArn': 'string'
},
tags={
'string': 'string'
}
)
string
[REQUIRED]
The name of the AgentCore Runtime.
dict
[REQUIRED]
The artifact of the AgentCore Runtime.
containerConfiguration (dict) --
The container configuration for the agent artifact.
containerUri (string) -- [REQUIRED]
The ECR URI of the container.
codeConfiguration (dict) --
The code configuration for the agent runtime artifact, including the source code location and execution settings.
code (dict) -- [REQUIRED]
The source code location and configuration details.
s3 (dict) --
The Amazon Amazon S3 object that contains the source code for the agent runtime.
bucket (string) -- [REQUIRED]
The name of the Amazon S3 bucket. This bucket contains the stored data.
prefix (string) -- [REQUIRED]
The prefix for objects in the Amazon S3 bucket. This prefix is added to the object keys to organize the data.
versionId (string) --
The version ID of the Amazon Amazon S3 object. If not specified, the latest version of the object is used.
runtime (string) -- [REQUIRED]
The runtime environment for executing the agent code. Specify the programming language and version to use for the agent runtime. For valid values, see the list of supported runtimes.
entryPoint (list) -- [REQUIRED]
The entry point for the code execution, specifying the function or method that should be invoked when the code runs.
(string) --
string
[REQUIRED]
The IAM role ARN that provides permissions for the AgentCore Runtime.
dict
The network configuration for the AgentCore Runtime.
networkMode (string) -- [REQUIRED]
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) -- [REQUIRED]
The security groups associated with the VPC configuration.
(string) --
subnets (list) -- [REQUIRED]
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
string
A unique, case-sensitive identifier to ensure idempotency of the request.
This field is autopopulated if not provided.
string
The description of the AgentCore Runtime.
dict
The authorizer configuration for the AgentCore Runtime.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
dict
Configuration for HTTP request headers that will be passed through to the runtime.
requestHeaderAllowlist (list) --
A list of HTTP request headers that are allowed to be passed through to the runtime.
(string) --
dict
The protocol configuration for an agent runtime. This structure defines how the agent runtime communicates with clients.
serverProtocol (string) -- [REQUIRED]
The server protocol for the agent runtime. This field specifies which protocol the agent runtime uses to communicate with clients.
dict
The life cycle configuration for the AgentCore Runtime.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
dict
Environment variables to set in the AgentCore Runtime environment.
(string) --
(string) --
list
The filesystem configurations to mount into the AgentCore Runtime. Use filesystem configurations to provide persistent storage to your AgentCore Runtime sessions.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) -- [REQUIRED]
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) -- [REQUIRED]
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) -- [REQUIRED]
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
dict
The capacity provider configuration for the AgentCore Runtime. Use a capacity provider to run the AgentCore Runtime on the Instances compute type, which provisions Amazon Web Services managed compute in your account.
capacityProviderArn (string) --
The Amazon Resource Name (ARN) of the capacity provider to use for the AgentCore Runtime.
dict
A map of tag keys and values to assign to the agent runtime. Tags enable you to categorize your resources in different ways, for example, by purpose, owner, or environment.
(string) --
(string) --
dict
Response Syntax
{
'agentRuntimeArn': 'string',
'workloadIdentityDetails': {
'workloadIdentityArn': 'string'
},
'agentRuntimeId': 'string',
'agentRuntimeVersion': 'string',
'createdAt': datetime(2015, 1, 1),
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'
}
Response Structure
(dict) --
agentRuntimeArn (string) --
The Amazon Resource Name (ARN) of the AgentCore Runtime.
workloadIdentityDetails (dict) --
The workload identity details for the AgentCore Runtime.
workloadIdentityArn (string) --
The ARN associated with the workload identity.
agentRuntimeId (string) --
The unique identifier of the AgentCore Runtime.
agentRuntimeVersion (string) --
The version of the AgentCore Runtime.
createdAt (datetime) --
The timestamp when the AgentCore Runtime was created.
status (string) --
The current status of the AgentCore Runtime.
{'environment': {'agentCoreRuntimeEnvironment': {'filesystemConfigurations': {'capacityProviderVolume': {'mountPath': 'string',
'volumeName': 'string'}}}}}
Response {'harness': {'environment': {'agentCoreRuntimeEnvironment': {'filesystemConfigurations': {'capacityProviderVolume': {'mountPath': 'string',
'volumeName': 'string'}}}}}}
Operation to create a harness.
See also: AWS API Documentation
Request Syntax
client.create_harness(
harnessName='string',
clientToken='string',
executionRoleArn='string',
environment={
'agentCoreRuntimeEnvironment': {
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
]
}
},
environmentArtifact={
'containerConfiguration': {
'containerUri': 'string'
}
},
environmentVariables={
'string': 'string'
},
authorizerConfiguration={
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
model={
'bedrockModelConfig': {
'modelId': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'converse_stream'|'responses'|'chat_completions',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'openAiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'chat_completions'|'responses',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'geminiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'topK': 123,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'liteLlmModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
}
},
systemPrompt=[
{
'text': 'string'
},
],
tools=[
{
'type': 'remote_mcp'|'agentcore_browser'|'agentcore_gateway'|'inline_function'|'agentcore_code_interpreter',
'name': 'string',
'config': {
'remoteMcp': {
'url': 'string',
'headers': {
'string': 'string'
}
},
'agentCoreBrowser': {
'browserArn': 'string'
},
'agentCoreGateway': {
'gatewayArn': 'string',
'outboundAuth': {
'awsIam': {}
,
'none': {}
,
'oauth': {
'providerArn': 'string',
'scopes': [
'string',
],
'customParameters': {
'string': 'string'
},
'grantType': 'CLIENT_CREDENTIALS'|'AUTHORIZATION_CODE'|'TOKEN_EXCHANGE',
'defaultReturnUrl': 'string'
}
}
},
'inlineFunction': {
'description': 'string',
'inputSchema': {...}|[...]|123|123.4|'string'|True|None
},
'agentCoreCodeInterpreter': {
'codeInterpreterArn': 'string'
}
}
},
],
skills=[
{
'path': 'string',
's3': {
'uri': 'string'
},
'git': {
'url': 'string',
'path': 'string',
'auth': {
'credentialArn': 'string',
'username': 'string'
}
},
'awsSkills': {
'paths': [
'string',
]
}
},
],
allowedTools=[
'string',
],
memory={
'agentCoreMemoryConfiguration': {
'arn': 'string',
'actorId': 'string',
'messagesCount': 123,
'retrievalConfig': {
'string': {
'topK': 123,
'relevanceScore': ...,
'strategyId': 'string'
}
}
},
'managedMemoryConfiguration': {
'arn': 'string',
'strategies': [
'SEMANTIC'|'SUMMARIZATION'|'USER_PREFERENCE'|'EPISODIC',
],
'eventExpiryDuration': 123,
'encryptionKeyArn': 'string'
},
'disabled': {}
},
truncation={
'strategy': 'sliding_window'|'summarization'|'none',
'config': {
'slidingWindow': {
'messagesCount': 123
},
'summarization': {
'summaryRatio': ...,
'preserveRecentMessages': 123,
'summarizationSystemPrompt': 'string'
}
}
},
maxIterations=123,
maxTokens=123,
timeoutSeconds=123,
tags={
'string': 'string'
}
)
string
[REQUIRED]
The name of the harness. Must start with a letter and contain only alphanumeric characters and underscores.
string
A unique, case-sensitive identifier to ensure idempotency of the request.
This field is autopopulated if not provided.
string
[REQUIRED]
The ARN of the IAM role that the harness assumes when running. This role must have permissions for the services the agent needs to access, such as Amazon Bedrock for model invocation.
dict
The compute environment configuration for the harness, including network and lifecycle settings.
agentCoreRuntimeEnvironment (dict) --
The AgentCore Runtime environment configuration.
lifecycleConfiguration (dict) --
LifecycleConfiguration lets you manage the lifecycle of runtime sessions and resources in AgentCore Runtime. This configuration helps optimize resource utilization by automatically cleaning up idle sessions and preventing long-running instances from consuming resources indefinitely.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
networkConfiguration (dict) --
SecurityConfig for the Agent.
networkMode (string) -- [REQUIRED]
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) -- [REQUIRED]
The security groups associated with the VPC configuration.
(string) --
subnets (list) -- [REQUIRED]
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
filesystemConfigurations (list) --
The filesystem configurations for the runtime environment.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) -- [REQUIRED]
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) -- [REQUIRED]
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) -- [REQUIRED]
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
dict
The environment artifact for the harness, such as a custom container image containing additional dependencies.
containerConfiguration (dict) --
Representation of a container configuration.
containerUri (string) -- [REQUIRED]
The ECR URI of the container.
dict
Environment variables to set in the harness runtime environment.
(string) --
(string) --
dict
Represents inbound authorization configuration options used to authenticate incoming requests.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
dict
The model configuration for the harness. Supports Amazon Bedrock, OpenAI, and Google Gemini model providers.
bedrockModelConfig (dict) --
Configuration for an Amazon Bedrock model.
modelId (string) -- [REQUIRED]
The Bedrock model ID.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the Bedrock provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
openAiModelConfig (dict) --
Configuration for an OpenAI model.
modelId (string) -- [REQUIRED]
The OpenAI model ID.
apiKeyArn (string) -- [REQUIRED]
The ARN of your OpenAI API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the OpenAI provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
geminiModelConfig (dict) --
Configuration for a Google Gemini model.
modelId (string) -- [REQUIRED]
The Gemini model ID.
apiKeyArn (string) -- [REQUIRED]
The ARN of your Gemini API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
topK (integer) --
The topK set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the Gemini model provider unchanged.
liteLlmModelConfig (dict) --
The LiteLLM model configuration for connecting to third-party model providers.
modelId (string) -- [REQUIRED]
The LiteLLM model identifier (e.g., "anthropic/claude-3-sonnet").
apiKeyArn (string) --
The ARN of the API key in AgentCore Identity for authenticating with the model provider.
apiBase (string) --
The base URL for the model provider's API endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per iteration.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
list
The system prompt that defines the agent's behavior and instructions.
(dict) --
A content block in the system prompt.
text (string) --
The text content of the system prompt block.
list
The tools available to the agent, such as remote MCP servers, AgentCore Gateway, AgentCore Browser, Code Interpreter, or inline functions.
(dict) --
A tool available to the agent loop.
type (string) -- [REQUIRED]
The type of tool.
name (string) --
Unique name for the tool. If not provided, a name will be inferred or generated.
config (dict) --
Tool-specific configuration.
remoteMcp (dict) --
Configuration for remote MCP server.
url (string) -- [REQUIRED]
URL of the MCP endpoint.
headers (dict) --
Custom headers to include when connecting to the remote MCP server.
(string) --
The key of an HTTP header.
(string) --
The value of an HTTP header.
agentCoreBrowser (dict) --
Configuration for AgentCore Browser.
browserArn (string) --
If not populated, the built-in Browser ARN is used.
agentCoreGateway (dict) --
Configuration for AgentCore Gateway.
gatewayArn (string) -- [REQUIRED]
The ARN of the desired AgentCore Gateway.
outboundAuth (dict) --
How harness authenticates to this Gateway. Defaults to AWS_IAM (SigV4) if omitted.
awsIam (dict) --
SigV4-sign requests using the agent's execution role.
none (dict) --
No authentication.
oauth (dict) --
Use OAuth credentials for outbound authentication to the gateway.
providerArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the OAuth credential provider. This ARN identifies the provider in Amazon Web Services.
scopes (list) -- [REQUIRED]
The OAuth scopes for the credential provider. These scopes define the level of access requested from the OAuth provider.
(string) --
customParameters (dict) --
The custom parameters for the OAuth credential provider. These parameters provide additional configuration for the OAuth authentication process.
(string) --
(string) --
grantType (string) --
Specifies the kind of credentials to use for authorization:
CLIENT_CREDENTIALS - Authorization with a client ID and secret.
AUTHORIZATION_CODE - Authorization with a token that is specific to an individual end user.
TOKEN_EXCHANGE - Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience.
defaultReturnUrl (string) --
The URL where the end user's browser is redirected after obtaining the authorization code. Generally points to the customer's application.
inlineFunction (dict) --
Configuration for an inline function tool.
description (string) -- [REQUIRED]
Description of what the tool does, provided to the model.
inputSchema (:ref:`document<document>`) -- [REQUIRED]
JSON Schema describing the tool's input parameters.
agentCoreCodeInterpreter (dict) --
Configuration for AgentCore Code Interpreter.
codeInterpreterArn (string) --
If not populated, the built-in Code Interpreter ARN is used.
list
The skills available to the agent. Skills are bundles of files that the agent can pull into its context on demand.
(dict) --
A skill available to the agent.
path (string) --
The filesystem path to the skill definition.
s3 (dict) --
An S3 source containing the skill.
uri (string) -- [REQUIRED]
The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
git (dict) --
A git repository containing the skill.
url (string) -- [REQUIRED]
The HTTPS URL of the git repository.
path (string) --
Subdirectory within the repository containing the skill.
auth (dict) --
Authentication configuration for private repositories.
credentialArn (string) -- [REQUIRED]
The ARN of the credential in AgentCore Identity containing the password or personal access token.
username (string) --
Username for authentication. Defaults to 'oauth2' if not specified.
awsSkills (dict) --
AWS Skills baked into the harness's underlying Runtime.
paths (list) --
Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
(string) --
list
The tools that the agent is allowed to use. Supports glob patterns such as * for all tools, @builtin for all built-in tools, or @serverName/toolName for specific MCP server tools.
(string) --
dict
The AgentCore Memory configuration for persisting conversation context across sessions.
agentCoreMemoryConfiguration (dict) --
The AgentCore Memory configuration.
arn (string) -- [REQUIRED]
The ARN of the AgentCore Memory resource.
actorId (string) --
The actor ID for memory operations.
messagesCount (integer) --
The number of messages to retrieve from memory.
retrievalConfig (dict) --
The retrieval configuration for long-term memory, mapping namespace path templates to retrieval settings.
(string) --
(dict) --
Configuration for memory retrieval within a namespace.
topK (integer) --
The maximum number of memory entries to retrieve.
relevanceScore (float) --
The minimum relevance score for retrieved memories.
strategyId (string) --
The ID of the retrieval strategy to use.
managedMemoryConfiguration (dict) --
Harness creates and manages a memory resource in the customer's account.
arn (string) --
The ARN of the managed AgentCore Memory resource. Read-only on Get, ignored on Create/Update input.
strategies (list) --
Strategy types to enable. Defaults to [SEMANTIC, SUMMARIZATION].
(string) --
eventExpiryDuration (integer) --
Event retention in days. Defaults to 30.
encryptionKeyArn (string) --
Customer-managed KMS key. Defaults to AWS-owned key. Not updatable after creation.
disabled (dict) --
Explicitly opt out of memory.
dict
The truncation configuration for managing conversation context when it exceeds model limits.
strategy (string) -- [REQUIRED]
The truncation strategy to use.
config (dict) --
The strategy-specific configuration.
slidingWindow (dict) --
Configuration for sliding window truncation.
messagesCount (integer) --
The number of recent messages to retain in the context window.
summarization (dict) --
Configuration for summarization-based truncation.
summaryRatio (float) --
The ratio of content to summarize.
preserveRecentMessages (integer) --
The number of recent messages to preserve without summarization.
summarizationSystemPrompt (string) --
The system prompt used for generating summaries.
integer
The maximum number of iterations the agent loop can execute per invocation.
integer
The maximum total number of output tokens the agent can generate across all model calls within a single invocation.
integer
The maximum duration in seconds for the agent loop execution per invocation.
dict
Tags to apply to the harness resource.
(string) --
(string) --
dict
Response Syntax
{
'harness': {
'harnessId': 'string',
'harnessName': 'string',
'arn': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED',
'harnessVersion': 'string',
'executionRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'model': {
'bedrockModelConfig': {
'modelId': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'converse_stream'|'responses'|'chat_completions',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'openAiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'chat_completions'|'responses',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'geminiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'topK': 123,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'liteLlmModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
}
},
'systemPrompt': [
{
'text': 'string'
},
],
'tools': [
{
'type': 'remote_mcp'|'agentcore_browser'|'agentcore_gateway'|'inline_function'|'agentcore_code_interpreter',
'name': 'string',
'config': {
'remoteMcp': {
'url': 'string',
'headers': {
'string': 'string'
}
},
'agentCoreBrowser': {
'browserArn': 'string'
},
'agentCoreGateway': {
'gatewayArn': 'string',
'outboundAuth': {
'awsIam': {},
'none': {},
'oauth': {
'providerArn': 'string',
'scopes': [
'string',
],
'customParameters': {
'string': 'string'
},
'grantType': 'CLIENT_CREDENTIALS'|'AUTHORIZATION_CODE'|'TOKEN_EXCHANGE',
'defaultReturnUrl': 'string'
}
}
},
'inlineFunction': {
'description': 'string',
'inputSchema': {...}|[...]|123|123.4|'string'|True|None
},
'agentCoreCodeInterpreter': {
'codeInterpreterArn': 'string'
}
}
},
],
'skills': [
{
'path': 'string',
's3': {
'uri': 'string'
},
'git': {
'url': 'string',
'path': 'string',
'auth': {
'credentialArn': 'string',
'username': 'string'
}
},
'awsSkills': {
'paths': [
'string',
]
}
},
],
'allowedTools': [
'string',
],
'truncation': {
'strategy': 'sliding_window'|'summarization'|'none',
'config': {
'slidingWindow': {
'messagesCount': 123
},
'summarization': {
'summaryRatio': ...,
'preserveRecentMessages': 123,
'summarizationSystemPrompt': 'string'
}
}
},
'environment': {
'agentCoreRuntimeEnvironment': {
'agentRuntimeArn': 'string',
'agentRuntimeName': 'string',
'agentRuntimeId': 'string',
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
]
}
},
'environmentArtifact': {
'containerConfiguration': {
'containerUri': 'string'
}
},
'environmentVariables': {
'string': 'string'
},
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'memory': {
'agentCoreMemoryConfiguration': {
'arn': 'string',
'actorId': 'string',
'messagesCount': 123,
'retrievalConfig': {
'string': {
'topK': 123,
'relevanceScore': ...,
'strategyId': 'string'
}
}
},
'managedMemoryConfiguration': {
'arn': 'string',
'strategies': [
'SEMANTIC'|'SUMMARIZATION'|'USER_PREFERENCE'|'EPISODIC',
],
'eventExpiryDuration': 123,
'encryptionKeyArn': 'string'
},
'disabled': {}
},
'maxIterations': 123,
'maxTokens': 123,
'timeoutSeconds': 123,
'failureReason': 'string'
}
}
Response Structure
(dict) --
harness (dict) --
The harness that was created.
harnessId (string) --
The ID of the harness.
harnessName (string) --
The name of the harness.
arn (string) --
The ARN of the harness.
status (string) --
The status of the harness.
harnessVersion (string) --
The version of the harness. Incremented on every successful UpdateHarness.
executionRoleArn (string) --
IAM role the harness assumes when running.
createdAt (datetime) --
The createdAt time of the harness.
updatedAt (datetime) --
The updatedAt time of the harness.
model (dict) --
The configuration of the default model used by the Harness.
bedrockModelConfig (dict) --
Configuration for an Amazon Bedrock model.
modelId (string) --
The Bedrock model ID.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the Bedrock provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
openAiModelConfig (dict) --
Configuration for an OpenAI model.
modelId (string) --
The OpenAI model ID.
apiKeyArn (string) --
The ARN of your OpenAI API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the OpenAI provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
geminiModelConfig (dict) --
Configuration for a Google Gemini model.
modelId (string) --
The Gemini model ID.
apiKeyArn (string) --
The ARN of your Gemini API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
topK (integer) --
The topK set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the Gemini model provider unchanged.
liteLlmModelConfig (dict) --
The LiteLLM model configuration for connecting to third-party model providers.
modelId (string) --
The LiteLLM model identifier (e.g., "anthropic/claude-3-sonnet").
apiKeyArn (string) --
The ARN of the API key in AgentCore Identity for authenticating with the model provider.
apiBase (string) --
The base URL for the model provider's API endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per iteration.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
systemPrompt (list) --
The system prompt of the harness.
(dict) --
A content block in the system prompt.
text (string) --
The text content of the system prompt block.
tools (list) --
The tools of the harness.
(dict) --
A tool available to the agent loop.
type (string) --
The type of tool.
name (string) --
Unique name for the tool. If not provided, a name will be inferred or generated.
config (dict) --
Tool-specific configuration.
remoteMcp (dict) --
Configuration for remote MCP server.
url (string) --
URL of the MCP endpoint.
headers (dict) --
Custom headers to include when connecting to the remote MCP server.
(string) --
The key of an HTTP header.
(string) --
The value of an HTTP header.
agentCoreBrowser (dict) --
Configuration for AgentCore Browser.
browserArn (string) --
If not populated, the built-in Browser ARN is used.
agentCoreGateway (dict) --
Configuration for AgentCore Gateway.
gatewayArn (string) --
The ARN of the desired AgentCore Gateway.
outboundAuth (dict) --
How harness authenticates to this Gateway. Defaults to AWS_IAM (SigV4) if omitted.
awsIam (dict) --
SigV4-sign requests using the agent's execution role.
none (dict) --
No authentication.
oauth (dict) --
Use OAuth credentials for outbound authentication to the gateway.
providerArn (string) --
The Amazon Resource Name (ARN) of the OAuth credential provider. This ARN identifies the provider in Amazon Web Services.
scopes (list) --
The OAuth scopes for the credential provider. These scopes define the level of access requested from the OAuth provider.
(string) --
customParameters (dict) --
The custom parameters for the OAuth credential provider. These parameters provide additional configuration for the OAuth authentication process.
(string) --
(string) --
grantType (string) --
Specifies the kind of credentials to use for authorization:
CLIENT_CREDENTIALS - Authorization with a client ID and secret.
AUTHORIZATION_CODE - Authorization with a token that is specific to an individual end user.
TOKEN_EXCHANGE - Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience.
defaultReturnUrl (string) --
The URL where the end user's browser is redirected after obtaining the authorization code. Generally points to the customer's application.
inlineFunction (dict) --
Configuration for an inline function tool.
description (string) --
Description of what the tool does, provided to the model.
inputSchema (:ref:`document<document>`) --
JSON Schema describing the tool's input parameters.
agentCoreCodeInterpreter (dict) --
Configuration for AgentCore Code Interpreter.
codeInterpreterArn (string) --
If not populated, the built-in Code Interpreter ARN is used.
skills (list) --
The skills of the harness.
(dict) --
A skill available to the agent.
path (string) --
The filesystem path to the skill definition.
s3 (dict) --
An S3 source containing the skill.
uri (string) --
The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
git (dict) --
A git repository containing the skill.
url (string) --
The HTTPS URL of the git repository.
path (string) --
Subdirectory within the repository containing the skill.
auth (dict) --
Authentication configuration for private repositories.
credentialArn (string) --
The ARN of the credential in AgentCore Identity containing the password or personal access token.
username (string) --
Username for authentication. Defaults to 'oauth2' if not specified.
awsSkills (dict) --
AWS Skills baked into the harness's underlying Runtime.
paths (list) --
Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
(string) --
allowedTools (list) --
The allowed tools of the harness. All tools are allowed by default.
(string) --
truncation (dict) --
Configuration for truncating model context.
strategy (string) --
The truncation strategy to use.
config (dict) --
The strategy-specific configuration.
slidingWindow (dict) --
Configuration for sliding window truncation.
messagesCount (integer) --
The number of recent messages to retain in the context window.
summarization (dict) --
Configuration for summarization-based truncation.
summaryRatio (float) --
The ratio of content to summarize.
preserveRecentMessages (integer) --
The number of recent messages to preserve without summarization.
summarizationSystemPrompt (string) --
The system prompt used for generating summaries.
environment (dict) --
The compute environment on which the Harness runs.
agentCoreRuntimeEnvironment (dict) --
The AgentCore Runtime environment configuration.
agentRuntimeArn (string) --
The ARN of the underlying AgentCore Runtime.
agentRuntimeName (string) --
The name of the underlying AgentCore Runtime.
agentRuntimeId (string) --
The ID of the underlying AgentCore Runtime.
lifecycleConfiguration (dict) --
LifecycleConfiguration lets you manage the lifecycle of runtime sessions and resources in AgentCore Runtime. This configuration helps optimize resource utilization by automatically cleaning up idle sessions and preventing long-running instances from consuming resources indefinitely.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
networkConfiguration (dict) --
SecurityConfig for the Agent.
networkMode (string) --
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) --
The security groups associated with the VPC configuration.
(string) --
subnets (list) --
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
filesystemConfigurations (list) --
The filesystem configurations for the runtime environment.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) --
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) --
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) --
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
environmentArtifact (dict) --
The environment artifact (e.g., container) in which the Harness operates.
containerConfiguration (dict) --
Representation of a container configuration.
containerUri (string) --
The ECR URI of the container.
environmentVariables (dict) --
Environment variables exposed in the environment in which the harness operates.
(string) --
(string) --
authorizerConfiguration (dict) --
Represents inbound authorization configuration options used to authenticate incoming requests.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
memory (dict) --
AgentCore Memory instance configuration for short and long term memory.
agentCoreMemoryConfiguration (dict) --
The AgentCore Memory configuration.
arn (string) --
The ARN of the AgentCore Memory resource.
actorId (string) --
The actor ID for memory operations.
messagesCount (integer) --
The number of messages to retrieve from memory.
retrievalConfig (dict) --
The retrieval configuration for long-term memory, mapping namespace path templates to retrieval settings.
(string) --
(dict) --
Configuration for memory retrieval within a namespace.
topK (integer) --
The maximum number of memory entries to retrieve.
relevanceScore (float) --
The minimum relevance score for retrieved memories.
strategyId (string) --
The ID of the retrieval strategy to use.
managedMemoryConfiguration (dict) --
Harness creates and manages a memory resource in the customer's account.
arn (string) --
The ARN of the managed AgentCore Memory resource. Read-only on Get, ignored on Create/Update input.
strategies (list) --
Strategy types to enable. Defaults to [SEMANTIC, SUMMARIZATION].
(string) --
eventExpiryDuration (integer) --
Event retention in days. Defaults to 30.
encryptionKeyArn (string) --
Customer-managed KMS key. Defaults to AWS-owned key. Not updatable after creation.
disabled (dict) --
Explicitly opt out of memory.
maxIterations (integer) --
The maximum number of iterations in the agent loop allowed before exiting per invocation.
maxTokens (integer) --
The maximum total number of output tokens the agent can generate across all model calls within a single invocation.
timeoutSeconds (integer) --
The maximum duration per invocation.
failureReason (string) --
Reason why create or update operations fail.
{'agentRuntimeVersion': 'string'}
Deletes an Amazon Bedrock AgentCore Runtime, or a single version of an AgentCore Runtime when you provide the version qualifier.
See also: AWS API Documentation
Request Syntax
client.delete_agent_runtime(
agentRuntimeId='string',
agentRuntimeVersion='string',
clientToken='string'
)
string
[REQUIRED]
The unique identifier of the AgentCore Runtime to delete.
string
The version of the AgentCore Runtime to delete. When you provide this value, only that version is deleted. When you omit it, the entire AgentCore Runtime and all of its versions are deleted.
string
A unique, case-sensitive identifier to ensure that the operation completes no more than one time. If this token matches a previous request, the service ignores the request but does not return an error.
This field is autopopulated if not provided.
dict
Response Syntax
{
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING',
'agentRuntimeId': 'string',
'agentRuntimeVersion': 'string'
}
Response Structure
(dict) --
status (string) --
The current status of the AgentCore Runtime deletion.
agentRuntimeId (string) --
The unique identifier of the AgentCore Runtime.
agentRuntimeVersion (string) --
The version of the AgentCore Runtime that was deleted. This value is present only when you delete a single version.
{'harness': {'environment': {'agentCoreRuntimeEnvironment': {'filesystemConfigurations': {'capacityProviderVolume': {'mountPath': 'string',
'volumeName': 'string'}}}}}}
Operation to delete a Harness.
See also: AWS API Documentation
Request Syntax
client.delete_harness(
harnessId='string',
clientToken='string',
deleteManagedMemory=True|False
)
string
[REQUIRED]
The ID of the harness to delete.
string
A unique, case-sensitive identifier to ensure idempotency of the request.
This field is autopopulated if not provided.
boolean
Whether to delete the managed memory on harness deletion. Default: true. If false, the memory is disassociated and becomes a regular customer-owned resource.
dict
Response Syntax
{
'harness': {
'harnessId': 'string',
'harnessName': 'string',
'arn': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED',
'harnessVersion': 'string',
'executionRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'model': {
'bedrockModelConfig': {
'modelId': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'converse_stream'|'responses'|'chat_completions',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'openAiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'chat_completions'|'responses',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'geminiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'topK': 123,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'liteLlmModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
}
},
'systemPrompt': [
{
'text': 'string'
},
],
'tools': [
{
'type': 'remote_mcp'|'agentcore_browser'|'agentcore_gateway'|'inline_function'|'agentcore_code_interpreter',
'name': 'string',
'config': {
'remoteMcp': {
'url': 'string',
'headers': {
'string': 'string'
}
},
'agentCoreBrowser': {
'browserArn': 'string'
},
'agentCoreGateway': {
'gatewayArn': 'string',
'outboundAuth': {
'awsIam': {},
'none': {},
'oauth': {
'providerArn': 'string',
'scopes': [
'string',
],
'customParameters': {
'string': 'string'
},
'grantType': 'CLIENT_CREDENTIALS'|'AUTHORIZATION_CODE'|'TOKEN_EXCHANGE',
'defaultReturnUrl': 'string'
}
}
},
'inlineFunction': {
'description': 'string',
'inputSchema': {...}|[...]|123|123.4|'string'|True|None
},
'agentCoreCodeInterpreter': {
'codeInterpreterArn': 'string'
}
}
},
],
'skills': [
{
'path': 'string',
's3': {
'uri': 'string'
},
'git': {
'url': 'string',
'path': 'string',
'auth': {
'credentialArn': 'string',
'username': 'string'
}
},
'awsSkills': {
'paths': [
'string',
]
}
},
],
'allowedTools': [
'string',
],
'truncation': {
'strategy': 'sliding_window'|'summarization'|'none',
'config': {
'slidingWindow': {
'messagesCount': 123
},
'summarization': {
'summaryRatio': ...,
'preserveRecentMessages': 123,
'summarizationSystemPrompt': 'string'
}
}
},
'environment': {
'agentCoreRuntimeEnvironment': {
'agentRuntimeArn': 'string',
'agentRuntimeName': 'string',
'agentRuntimeId': 'string',
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
]
}
},
'environmentArtifact': {
'containerConfiguration': {
'containerUri': 'string'
}
},
'environmentVariables': {
'string': 'string'
},
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'memory': {
'agentCoreMemoryConfiguration': {
'arn': 'string',
'actorId': 'string',
'messagesCount': 123,
'retrievalConfig': {
'string': {
'topK': 123,
'relevanceScore': ...,
'strategyId': 'string'
}
}
},
'managedMemoryConfiguration': {
'arn': 'string',
'strategies': [
'SEMANTIC'|'SUMMARIZATION'|'USER_PREFERENCE'|'EPISODIC',
],
'eventExpiryDuration': 123,
'encryptionKeyArn': 'string'
},
'disabled': {}
},
'maxIterations': 123,
'maxTokens': 123,
'timeoutSeconds': 123,
'failureReason': 'string'
}
}
Response Structure
(dict) --
harness (dict) --
The harness that was deleted.
harnessId (string) --
The ID of the harness.
harnessName (string) --
The name of the harness.
arn (string) --
The ARN of the harness.
status (string) --
The status of the harness.
harnessVersion (string) --
The version of the harness. Incremented on every successful UpdateHarness.
executionRoleArn (string) --
IAM role the harness assumes when running.
createdAt (datetime) --
The createdAt time of the harness.
updatedAt (datetime) --
The updatedAt time of the harness.
model (dict) --
The configuration of the default model used by the Harness.
bedrockModelConfig (dict) --
Configuration for an Amazon Bedrock model.
modelId (string) --
The Bedrock model ID.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the Bedrock provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
openAiModelConfig (dict) --
Configuration for an OpenAI model.
modelId (string) --
The OpenAI model ID.
apiKeyArn (string) --
The ARN of your OpenAI API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the OpenAI provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
geminiModelConfig (dict) --
Configuration for a Google Gemini model.
modelId (string) --
The Gemini model ID.
apiKeyArn (string) --
The ARN of your Gemini API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
topK (integer) --
The topK set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the Gemini model provider unchanged.
liteLlmModelConfig (dict) --
The LiteLLM model configuration for connecting to third-party model providers.
modelId (string) --
The LiteLLM model identifier (e.g., "anthropic/claude-3-sonnet").
apiKeyArn (string) --
The ARN of the API key in AgentCore Identity for authenticating with the model provider.
apiBase (string) --
The base URL for the model provider's API endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per iteration.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
systemPrompt (list) --
The system prompt of the harness.
(dict) --
A content block in the system prompt.
text (string) --
The text content of the system prompt block.
tools (list) --
The tools of the harness.
(dict) --
A tool available to the agent loop.
type (string) --
The type of tool.
name (string) --
Unique name for the tool. If not provided, a name will be inferred or generated.
config (dict) --
Tool-specific configuration.
remoteMcp (dict) --
Configuration for remote MCP server.
url (string) --
URL of the MCP endpoint.
headers (dict) --
Custom headers to include when connecting to the remote MCP server.
(string) --
The key of an HTTP header.
(string) --
The value of an HTTP header.
agentCoreBrowser (dict) --
Configuration for AgentCore Browser.
browserArn (string) --
If not populated, the built-in Browser ARN is used.
agentCoreGateway (dict) --
Configuration for AgentCore Gateway.
gatewayArn (string) --
The ARN of the desired AgentCore Gateway.
outboundAuth (dict) --
How harness authenticates to this Gateway. Defaults to AWS_IAM (SigV4) if omitted.
awsIam (dict) --
SigV4-sign requests using the agent's execution role.
none (dict) --
No authentication.
oauth (dict) --
Use OAuth credentials for outbound authentication to the gateway.
providerArn (string) --
The Amazon Resource Name (ARN) of the OAuth credential provider. This ARN identifies the provider in Amazon Web Services.
scopes (list) --
The OAuth scopes for the credential provider. These scopes define the level of access requested from the OAuth provider.
(string) --
customParameters (dict) --
The custom parameters for the OAuth credential provider. These parameters provide additional configuration for the OAuth authentication process.
(string) --
(string) --
grantType (string) --
Specifies the kind of credentials to use for authorization:
CLIENT_CREDENTIALS - Authorization with a client ID and secret.
AUTHORIZATION_CODE - Authorization with a token that is specific to an individual end user.
TOKEN_EXCHANGE - Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience.
defaultReturnUrl (string) --
The URL where the end user's browser is redirected after obtaining the authorization code. Generally points to the customer's application.
inlineFunction (dict) --
Configuration for an inline function tool.
description (string) --
Description of what the tool does, provided to the model.
inputSchema (:ref:`document<document>`) --
JSON Schema describing the tool's input parameters.
agentCoreCodeInterpreter (dict) --
Configuration for AgentCore Code Interpreter.
codeInterpreterArn (string) --
If not populated, the built-in Code Interpreter ARN is used.
skills (list) --
The skills of the harness.
(dict) --
A skill available to the agent.
path (string) --
The filesystem path to the skill definition.
s3 (dict) --
An S3 source containing the skill.
uri (string) --
The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
git (dict) --
A git repository containing the skill.
url (string) --
The HTTPS URL of the git repository.
path (string) --
Subdirectory within the repository containing the skill.
auth (dict) --
Authentication configuration for private repositories.
credentialArn (string) --
The ARN of the credential in AgentCore Identity containing the password or personal access token.
username (string) --
Username for authentication. Defaults to 'oauth2' if not specified.
awsSkills (dict) --
AWS Skills baked into the harness's underlying Runtime.
paths (list) --
Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
(string) --
allowedTools (list) --
The allowed tools of the harness. All tools are allowed by default.
(string) --
truncation (dict) --
Configuration for truncating model context.
strategy (string) --
The truncation strategy to use.
config (dict) --
The strategy-specific configuration.
slidingWindow (dict) --
Configuration for sliding window truncation.
messagesCount (integer) --
The number of recent messages to retain in the context window.
summarization (dict) --
Configuration for summarization-based truncation.
summaryRatio (float) --
The ratio of content to summarize.
preserveRecentMessages (integer) --
The number of recent messages to preserve without summarization.
summarizationSystemPrompt (string) --
The system prompt used for generating summaries.
environment (dict) --
The compute environment on which the Harness runs.
agentCoreRuntimeEnvironment (dict) --
The AgentCore Runtime environment configuration.
agentRuntimeArn (string) --
The ARN of the underlying AgentCore Runtime.
agentRuntimeName (string) --
The name of the underlying AgentCore Runtime.
agentRuntimeId (string) --
The ID of the underlying AgentCore Runtime.
lifecycleConfiguration (dict) --
LifecycleConfiguration lets you manage the lifecycle of runtime sessions and resources in AgentCore Runtime. This configuration helps optimize resource utilization by automatically cleaning up idle sessions and preventing long-running instances from consuming resources indefinitely.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
networkConfiguration (dict) --
SecurityConfig for the Agent.
networkMode (string) --
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) --
The security groups associated with the VPC configuration.
(string) --
subnets (list) --
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
filesystemConfigurations (list) --
The filesystem configurations for the runtime environment.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) --
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) --
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) --
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
environmentArtifact (dict) --
The environment artifact (e.g., container) in which the Harness operates.
containerConfiguration (dict) --
Representation of a container configuration.
containerUri (string) --
The ECR URI of the container.
environmentVariables (dict) --
Environment variables exposed in the environment in which the harness operates.
(string) --
(string) --
authorizerConfiguration (dict) --
Represents inbound authorization configuration options used to authenticate incoming requests.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
memory (dict) --
AgentCore Memory instance configuration for short and long term memory.
agentCoreMemoryConfiguration (dict) --
The AgentCore Memory configuration.
arn (string) --
The ARN of the AgentCore Memory resource.
actorId (string) --
The actor ID for memory operations.
messagesCount (integer) --
The number of messages to retrieve from memory.
retrievalConfig (dict) --
The retrieval configuration for long-term memory, mapping namespace path templates to retrieval settings.
(string) --
(dict) --
Configuration for memory retrieval within a namespace.
topK (integer) --
The maximum number of memory entries to retrieve.
relevanceScore (float) --
The minimum relevance score for retrieved memories.
strategyId (string) --
The ID of the retrieval strategy to use.
managedMemoryConfiguration (dict) --
Harness creates and manages a memory resource in the customer's account.
arn (string) --
The ARN of the managed AgentCore Memory resource. Read-only on Get, ignored on Create/Update input.
strategies (list) --
Strategy types to enable. Defaults to [SEMANTIC, SUMMARIZATION].
(string) --
eventExpiryDuration (integer) --
Event retention in days. Defaults to 30.
encryptionKeyArn (string) --
Customer-managed KMS key. Defaults to AWS-owned key. Not updatable after creation.
disabled (dict) --
Explicitly opt out of memory.
maxIterations (integer) --
The maximum number of iterations in the agent loop allowed before exiting per invocation.
maxTokens (integer) --
The maximum total number of output tokens the agent can generate across all model calls within a single invocation.
timeoutSeconds (integer) --
The maximum duration per invocation.
failureReason (string) --
Reason why create or update operations fail.
{'capacityProviderConfiguration': {'capacityProviderArn': 'string'},
'filesystemConfigurations': {'capacityProviderVolume': {'mountPath': 'string',
'volumeName': 'string'}}}
Gets an Amazon Bedrock AgentCore Runtime.
See also: AWS API Documentation
Request Syntax
client.get_agent_runtime(
agentRuntimeId='string',
agentRuntimeVersion='string'
)
string
[REQUIRED]
The unique identifier of the AgentCore Runtime to retrieve.
string
The version of the AgentCore Runtime to retrieve.
dict
Response Syntax
{
'agentRuntimeArn': 'string',
'agentRuntimeName': 'string',
'agentRuntimeId': 'string',
'agentRuntimeVersion': 'string',
'createdAt': datetime(2015, 1, 1),
'lastUpdatedAt': datetime(2015, 1, 1),
'roleArn': 'string',
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING',
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'failureReason': 'string',
'description': 'string',
'workloadIdentityDetails': {
'workloadIdentityArn': 'string'
},
'agentRuntimeArtifact': {
'containerConfiguration': {
'containerUri': 'string'
},
'codeConfiguration': {
'code': {
's3': {
'bucket': 'string',
'prefix': 'string',
'versionId': 'string'
}
},
'runtime': 'PYTHON_3_10'|'PYTHON_3_11'|'PYTHON_3_12'|'PYTHON_3_13'|'PYTHON_3_14'|'NODE_22',
'entryPoint': [
'string',
]
}
},
'protocolConfiguration': {
'serverProtocol': 'MCP'|'HTTP'|'A2A'|'AGUI'
},
'environmentVariables': {
'string': 'string'
},
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'requestHeaderConfiguration': {
'requestHeaderAllowlist': [
'string',
]
},
'metadataConfiguration': {
'requireMMDSV2': True|False
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
],
'capacityProviderConfiguration': {
'capacityProviderArn': 'string'
}
}
Response Structure
(dict) --
agentRuntimeArn (string) --
The Amazon Resource Name (ARN) of the AgentCore Runtime.
agentRuntimeName (string) --
The name of the AgentCore Runtime.
agentRuntimeId (string) --
The unique identifier of the AgentCore Runtime.
agentRuntimeVersion (string) --
The version of the AgentCore Runtime.
createdAt (datetime) --
The timestamp when the AgentCore Runtime was created.
lastUpdatedAt (datetime) --
The timestamp when the AgentCore Runtime was last updated.
roleArn (string) --
The IAM role ARN that provides permissions for the AgentCore Runtime.
networkConfiguration (dict) --
The network configuration for the AgentCore Runtime.
networkMode (string) --
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) --
The security groups associated with the VPC configuration.
(string) --
subnets (list) --
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
status (string) --
The current status of the AgentCore Runtime.
lifecycleConfiguration (dict) --
The life cycle configuration for the AgentCore Runtime.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
failureReason (string) --
The reason for failure if the AgentCore Runtime is in a failed state.
description (string) --
The description of the AgentCore Runtime.
workloadIdentityDetails (dict) --
The workload identity details for the AgentCore Runtime.
workloadIdentityArn (string) --
The ARN associated with the workload identity.
agentRuntimeArtifact (dict) --
The artifact of the AgentCore Runtime.
containerConfiguration (dict) --
The container configuration for the agent artifact.
containerUri (string) --
The ECR URI of the container.
codeConfiguration (dict) --
The code configuration for the agent runtime artifact, including the source code location and execution settings.
code (dict) --
The source code location and configuration details.
s3 (dict) --
The Amazon Amazon S3 object that contains the source code for the agent runtime.
bucket (string) --
The name of the Amazon S3 bucket. This bucket contains the stored data.
prefix (string) --
The prefix for objects in the Amazon S3 bucket. This prefix is added to the object keys to organize the data.
versionId (string) --
The version ID of the Amazon Amazon S3 object. If not specified, the latest version of the object is used.
runtime (string) --
The runtime environment for executing the agent code. Specify the programming language and version to use for the agent runtime. For valid values, see the list of supported runtimes.
entryPoint (list) --
The entry point for the code execution, specifying the function or method that should be invoked when the code runs.
(string) --
protocolConfiguration (dict) --
The protocol configuration for an agent runtime. This structure defines how the agent runtime communicates with clients.
serverProtocol (string) --
The server protocol for the agent runtime. This field specifies which protocol the agent runtime uses to communicate with clients.
environmentVariables (dict) --
Environment variables set in the AgentCore Runtime environment.
(string) --
(string) --
authorizerConfiguration (dict) --
The authorizer configuration for the AgentCore Runtime.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
requestHeaderConfiguration (dict) --
Configuration for HTTP request headers that will be passed through to the runtime.
requestHeaderAllowlist (list) --
A list of HTTP request headers that are allowed to be passed through to the runtime.
(string) --
metadataConfiguration (dict) --
Configuration for microVM Metadata Service (MMDS) settings for the AgentCore Runtime.
requireMMDSV2 (boolean) --
Enables MMDSv2 (microVM Metadata Service Version 2) requirement for the agent runtime. When set to true, the runtime microVM will only accept MMDSv2 requests.
filesystemConfigurations (list) --
The filesystem configurations mounted into the AgentCore Runtime.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) --
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) --
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) --
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderConfiguration (dict) --
The capacity provider configuration for the AgentCore Runtime.
capacityProviderArn (string) --
The Amazon Resource Name (ARN) of the capacity provider to use for the AgentCore Runtime.
{'harness': {'environment': {'agentCoreRuntimeEnvironment': {'filesystemConfigurations': {'capacityProviderVolume': {'mountPath': 'string',
'volumeName': 'string'}}}}}}
Operation to get a single harness.
See also: AWS API Documentation
Request Syntax
client.get_harness(
harnessId='string',
harnessVersion='string'
)
string
[REQUIRED]
The ID of the harness to retrieve.
string
Specific version of the harness to retrieve. If omitted, returns the current Harness configuration, including its status.
dict
Response Syntax
{
'harness': {
'harnessId': 'string',
'harnessName': 'string',
'arn': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED',
'harnessVersion': 'string',
'executionRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'model': {
'bedrockModelConfig': {
'modelId': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'converse_stream'|'responses'|'chat_completions',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'openAiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'chat_completions'|'responses',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'geminiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'topK': 123,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'liteLlmModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
}
},
'systemPrompt': [
{
'text': 'string'
},
],
'tools': [
{
'type': 'remote_mcp'|'agentcore_browser'|'agentcore_gateway'|'inline_function'|'agentcore_code_interpreter',
'name': 'string',
'config': {
'remoteMcp': {
'url': 'string',
'headers': {
'string': 'string'
}
},
'agentCoreBrowser': {
'browserArn': 'string'
},
'agentCoreGateway': {
'gatewayArn': 'string',
'outboundAuth': {
'awsIam': {},
'none': {},
'oauth': {
'providerArn': 'string',
'scopes': [
'string',
],
'customParameters': {
'string': 'string'
},
'grantType': 'CLIENT_CREDENTIALS'|'AUTHORIZATION_CODE'|'TOKEN_EXCHANGE',
'defaultReturnUrl': 'string'
}
}
},
'inlineFunction': {
'description': 'string',
'inputSchema': {...}|[...]|123|123.4|'string'|True|None
},
'agentCoreCodeInterpreter': {
'codeInterpreterArn': 'string'
}
}
},
],
'skills': [
{
'path': 'string',
's3': {
'uri': 'string'
},
'git': {
'url': 'string',
'path': 'string',
'auth': {
'credentialArn': 'string',
'username': 'string'
}
},
'awsSkills': {
'paths': [
'string',
]
}
},
],
'allowedTools': [
'string',
],
'truncation': {
'strategy': 'sliding_window'|'summarization'|'none',
'config': {
'slidingWindow': {
'messagesCount': 123
},
'summarization': {
'summaryRatio': ...,
'preserveRecentMessages': 123,
'summarizationSystemPrompt': 'string'
}
}
},
'environment': {
'agentCoreRuntimeEnvironment': {
'agentRuntimeArn': 'string',
'agentRuntimeName': 'string',
'agentRuntimeId': 'string',
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
]
}
},
'environmentArtifact': {
'containerConfiguration': {
'containerUri': 'string'
}
},
'environmentVariables': {
'string': 'string'
},
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'memory': {
'agentCoreMemoryConfiguration': {
'arn': 'string',
'actorId': 'string',
'messagesCount': 123,
'retrievalConfig': {
'string': {
'topK': 123,
'relevanceScore': ...,
'strategyId': 'string'
}
}
},
'managedMemoryConfiguration': {
'arn': 'string',
'strategies': [
'SEMANTIC'|'SUMMARIZATION'|'USER_PREFERENCE'|'EPISODIC',
],
'eventExpiryDuration': 123,
'encryptionKeyArn': 'string'
},
'disabled': {}
},
'maxIterations': 123,
'maxTokens': 123,
'timeoutSeconds': 123,
'failureReason': 'string'
}
}
Response Structure
(dict) --
harness (dict) --
The harness resource.
harnessId (string) --
The ID of the harness.
harnessName (string) --
The name of the harness.
arn (string) --
The ARN of the harness.
status (string) --
The status of the harness.
harnessVersion (string) --
The version of the harness. Incremented on every successful UpdateHarness.
executionRoleArn (string) --
IAM role the harness assumes when running.
createdAt (datetime) --
The createdAt time of the harness.
updatedAt (datetime) --
The updatedAt time of the harness.
model (dict) --
The configuration of the default model used by the Harness.
bedrockModelConfig (dict) --
Configuration for an Amazon Bedrock model.
modelId (string) --
The Bedrock model ID.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the Bedrock provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
openAiModelConfig (dict) --
Configuration for an OpenAI model.
modelId (string) --
The OpenAI model ID.
apiKeyArn (string) --
The ARN of your OpenAI API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the OpenAI provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
geminiModelConfig (dict) --
Configuration for a Google Gemini model.
modelId (string) --
The Gemini model ID.
apiKeyArn (string) --
The ARN of your Gemini API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
topK (integer) --
The topK set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the Gemini model provider unchanged.
liteLlmModelConfig (dict) --
The LiteLLM model configuration for connecting to third-party model providers.
modelId (string) --
The LiteLLM model identifier (e.g., "anthropic/claude-3-sonnet").
apiKeyArn (string) --
The ARN of the API key in AgentCore Identity for authenticating with the model provider.
apiBase (string) --
The base URL for the model provider's API endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per iteration.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
systemPrompt (list) --
The system prompt of the harness.
(dict) --
A content block in the system prompt.
text (string) --
The text content of the system prompt block.
tools (list) --
The tools of the harness.
(dict) --
A tool available to the agent loop.
type (string) --
The type of tool.
name (string) --
Unique name for the tool. If not provided, a name will be inferred or generated.
config (dict) --
Tool-specific configuration.
remoteMcp (dict) --
Configuration for remote MCP server.
url (string) --
URL of the MCP endpoint.
headers (dict) --
Custom headers to include when connecting to the remote MCP server.
(string) --
The key of an HTTP header.
(string) --
The value of an HTTP header.
agentCoreBrowser (dict) --
Configuration for AgentCore Browser.
browserArn (string) --
If not populated, the built-in Browser ARN is used.
agentCoreGateway (dict) --
Configuration for AgentCore Gateway.
gatewayArn (string) --
The ARN of the desired AgentCore Gateway.
outboundAuth (dict) --
How harness authenticates to this Gateway. Defaults to AWS_IAM (SigV4) if omitted.
awsIam (dict) --
SigV4-sign requests using the agent's execution role.
none (dict) --
No authentication.
oauth (dict) --
Use OAuth credentials for outbound authentication to the gateway.
providerArn (string) --
The Amazon Resource Name (ARN) of the OAuth credential provider. This ARN identifies the provider in Amazon Web Services.
scopes (list) --
The OAuth scopes for the credential provider. These scopes define the level of access requested from the OAuth provider.
(string) --
customParameters (dict) --
The custom parameters for the OAuth credential provider. These parameters provide additional configuration for the OAuth authentication process.
(string) --
(string) --
grantType (string) --
Specifies the kind of credentials to use for authorization:
CLIENT_CREDENTIALS - Authorization with a client ID and secret.
AUTHORIZATION_CODE - Authorization with a token that is specific to an individual end user.
TOKEN_EXCHANGE - Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience.
defaultReturnUrl (string) --
The URL where the end user's browser is redirected after obtaining the authorization code. Generally points to the customer's application.
inlineFunction (dict) --
Configuration for an inline function tool.
description (string) --
Description of what the tool does, provided to the model.
inputSchema (:ref:`document<document>`) --
JSON Schema describing the tool's input parameters.
agentCoreCodeInterpreter (dict) --
Configuration for AgentCore Code Interpreter.
codeInterpreterArn (string) --
If not populated, the built-in Code Interpreter ARN is used.
skills (list) --
The skills of the harness.
(dict) --
A skill available to the agent.
path (string) --
The filesystem path to the skill definition.
s3 (dict) --
An S3 source containing the skill.
uri (string) --
The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
git (dict) --
A git repository containing the skill.
url (string) --
The HTTPS URL of the git repository.
path (string) --
Subdirectory within the repository containing the skill.
auth (dict) --
Authentication configuration for private repositories.
credentialArn (string) --
The ARN of the credential in AgentCore Identity containing the password or personal access token.
username (string) --
Username for authentication. Defaults to 'oauth2' if not specified.
awsSkills (dict) --
AWS Skills baked into the harness's underlying Runtime.
paths (list) --
Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
(string) --
allowedTools (list) --
The allowed tools of the harness. All tools are allowed by default.
(string) --
truncation (dict) --
Configuration for truncating model context.
strategy (string) --
The truncation strategy to use.
config (dict) --
The strategy-specific configuration.
slidingWindow (dict) --
Configuration for sliding window truncation.
messagesCount (integer) --
The number of recent messages to retain in the context window.
summarization (dict) --
Configuration for summarization-based truncation.
summaryRatio (float) --
The ratio of content to summarize.
preserveRecentMessages (integer) --
The number of recent messages to preserve without summarization.
summarizationSystemPrompt (string) --
The system prompt used for generating summaries.
environment (dict) --
The compute environment on which the Harness runs.
agentCoreRuntimeEnvironment (dict) --
The AgentCore Runtime environment configuration.
agentRuntimeArn (string) --
The ARN of the underlying AgentCore Runtime.
agentRuntimeName (string) --
The name of the underlying AgentCore Runtime.
agentRuntimeId (string) --
The ID of the underlying AgentCore Runtime.
lifecycleConfiguration (dict) --
LifecycleConfiguration lets you manage the lifecycle of runtime sessions and resources in AgentCore Runtime. This configuration helps optimize resource utilization by automatically cleaning up idle sessions and preventing long-running instances from consuming resources indefinitely.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
networkConfiguration (dict) --
SecurityConfig for the Agent.
networkMode (string) --
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) --
The security groups associated with the VPC configuration.
(string) --
subnets (list) --
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
filesystemConfigurations (list) --
The filesystem configurations for the runtime environment.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) --
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) --
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) --
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
environmentArtifact (dict) --
The environment artifact (e.g., container) in which the Harness operates.
containerConfiguration (dict) --
Representation of a container configuration.
containerUri (string) --
The ECR URI of the container.
environmentVariables (dict) --
Environment variables exposed in the environment in which the harness operates.
(string) --
(string) --
authorizerConfiguration (dict) --
Represents inbound authorization configuration options used to authenticate incoming requests.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
memory (dict) --
AgentCore Memory instance configuration for short and long term memory.
agentCoreMemoryConfiguration (dict) --
The AgentCore Memory configuration.
arn (string) --
The ARN of the AgentCore Memory resource.
actorId (string) --
The actor ID for memory operations.
messagesCount (integer) --
The number of messages to retrieve from memory.
retrievalConfig (dict) --
The retrieval configuration for long-term memory, mapping namespace path templates to retrieval settings.
(string) --
(dict) --
Configuration for memory retrieval within a namespace.
topK (integer) --
The maximum number of memory entries to retrieve.
relevanceScore (float) --
The minimum relevance score for retrieved memories.
strategyId (string) --
The ID of the retrieval strategy to use.
managedMemoryConfiguration (dict) --
Harness creates and manages a memory resource in the customer's account.
arn (string) --
The ARN of the managed AgentCore Memory resource. Read-only on Get, ignored on Create/Update input.
strategies (list) --
Strategy types to enable. Defaults to [SEMANTIC, SUMMARIZATION].
(string) --
eventExpiryDuration (integer) --
Event retention in days. Defaults to 30.
encryptionKeyArn (string) --
Customer-managed KMS key. Defaults to AWS-owned key. Not updatable after creation.
disabled (dict) --
Explicitly opt out of memory.
maxIterations (integer) --
The maximum number of iterations in the agent loop allowed before exiting per invocation.
maxTokens (integer) --
The maximum total number of output tokens the agent can generate across all model calls within a single invocation.
timeoutSeconds (integer) --
The maximum duration per invocation.
failureReason (string) --
Reason why create or update operations fail.
{'capacityProviderConfiguration': {'capacityProviderArn': 'string'},
'filesystemConfigurations': {'capacityProviderVolume': {'mountPath': 'string',
'volumeName': 'string'}}}
Updates an existing Amazon Secure Agent.
See also: AWS API Documentation
Request Syntax
client.update_agent_runtime(
agentRuntimeId='string',
agentRuntimeArtifact={
'containerConfiguration': {
'containerUri': 'string'
},
'codeConfiguration': {
'code': {
's3': {
'bucket': 'string',
'prefix': 'string',
'versionId': 'string'
}
},
'runtime': 'PYTHON_3_10'|'PYTHON_3_11'|'PYTHON_3_12'|'PYTHON_3_13'|'PYTHON_3_14'|'NODE_22',
'entryPoint': [
'string',
]
}
},
roleArn='string',
networkConfiguration={
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
description='string',
authorizerConfiguration={
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
requestHeaderConfiguration={
'requestHeaderAllowlist': [
'string',
]
},
protocolConfiguration={
'serverProtocol': 'MCP'|'HTTP'|'A2A'|'AGUI'
},
lifecycleConfiguration={
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
metadataConfiguration={
'requireMMDSV2': True|False
},
environmentVariables={
'string': 'string'
},
filesystemConfigurations=[
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
],
capacityProviderConfiguration={
'capacityProviderArn': 'string'
},
clientToken='string'
)
string
[REQUIRED]
The unique identifier of the AgentCore Runtime to update.
dict
[REQUIRED]
The updated artifact of the AgentCore Runtime.
containerConfiguration (dict) --
The container configuration for the agent artifact.
containerUri (string) -- [REQUIRED]
The ECR URI of the container.
codeConfiguration (dict) --
The code configuration for the agent runtime artifact, including the source code location and execution settings.
code (dict) -- [REQUIRED]
The source code location and configuration details.
s3 (dict) --
The Amazon Amazon S3 object that contains the source code for the agent runtime.
bucket (string) -- [REQUIRED]
The name of the Amazon S3 bucket. This bucket contains the stored data.
prefix (string) -- [REQUIRED]
The prefix for objects in the Amazon S3 bucket. This prefix is added to the object keys to organize the data.
versionId (string) --
The version ID of the Amazon Amazon S3 object. If not specified, the latest version of the object is used.
runtime (string) -- [REQUIRED]
The runtime environment for executing the agent code. Specify the programming language and version to use for the agent runtime. For valid values, see the list of supported runtimes.
entryPoint (list) -- [REQUIRED]
The entry point for the code execution, specifying the function or method that should be invoked when the code runs.
(string) --
string
[REQUIRED]
The updated IAM role ARN that provides permissions for the AgentCore Runtime.
dict
The updated network configuration for the AgentCore Runtime.
networkMode (string) -- [REQUIRED]
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) -- [REQUIRED]
The security groups associated with the VPC configuration.
(string) --
subnets (list) -- [REQUIRED]
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
string
The updated description of the AgentCore Runtime.
dict
The updated authorizer configuration for the AgentCore Runtime.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
dict
The updated configuration for HTTP request headers that will be passed through to the runtime.
requestHeaderAllowlist (list) --
A list of HTTP request headers that are allowed to be passed through to the runtime.
(string) --
dict
The protocol configuration for an agent runtime. This structure defines how the agent runtime communicates with clients.
serverProtocol (string) -- [REQUIRED]
The server protocol for the agent runtime. This field specifies which protocol the agent runtime uses to communicate with clients.
dict
The updated life cycle configuration for the AgentCore Runtime.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
dict
The updated configuration for microVM Metadata Service (MMDS) settings for the AgentCore Runtime.
requireMMDSV2 (boolean) -- [REQUIRED]
Enables MMDSv2 (microVM Metadata Service Version 2) requirement for the agent runtime. When set to true, the runtime microVM will only accept MMDSv2 requests.
dict
Updated environment variables to set in the AgentCore Runtime environment.
(string) --
(string) --
list
The updated filesystem configurations to mount into the AgentCore Runtime.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) -- [REQUIRED]
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) -- [REQUIRED]
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) -- [REQUIRED]
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
dict
The updated capacity provider configuration for the AgentCore Runtime.
capacityProviderArn (string) --
The Amazon Resource Name (ARN) of the capacity provider to use for the AgentCore Runtime.
string
A unique, case-sensitive identifier to ensure idempotency of the request.
This field is autopopulated if not provided.
dict
Response Syntax
{
'agentRuntimeArn': 'string',
'agentRuntimeId': 'string',
'workloadIdentityDetails': {
'workloadIdentityArn': 'string'
},
'agentRuntimeVersion': 'string',
'createdAt': datetime(2015, 1, 1),
'lastUpdatedAt': datetime(2015, 1, 1),
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'
}
Response Structure
(dict) --
agentRuntimeArn (string) --
The Amazon Resource Name (ARN) of the updated AgentCore Runtime.
agentRuntimeId (string) --
The unique identifier of the updated AgentCore Runtime.
workloadIdentityDetails (dict) --
The workload identity details for the updated AgentCore Runtime.
workloadIdentityArn (string) --
The ARN associated with the workload identity.
agentRuntimeVersion (string) --
The version of the updated AgentCore Runtime.
createdAt (datetime) --
The timestamp when the AgentCore Runtime was created.
lastUpdatedAt (datetime) --
The timestamp when the AgentCore Runtime was last updated.
status (string) --
The current status of the updated AgentCore Runtime.
{'environment': {'agentCoreRuntimeEnvironment': {'filesystemConfigurations': {'capacityProviderVolume': {'mountPath': 'string',
'volumeName': 'string'}}}}}
Response {'harness': {'environment': {'agentCoreRuntimeEnvironment': {'filesystemConfigurations': {'capacityProviderVolume': {'mountPath': 'string',
'volumeName': 'string'}}}}}}
Operation to update a harness.
See also: AWS API Documentation
Request Syntax
client.update_harness(
harnessId='string',
clientToken='string',
executionRoleArn='string',
environment={
'agentCoreRuntimeEnvironment': {
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
]
}
},
environmentArtifact={
'optionalValue': {
'containerConfiguration': {
'containerUri': 'string'
}
}
},
environmentVariables={
'string': 'string'
},
authorizerConfiguration={
'optionalValue': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
}
},
model={
'bedrockModelConfig': {
'modelId': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'converse_stream'|'responses'|'chat_completions',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'openAiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'chat_completions'|'responses',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'geminiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'topK': 123,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'liteLlmModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
}
},
systemPrompt=[
{
'text': 'string'
},
],
tools=[
{
'type': 'remote_mcp'|'agentcore_browser'|'agentcore_gateway'|'inline_function'|'agentcore_code_interpreter',
'name': 'string',
'config': {
'remoteMcp': {
'url': 'string',
'headers': {
'string': 'string'
}
},
'agentCoreBrowser': {
'browserArn': 'string'
},
'agentCoreGateway': {
'gatewayArn': 'string',
'outboundAuth': {
'awsIam': {}
,
'none': {}
,
'oauth': {
'providerArn': 'string',
'scopes': [
'string',
],
'customParameters': {
'string': 'string'
},
'grantType': 'CLIENT_CREDENTIALS'|'AUTHORIZATION_CODE'|'TOKEN_EXCHANGE',
'defaultReturnUrl': 'string'
}
}
},
'inlineFunction': {
'description': 'string',
'inputSchema': {...}|[...]|123|123.4|'string'|True|None
},
'agentCoreCodeInterpreter': {
'codeInterpreterArn': 'string'
}
}
},
],
skills=[
{
'path': 'string',
's3': {
'uri': 'string'
},
'git': {
'url': 'string',
'path': 'string',
'auth': {
'credentialArn': 'string',
'username': 'string'
}
},
'awsSkills': {
'paths': [
'string',
]
}
},
],
allowedTools=[
'string',
],
memory={
'optionalValue': {
'agentCoreMemoryConfiguration': {
'arn': 'string',
'actorId': 'string',
'messagesCount': 123,
'retrievalConfig': {
'string': {
'topK': 123,
'relevanceScore': ...,
'strategyId': 'string'
}
}
},
'managedMemoryConfiguration': {
'arn': 'string',
'strategies': [
'SEMANTIC'|'SUMMARIZATION'|'USER_PREFERENCE'|'EPISODIC',
],
'eventExpiryDuration': 123,
'encryptionKeyArn': 'string'
},
'disabled': {}
}
},
truncation={
'strategy': 'sliding_window'|'summarization'|'none',
'config': {
'slidingWindow': {
'messagesCount': 123
},
'summarization': {
'summaryRatio': ...,
'preserveRecentMessages': 123,
'summarizationSystemPrompt': 'string'
}
}
},
maxIterations=123,
maxTokens=123,
timeoutSeconds=123
)
string
[REQUIRED]
The ID of the harness to update.
string
A unique, case-sensitive identifier to ensure idempotency of the request.
This field is autopopulated if not provided.
string
The ARN of the IAM role that the harness assumes when running. If not specified, the existing value is retained.
dict
The compute environment configuration for the harness. If not specified, the existing value is retained.
agentCoreRuntimeEnvironment (dict) --
The AgentCore Runtime environment configuration.
lifecycleConfiguration (dict) --
LifecycleConfiguration lets you manage the lifecycle of runtime sessions and resources in AgentCore Runtime. This configuration helps optimize resource utilization by automatically cleaning up idle sessions and preventing long-running instances from consuming resources indefinitely.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
networkConfiguration (dict) --
SecurityConfig for the Agent.
networkMode (string) -- [REQUIRED]
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) -- [REQUIRED]
The security groups associated with the VPC configuration.
(string) --
subnets (list) -- [REQUIRED]
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
filesystemConfigurations (list) --
The filesystem configurations for the runtime environment.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) -- [REQUIRED]
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) -- [REQUIRED]
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) -- [REQUIRED]
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
dict
The environment artifact for the harness. Use the optionalValue wrapper to set a new value, or set it to null to clear the existing configuration.
optionalValue (dict) --
The updated environment artifact value, or null to clear the existing configuration.
containerConfiguration (dict) --
Representation of a container configuration.
containerUri (string) -- [REQUIRED]
The ECR URI of the container.
dict
Environment variables to set in the harness runtime environment. If specified, this replaces all existing environment variables. If not specified, the existing value is retained.
(string) --
(string) --
dict
Wrapper for updating an optional AuthorizerConfiguration field with PATCH semantics. When present in an update request, the authorizer configuration is replaced with optionalValue. When absent, the authorizer configuration is left unchanged. To unset, include the wrapper with optionalValue not specified.
optionalValue (dict) --
The updated authorizer configuration value. If not specified, it will clear the current authorizer configuration of the resource.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
dict
The model configuration for the harness. If not specified, the existing value is retained.
bedrockModelConfig (dict) --
Configuration for an Amazon Bedrock model.
modelId (string) -- [REQUIRED]
The Bedrock model ID.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the Bedrock provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
openAiModelConfig (dict) --
Configuration for an OpenAI model.
modelId (string) -- [REQUIRED]
The OpenAI model ID.
apiKeyArn (string) -- [REQUIRED]
The ARN of your OpenAI API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the OpenAI provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
geminiModelConfig (dict) --
Configuration for a Google Gemini model.
modelId (string) -- [REQUIRED]
The Gemini model ID.
apiKeyArn (string) -- [REQUIRED]
The ARN of your Gemini API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
topK (integer) --
The topK set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the Gemini model provider unchanged.
liteLlmModelConfig (dict) --
The LiteLLM model configuration for connecting to third-party model providers.
modelId (string) -- [REQUIRED]
The LiteLLM model identifier (e.g., "anthropic/claude-3-sonnet").
apiKeyArn (string) --
The ARN of the API key in AgentCore Identity for authenticating with the model provider.
apiBase (string) --
The base URL for the model provider's API endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per iteration.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
list
The system prompt that defines the agent's behavior. If not specified, the existing value is retained.
(dict) --
A content block in the system prompt.
text (string) --
The text content of the system prompt block.
list
The tools available to the agent. If specified, this replaces all existing tools. If not specified, the existing value is retained.
(dict) --
A tool available to the agent loop.
type (string) -- [REQUIRED]
The type of tool.
name (string) --
Unique name for the tool. If not provided, a name will be inferred or generated.
config (dict) --
Tool-specific configuration.
remoteMcp (dict) --
Configuration for remote MCP server.
url (string) -- [REQUIRED]
URL of the MCP endpoint.
headers (dict) --
Custom headers to include when connecting to the remote MCP server.
(string) --
The key of an HTTP header.
(string) --
The value of an HTTP header.
agentCoreBrowser (dict) --
Configuration for AgentCore Browser.
browserArn (string) --
If not populated, the built-in Browser ARN is used.
agentCoreGateway (dict) --
Configuration for AgentCore Gateway.
gatewayArn (string) -- [REQUIRED]
The ARN of the desired AgentCore Gateway.
outboundAuth (dict) --
How harness authenticates to this Gateway. Defaults to AWS_IAM (SigV4) if omitted.
awsIam (dict) --
SigV4-sign requests using the agent's execution role.
none (dict) --
No authentication.
oauth (dict) --
Use OAuth credentials for outbound authentication to the gateway.
providerArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the OAuth credential provider. This ARN identifies the provider in Amazon Web Services.
scopes (list) -- [REQUIRED]
The OAuth scopes for the credential provider. These scopes define the level of access requested from the OAuth provider.
(string) --
customParameters (dict) --
The custom parameters for the OAuth credential provider. These parameters provide additional configuration for the OAuth authentication process.
(string) --
(string) --
grantType (string) --
Specifies the kind of credentials to use for authorization:
CLIENT_CREDENTIALS - Authorization with a client ID and secret.
AUTHORIZATION_CODE - Authorization with a token that is specific to an individual end user.
TOKEN_EXCHANGE - Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience.
defaultReturnUrl (string) --
The URL where the end user's browser is redirected after obtaining the authorization code. Generally points to the customer's application.
inlineFunction (dict) --
Configuration for an inline function tool.
description (string) -- [REQUIRED]
Description of what the tool does, provided to the model.
inputSchema (:ref:`document<document>`) -- [REQUIRED]
JSON Schema describing the tool's input parameters.
agentCoreCodeInterpreter (dict) --
Configuration for AgentCore Code Interpreter.
codeInterpreterArn (string) --
If not populated, the built-in Code Interpreter ARN is used.
list
The skills available to the agent. If specified, this replaces all existing skills. If not specified, the existing value is retained.
(dict) --
A skill available to the agent.
path (string) --
The filesystem path to the skill definition.
s3 (dict) --
An S3 source containing the skill.
uri (string) -- [REQUIRED]
The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
git (dict) --
A git repository containing the skill.
url (string) -- [REQUIRED]
The HTTPS URL of the git repository.
path (string) --
Subdirectory within the repository containing the skill.
auth (dict) --
Authentication configuration for private repositories.
credentialArn (string) -- [REQUIRED]
The ARN of the credential in AgentCore Identity containing the password or personal access token.
username (string) --
Username for authentication. Defaults to 'oauth2' if not specified.
awsSkills (dict) --
AWS Skills baked into the harness's underlying Runtime.
paths (list) --
Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
(string) --
list
The tools that the agent is allowed to use. If specified, this replaces all existing allowed tools. If not specified, the existing value is retained.
(string) --
dict
The AgentCore Memory configuration. Use the optionalValue wrapper to set a new value, or set it to null to clear the existing configuration.
optionalValue (dict) --
The updated memory configuration value, or null to clear the existing configuration.
agentCoreMemoryConfiguration (dict) --
The AgentCore Memory configuration.
arn (string) -- [REQUIRED]
The ARN of the AgentCore Memory resource.
actorId (string) --
The actor ID for memory operations.
messagesCount (integer) --
The number of messages to retrieve from memory.
retrievalConfig (dict) --
The retrieval configuration for long-term memory, mapping namespace path templates to retrieval settings.
(string) --
(dict) --
Configuration for memory retrieval within a namespace.
topK (integer) --
The maximum number of memory entries to retrieve.
relevanceScore (float) --
The minimum relevance score for retrieved memories.
strategyId (string) --
The ID of the retrieval strategy to use.
managedMemoryConfiguration (dict) --
Harness creates and manages a memory resource in the customer's account.
arn (string) --
The ARN of the managed AgentCore Memory resource. Read-only on Get, ignored on Create/Update input.
strategies (list) --
Strategy types to enable. Defaults to [SEMANTIC, SUMMARIZATION].
(string) --
eventExpiryDuration (integer) --
Event retention in days. Defaults to 30.
encryptionKeyArn (string) --
Customer-managed KMS key. Defaults to AWS-owned key. Not updatable after creation.
disabled (dict) --
Explicitly opt out of memory.
dict
The truncation configuration for managing conversation context. If not specified, the existing value is retained.
strategy (string) -- [REQUIRED]
The truncation strategy to use.
config (dict) --
The strategy-specific configuration.
slidingWindow (dict) --
Configuration for sliding window truncation.
messagesCount (integer) --
The number of recent messages to retain in the context window.
summarization (dict) --
Configuration for summarization-based truncation.
summaryRatio (float) --
The ratio of content to summarize.
preserveRecentMessages (integer) --
The number of recent messages to preserve without summarization.
summarizationSystemPrompt (string) --
The system prompt used for generating summaries.
integer
The maximum number of iterations the agent loop can execute per invocation. If not specified, the existing value is retained.
integer
The maximum total number of output tokens the agent can generate across all model calls within a single invocation. If not specified, the existing value is retained.
integer
The maximum duration in seconds for the agent loop execution per invocation. If not specified, the existing value is retained.
dict
Response Syntax
{
'harness': {
'harnessId': 'string',
'harnessName': 'string',
'arn': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED',
'harnessVersion': 'string',
'executionRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'model': {
'bedrockModelConfig': {
'modelId': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'converse_stream'|'responses'|'chat_completions',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'openAiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'chat_completions'|'responses',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'geminiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'topK': 123,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'liteLlmModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
}
},
'systemPrompt': [
{
'text': 'string'
},
],
'tools': [
{
'type': 'remote_mcp'|'agentcore_browser'|'agentcore_gateway'|'inline_function'|'agentcore_code_interpreter',
'name': 'string',
'config': {
'remoteMcp': {
'url': 'string',
'headers': {
'string': 'string'
}
},
'agentCoreBrowser': {
'browserArn': 'string'
},
'agentCoreGateway': {
'gatewayArn': 'string',
'outboundAuth': {
'awsIam': {},
'none': {},
'oauth': {
'providerArn': 'string',
'scopes': [
'string',
],
'customParameters': {
'string': 'string'
},
'grantType': 'CLIENT_CREDENTIALS'|'AUTHORIZATION_CODE'|'TOKEN_EXCHANGE',
'defaultReturnUrl': 'string'
}
}
},
'inlineFunction': {
'description': 'string',
'inputSchema': {...}|[...]|123|123.4|'string'|True|None
},
'agentCoreCodeInterpreter': {
'codeInterpreterArn': 'string'
}
}
},
],
'skills': [
{
'path': 'string',
's3': {
'uri': 'string'
},
'git': {
'url': 'string',
'path': 'string',
'auth': {
'credentialArn': 'string',
'username': 'string'
}
},
'awsSkills': {
'paths': [
'string',
]
}
},
],
'allowedTools': [
'string',
],
'truncation': {
'strategy': 'sliding_window'|'summarization'|'none',
'config': {
'slidingWindow': {
'messagesCount': 123
},
'summarization': {
'summaryRatio': ...,
'preserveRecentMessages': 123,
'summarizationSystemPrompt': 'string'
}
}
},
'environment': {
'agentCoreRuntimeEnvironment': {
'agentRuntimeArn': 'string',
'agentRuntimeName': 'string',
'agentRuntimeId': 'string',
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
]
}
},
'environmentArtifact': {
'containerConfiguration': {
'containerUri': 'string'
}
},
'environmentVariables': {
'string': 'string'
},
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'memory': {
'agentCoreMemoryConfiguration': {
'arn': 'string',
'actorId': 'string',
'messagesCount': 123,
'retrievalConfig': {
'string': {
'topK': 123,
'relevanceScore': ...,
'strategyId': 'string'
}
}
},
'managedMemoryConfiguration': {
'arn': 'string',
'strategies': [
'SEMANTIC'|'SUMMARIZATION'|'USER_PREFERENCE'|'EPISODIC',
],
'eventExpiryDuration': 123,
'encryptionKeyArn': 'string'
},
'disabled': {}
},
'maxIterations': 123,
'maxTokens': 123,
'timeoutSeconds': 123,
'failureReason': 'string'
}
}
Response Structure
(dict) --
harness (dict) --
The updated harness.
harnessId (string) --
The ID of the harness.
harnessName (string) --
The name of the harness.
arn (string) --
The ARN of the harness.
status (string) --
The status of the harness.
harnessVersion (string) --
The version of the harness. Incremented on every successful UpdateHarness.
executionRoleArn (string) --
IAM role the harness assumes when running.
createdAt (datetime) --
The createdAt time of the harness.
updatedAt (datetime) --
The updatedAt time of the harness.
model (dict) --
The configuration of the default model used by the Harness.
bedrockModelConfig (dict) --
Configuration for an Amazon Bedrock model.
modelId (string) --
The Bedrock model ID.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the Bedrock provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
openAiModelConfig (dict) --
Configuration for an OpenAI model.
modelId (string) --
The OpenAI model ID.
apiKeyArn (string) --
The ARN of your OpenAI API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the OpenAI provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
geminiModelConfig (dict) --
Configuration for a Google Gemini model.
modelId (string) --
The Gemini model ID.
apiKeyArn (string) --
The ARN of your Gemini API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
topK (integer) --
The topK set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the Gemini model provider unchanged.
liteLlmModelConfig (dict) --
The LiteLLM model configuration for connecting to third-party model providers.
modelId (string) --
The LiteLLM model identifier (e.g., "anthropic/claude-3-sonnet").
apiKeyArn (string) --
The ARN of the API key in AgentCore Identity for authenticating with the model provider.
apiBase (string) --
The base URL for the model provider's API endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per iteration.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
systemPrompt (list) --
The system prompt of the harness.
(dict) --
A content block in the system prompt.
text (string) --
The text content of the system prompt block.
tools (list) --
The tools of the harness.
(dict) --
A tool available to the agent loop.
type (string) --
The type of tool.
name (string) --
Unique name for the tool. If not provided, a name will be inferred or generated.
config (dict) --
Tool-specific configuration.
remoteMcp (dict) --
Configuration for remote MCP server.
url (string) --
URL of the MCP endpoint.
headers (dict) --
Custom headers to include when connecting to the remote MCP server.
(string) --
The key of an HTTP header.
(string) --
The value of an HTTP header.
agentCoreBrowser (dict) --
Configuration for AgentCore Browser.
browserArn (string) --
If not populated, the built-in Browser ARN is used.
agentCoreGateway (dict) --
Configuration for AgentCore Gateway.
gatewayArn (string) --
The ARN of the desired AgentCore Gateway.
outboundAuth (dict) --
How harness authenticates to this Gateway. Defaults to AWS_IAM (SigV4) if omitted.
awsIam (dict) --
SigV4-sign requests using the agent's execution role.
none (dict) --
No authentication.
oauth (dict) --
Use OAuth credentials for outbound authentication to the gateway.
providerArn (string) --
The Amazon Resource Name (ARN) of the OAuth credential provider. This ARN identifies the provider in Amazon Web Services.
scopes (list) --
The OAuth scopes for the credential provider. These scopes define the level of access requested from the OAuth provider.
(string) --
customParameters (dict) --
The custom parameters for the OAuth credential provider. These parameters provide additional configuration for the OAuth authentication process.
(string) --
(string) --
grantType (string) --
Specifies the kind of credentials to use for authorization:
CLIENT_CREDENTIALS - Authorization with a client ID and secret.
AUTHORIZATION_CODE - Authorization with a token that is specific to an individual end user.
TOKEN_EXCHANGE - Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience.
defaultReturnUrl (string) --
The URL where the end user's browser is redirected after obtaining the authorization code. Generally points to the customer's application.
inlineFunction (dict) --
Configuration for an inline function tool.
description (string) --
Description of what the tool does, provided to the model.
inputSchema (:ref:`document<document>`) --
JSON Schema describing the tool's input parameters.
agentCoreCodeInterpreter (dict) --
Configuration for AgentCore Code Interpreter.
codeInterpreterArn (string) --
If not populated, the built-in Code Interpreter ARN is used.
skills (list) --
The skills of the harness.
(dict) --
A skill available to the agent.
path (string) --
The filesystem path to the skill definition.
s3 (dict) --
An S3 source containing the skill.
uri (string) --
The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
git (dict) --
A git repository containing the skill.
url (string) --
The HTTPS URL of the git repository.
path (string) --
Subdirectory within the repository containing the skill.
auth (dict) --
Authentication configuration for private repositories.
credentialArn (string) --
The ARN of the credential in AgentCore Identity containing the password or personal access token.
username (string) --
Username for authentication. Defaults to 'oauth2' if not specified.
awsSkills (dict) --
AWS Skills baked into the harness's underlying Runtime.
paths (list) --
Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
(string) --
allowedTools (list) --
The allowed tools of the harness. All tools are allowed by default.
(string) --
truncation (dict) --
Configuration for truncating model context.
strategy (string) --
The truncation strategy to use.
config (dict) --
The strategy-specific configuration.
slidingWindow (dict) --
Configuration for sliding window truncation.
messagesCount (integer) --
The number of recent messages to retain in the context window.
summarization (dict) --
Configuration for summarization-based truncation.
summaryRatio (float) --
The ratio of content to summarize.
preserveRecentMessages (integer) --
The number of recent messages to preserve without summarization.
summarizationSystemPrompt (string) --
The system prompt used for generating summaries.
environment (dict) --
The compute environment on which the Harness runs.
agentCoreRuntimeEnvironment (dict) --
The AgentCore Runtime environment configuration.
agentRuntimeArn (string) --
The ARN of the underlying AgentCore Runtime.
agentRuntimeName (string) --
The name of the underlying AgentCore Runtime.
agentRuntimeId (string) --
The ID of the underlying AgentCore Runtime.
lifecycleConfiguration (dict) --
LifecycleConfiguration lets you manage the lifecycle of runtime sessions and resources in AgentCore Runtime. This configuration helps optimize resource utilization by automatically cleaning up idle sessions and preventing long-running instances from consuming resources indefinitely.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
networkConfiguration (dict) --
SecurityConfig for the Agent.
networkMode (string) --
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) --
The security groups associated with the VPC configuration.
(string) --
subnets (list) --
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
filesystemConfigurations (list) --
The filesystem configurations for the runtime environment.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) --
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) --
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) --
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
environmentArtifact (dict) --
The environment artifact (e.g., container) in which the Harness operates.
containerConfiguration (dict) --
Representation of a container configuration.
containerUri (string) --
The ECR URI of the container.
environmentVariables (dict) --
Environment variables exposed in the environment in which the harness operates.
(string) --
(string) --
authorizerConfiguration (dict) --
Represents inbound authorization configuration options used to authenticate incoming requests.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
memory (dict) --
AgentCore Memory instance configuration for short and long term memory.
agentCoreMemoryConfiguration (dict) --
The AgentCore Memory configuration.
arn (string) --
The ARN of the AgentCore Memory resource.
actorId (string) --
The actor ID for memory operations.
messagesCount (integer) --
The number of messages to retrieve from memory.
retrievalConfig (dict) --
The retrieval configuration for long-term memory, mapping namespace path templates to retrieval settings.
(string) --
(dict) --
Configuration for memory retrieval within a namespace.
topK (integer) --
The maximum number of memory entries to retrieve.
relevanceScore (float) --
The minimum relevance score for retrieved memories.
strategyId (string) --
The ID of the retrieval strategy to use.
managedMemoryConfiguration (dict) --
Harness creates and manages a memory resource in the customer's account.
arn (string) --
The ARN of the managed AgentCore Memory resource. Read-only on Get, ignored on Create/Update input.
strategies (list) --
Strategy types to enable. Defaults to [SEMANTIC, SUMMARIZATION].
(string) --
eventExpiryDuration (integer) --
Event retention in days. Defaults to 30.
encryptionKeyArn (string) --
Customer-managed KMS key. Defaults to AWS-owned key. Not updatable after creation.
disabled (dict) --
Explicitly opt out of memory.
maxIterations (integer) --
The maximum number of iterations in the agent loop allowed before exiting per invocation.
maxTokens (integer) --
The maximum total number of output tokens the agent can generate across all model calls within a single invocation.
timeoutSeconds (integer) --
The maximum duration per invocation.
failureReason (string) --
Reason why create or update operations fail.