New serverless pattern - Strands Agent on Lambda with AgentCore Smithy Bedrock Target by humem001 · Pull Request #3221 · aws-samples/serverless-patterns

humem001 · 2026-07-08T10:42:45Z

Issue #, if available:

Description of changes:
Strands SDK agent on Lambda calls Bedrock Runtime via AgentCore Gateway using a Smithy
model target, with Cognito JWT auth and IAM role signing.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

biswanathmukherjee · 2026-07-19T05:14:42Z

+            Statement:
+              - Effect: Allow
+                Action:
+                  - bedrock-agentcore:*


Instead of wild card (*) access, can you make it restricted to required actions only.

The single bedrock-agentcore:* statement was replaced with two scoped statements:

TokenVaultApiKeyAccess — grants only GetResourceApiKey on the token vault resources. This is the correct action for retrieving API keys stored in the credential provider (e.g., for OpenAI or other MCP tool integrations).
WorkloadIdentityTokenAccess — grants the three workload access token actions on the workload identity directory resources. These are the only actions the gateway execution role needs for identity/auth flows.

biswanathmukherjee · 2026-07-19T05:16:05Z

+                Resource:
+                  - !Sub 'arn:aws:bedrock:${AWS::Region}::foundation-model/*'
+                  - !Sub 'arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*'
+                  - '*'


Wildcard (*) opens up everything. Can you make it restricted to required resources only.

Removed the '*' resource entry

biswanathmukherjee · 2026-07-19T05:16:43Z

+                  - bedrock:InvokeModelWithResponseStream
+                  - bedrock:Converse
+                  - bedrock:ConverseStream
+                Resource: '*'


Wildcard (*) opens up everything. Can you make it restricted to required resources only.

Done. Replaced Resource: '*' with the same two scoped ARN patterns used in GatewayExecutionRole

biswanathmukherjee · 2026-07-19T05:20:00Z

+          - Effect: Allow
+            Principal:
+              Service: bedrock-agentcore.amazonaws.com
+            Action: sts:AssumeRole


Can you try adding the condition? Please test after adding. Adding these conditions to prevent the cross-service confused deputy problem

AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: bedrock-agentcore.amazonaws.com Action: sts:AssumeRole Condition: StringEquals: aws:SourceAccount: !Ref AWS::AccountId ArnLike: aws:SourceArn: !Sub 'arn:aws:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:*'

aws:SourceAccount — ensures only resources from your own account can trigger the role assumption, blocking confused deputy attacks where another account's AgentCore service tricks a role.
aws:SourceArn with ArnLike — further scopes it to only AgentCore resources within your specific account and region, so even within the same account only the AgentCore service (not some other AWS service) can assume the role.

biswanathmukherjee · 2026-07-19T05:21:30Z

+                  - logs:CreateLogGroup
+                  - logs:CreateLogStream
+                  - logs:PutLogEvents
+                Resource: '*'


Can you make it more restrictive? e.g.

Resource: - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${AWS::StackName}-AgentFunction:*'

Test and modify if needed.

updated

Effect: Allow
Action:

logs:CreateLogGroup
Resource:

!Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${AWS::StackName}-AgentFunction'

Effect: Allow
Action:

logs:CreateLogStream

logs:PutLogEvents
Resource:

!Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${AWS::StackName}-AgentFunction:*'

biswanathmukherjee · 2026-07-19T06:34:27Z

+        if isinstance(body, dict):
+            prompt = body.get("prompt", "")
+        elif isinstance(body, str):
+            import json


move the import statement at the top of the file to maintain standard.

Done — import json is at line 9, in the top-level imports block. The inline import json inside the elif isinstance(body, str) branch was removed at the same time.

biswanathmukherjee · 2026-07-19T06:36:25Z

+Transform: AWS::Serverless-2016-10-31
+Description: >
+  AgentCore Smithy Bedrock Runtime - Serverless AI agent exposing Bedrock Runtime
+  operations through AWS Bedrock AgentCore Gateway using a Smithy model target.


AWS Bedrock AgentCore --> Amazon Bedrock AgentCore

Bedrock --> Amazon Bedrock

biswanathmukherjee · 2026-07-19T06:37:27Z

+
+
+def create_mcp_client(gateway_url: str, token: str) -> MCPClient:
+    """Create an MCP client configured to connect to AgentCore Gateway.


AgentCore Gateway --> Amazon Bedrock AgentCore Gateway

biswanathmukherjee · 2026-07-19T06:39:49Z

+    Configures Claude 3 Sonnet as the LLM provider via AWS Bedrock.
+
+    Args:
+        model_id: Bedrock model identifier. Defaults to Claude 3 Sonnet.


Update the model id accordingly.

all three references now correctly say Claude Sonnet 4.6:

Comment on DEFAULT_MODEL_ID
Function docstring: Configures Claude Sonnet 4.6 as the LLM provider
Args description: Defaults to Claude Sonnet 4.6

biswanathmukherjee · 2026-07-19T06:52:24Z

+One command deploys everything:
+
+```bash
+bash scripts/deploy.sh


Deploy failed with the following issue:

`strands-agentcore-smithy % bash scripts/deploy.sh

Deploying stack: agentcore-smithy-bedrock in region: us-east-1

Step 1: Validating SAM template...

SAM CLI update available (1.163.0); (1.162.1 installed)
To download: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-cli-install.html
Template validation successful.

Step 2: Uploading Bedrock Runtime Smithy model to S3...
upload failed: ../../../../../../../tmp/bedrock-runtime-2023-09-30.json to s3://agentcore-smithy-bedrock-smithy-models/bedrock-runtime-2023-09-30.json An error occurred (AccessDenied) when calling the PutObject operation: Access Denied`

Done. Three things fixed:

Removed duplicate prerequisites — they were listed twice (under ## Prerequisites and ### Step 1: Prerequisites). Now a single clean list.
Added IAM permissions note — explicitly tells users they need permissions for CloudFormation, IAM, Lambda, S3, Cognito, and AgentCore. This directly addresses the AccessDenied deployment failure.
Fixed step numbering — Deploy steps now run 1→2→3 cleanly.
The AccessDenied error itself is a credentials/IAM issue in the user's AWS account — the user needs to ensure their AWS CLI credentials have the necessary S3 permissions before running the deploy script.

… tests and scripts

biswanathmukherjee

Can you please make the requested changes?

biswanathmukherjee · 2026-08-02T13:50:23Z

+## Changing the Outer Agent Model
+
+The outer agent model is set in `src/agent/strands_client.py`:
+
+```python
+# Default Bedrock model ID for Claude Sonnet 4.6
+DEFAULT_MODEL_ID = "us.anthropic.claude-sonnet-4-6"
+```
+
+To use a different model, update `DEFAULT_MODEL_ID` to any Bedrock cross-region inference profile ID you have access to. For example:
+
+```python
+DEFAULT_MODEL_ID = "us.anthropic.claude-3-5-sonnet-20241022-v2:0"
+```
+
+Make sure the model is enabled in your AWS account under **Bedrock → Model access** before deploying.
+
+> **Note:** The inner model (the one the agent calls as a tool) is separate — it's configured in the `SYSTEM_PROMPT` string in `src/agent/agent_processor.py`. See [Changing the Inner Model](#changing-the-inner-model) and [Key Design Decisions](#key-design-decisions) for more detail.
+
+## Changing the Inner Model
+
+The inner model is the one the outer agent calls *as a tool* via the AgentCore Gateway. It's configured inside the `SYSTEM_PROMPT` string in `src/agent/agent_processor.py`:
+
+```python
+SYSTEM_PROMPT = """You have access to Bedrock Runtime tools via MCP. Use the Converse tool (not InvokeModel) to call another model.
+
+When using bedrock-runtime-target___Converse:
+- Set modelId to: anthropic.claude-haiku-4-5-20251001-v1:0
+...
+```
+
+To use a different model, replace the `modelId` value in that instruction:
+
+```python
+- Set modelId to: anthropic.claude-haiku-4-5-20251001-v1:0
+```
+
+A few things to keep in mind:
+
+- The model ID here is passed as a parameter in the MCP tool call, not used directly by the Lambda — so it must be a valid Bedrock `modelId` (not a cross-region inference profile).
+- Make sure the model supports the **Converse API** (most Claude models do, but check the [Bedrock docs](https://docs.aws.amazon.com/bedrock/latest/userguide/conversation-inference-supported-models-features.html)).
+- Enable the model in your AWS account under **Bedrock → Model access** before deploying.
+
+## Key Design Decisions
+
+### Official Smithy Model (not custom)
+Custom Smithy models don't work for AWS service targets — the gateway needs the full endpoint resolution metadata (`aws.api#service` trait, partition data, FIPS/DualStack logic) that only official models have. The deploy script downloads the official model from the [AWS API Models repo](https://github.com/aws/api-models-aws).
+
+### Converse API (not InvokeModel)
+The `InvokeModel` operation uses a `Blob` with `httpPayload` trait for the request body, which doesn't map to MCP tool input parameters. `Converse` has structured `messages` and `modelId` fields that map cleanly.
+
+### GATEWAY_IAM_ROLE (not API_KEY)
+Since the target is an AWS service (Bedrock Runtime), the gateway uses its IAM execution role to sign requests. No API keys, no Secrets Manager secrets, no credential provider CLI commands.
+
+### Agent code is target-agnostic
+All code in `src/agent/` and `src/shared/` connects to the gateway via MCP and doesn't reference Bedrock, DynamoDB, or any specific target. The same code works with any gateway target type.
+
+## Run Tests
+
+```bash
+python3 -m pytest tests/ -v
+```


Patterns are to showcase simple integration between different services. This section add complexity to the pattern. Also I got the following error:

ImportError while loading conftest '.../serverless-patterns/strands-agentcore-smithy/tests/conftest.py'. tests/conftest.py:9: in <module> import jwt E ModuleNotFoundError: No module named 'jwt'

biswanathmukherjee · 2026-08-02T14:09:39Z

+## Prerequisites
+
+- AWS CLI v2
+- Python 3.12+


Please use the latest supported Python version.

biswanathmukherjee · 2026-08-02T14:10:07Z

+- Python 3.12+
+- pip3
+- AWS account with Amazon Bedrock and Amazon Bedrock AgentCore enabled in `us-east-1`
+- Amazon Bedrock model access enabled for Claude Sonnet 4.6 and Claude Haiku 4.5


Please use the latest supported version to avoid the pattern getting dated sooner.

biswanathmukherjee · 2026-08-02T14:16:09Z

+  "description": "Strands SDK agent on AWS Lambda calls Amazon Bedrock Runtime via Amazon Bedrock AgentCore Gateway using a Smithy model target, with Cognito JWT auth and IAM role signing.",
+  "language": "Python",
+  "level": "300",
+  "framework": "CloudFormation",


AWS CloudFormation

New serverless pattern - strands-agentcore-smithy

c2fe5cd

julianwood assigned biswanathmukherjee and julianwood Jul 8, 2026

humem001 mentioned this pull request Jul 8, 2026

New pattern submission - Strands Agent on Lambda with AgentCore Smithy Bedrock Target #3222

Open

biswanathmukherjee requested changes Jul 19, 2026

View reviewed changes

biswanathmukherjee added the requested-changes label Jul 19, 2026

Address PR aws-samples#3221 review feedback - rename template, update…

3248976

… tests and scripts

biswanathmukherjee requested changes Aug 2, 2026

View reviewed changes

Create strands-agentcore-smithy.json

534e493



		def create_mcp_client(gateway_url: str, token: str) -> MCPClient:
		"""Create an MCP client configured to connect to AgentCore Gateway.

Uh oh!

Conversation

humem001 commented Jul 8, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

`strands-agentcore-smithy % bash scripts/deploy.sh

Deploying stack: agentcore-smithy-bedrock in region: us-east-1

Uh oh!

Choose a reason for hiding this comment

Uh oh!

biswanathmukherjee left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants