New serverless pattern - Strands Agent on Lambda with AgentCore Smithy Bedrock Target by humem001 · Pull Request #3221 · aws-samples/serverless-patterns

humem001 · 2026-07-08T10:42:45Z

Issue #, if available:

Description of changes:
Strands SDK agent on Lambda calls Bedrock Runtime via AgentCore Gateway using a Smithy
model target, with Cognito JWT auth and IAM role signing.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

biswanathmukherjee · 2026-07-19T05:14:42Z

+            Statement:
+              - Effect: Allow
+                Action:
+                  - bedrock-agentcore:*


Instead of wild card (*) access, can you make it restricted to required actions only.

The single bedrock-agentcore:* statement was replaced with two scoped statements:

TokenVaultApiKeyAccess — grants only GetResourceApiKey on the token vault resources. This is the correct action for retrieving API keys stored in the credential provider (e.g., for OpenAI or other MCP tool integrations).
WorkloadIdentityTokenAccess — grants the three workload access token actions on the workload identity directory resources. These are the only actions the gateway execution role needs for identity/auth flows.

biswanathmukherjee · 2026-07-19T05:16:05Z

+                Resource:
+                  - !Sub 'arn:aws:bedrock:${AWS::Region}::foundation-model/*'
+                  - !Sub 'arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*'
+                  - '*'


Wildcard (*) opens up everything. Can you make it restricted to required resources only.

Removed the '*' resource entry

biswanathmukherjee · 2026-07-19T05:16:43Z

+                  - bedrock:InvokeModelWithResponseStream
+                  - bedrock:Converse
+                  - bedrock:ConverseStream
+                Resource: '*'


Wildcard (*) opens up everything. Can you make it restricted to required resources only.

Done. Replaced Resource: '*' with the same two scoped ARN patterns used in GatewayExecutionRole

biswanathmukherjee · 2026-07-19T05:20:00Z

+          - Effect: Allow
+            Principal:
+              Service: bedrock-agentcore.amazonaws.com
+            Action: sts:AssumeRole


Can you try adding the condition? Please test after adding. Adding these conditions to prevent the cross-service confused deputy problem

AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: bedrock-agentcore.amazonaws.com Action: sts:AssumeRole Condition: StringEquals: aws:SourceAccount: !Ref AWS::AccountId ArnLike: aws:SourceArn: !Sub 'arn:aws:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:*'

aws:SourceAccount — ensures only resources from your own account can trigger the role assumption, blocking confused deputy attacks where another account's AgentCore service tricks a role.
aws:SourceArn with ArnLike — further scopes it to only AgentCore resources within your specific account and region, so even within the same account only the AgentCore service (not some other AWS service) can assume the role.

biswanathmukherjee · 2026-07-19T05:21:30Z

+                  - logs:CreateLogGroup
+                  - logs:CreateLogStream
+                  - logs:PutLogEvents
+                Resource: '*'


Can you make it more restrictive? e.g.

Resource: - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${AWS::StackName}-AgentFunction:*'

Test and modify if needed.

updated

Effect: Allow
Action:

logs:CreateLogGroup
Resource:

!Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${AWS::StackName}-AgentFunction'

Effect: Allow
Action:

logs:CreateLogStream

logs:PutLogEvents
Resource:

!Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${AWS::StackName}-AgentFunction:*'

biswanathmukherjee · 2026-07-19T06:34:27Z

+        if isinstance(body, dict):
+            prompt = body.get("prompt", "")
+        elif isinstance(body, str):
+            import json


move the import statement at the top of the file to maintain standard.

Done — import json is at line 9, in the top-level imports block. The inline import json inside the elif isinstance(body, str) branch was removed at the same time.

biswanathmukherjee · 2026-07-19T06:36:25Z

+Transform: AWS::Serverless-2016-10-31
+Description: >
+  AgentCore Smithy Bedrock Runtime - Serverless AI agent exposing Bedrock Runtime
+  operations through AWS Bedrock AgentCore Gateway using a Smithy model target.


AWS Bedrock AgentCore --> Amazon Bedrock AgentCore

Bedrock --> Amazon Bedrock

biswanathmukherjee · 2026-07-19T06:37:27Z

+
+
+def create_mcp_client(gateway_url: str, token: str) -> MCPClient:
+    """Create an MCP client configured to connect to AgentCore Gateway.


AgentCore Gateway --> Amazon Bedrock AgentCore Gateway

biswanathmukherjee · 2026-07-19T06:39:49Z

+    Configures Claude 3 Sonnet as the LLM provider via AWS Bedrock.
+
+    Args:
+        model_id: Bedrock model identifier. Defaults to Claude 3 Sonnet.


Update the model id accordingly.

all three references now correctly say Claude Sonnet 4.6:

Comment on DEFAULT_MODEL_ID
Function docstring: Configures Claude Sonnet 4.6 as the LLM provider
Args description: Defaults to Claude Sonnet 4.6

biswanathmukherjee · 2026-07-19T06:52:24Z

+One command deploys everything:
+
+```bash
+bash scripts/deploy.sh


Deploy failed with the following issue:

`strands-agentcore-smithy % bash scripts/deploy.sh

Deploying stack: agentcore-smithy-bedrock in region: us-east-1

Step 1: Validating SAM template...

SAM CLI update available (1.163.0); (1.162.1 installed)
To download: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-cli-install.html
Template validation successful.

Step 2: Uploading Bedrock Runtime Smithy model to S3...
upload failed: ../../../../../../../tmp/bedrock-runtime-2023-09-30.json to s3://agentcore-smithy-bedrock-smithy-models/bedrock-runtime-2023-09-30.json An error occurred (AccessDenied) when calling the PutObject operation: Access Denied`

Done. Three things fixed:

Removed duplicate prerequisites — they were listed twice (under ## Prerequisites and ### Step 1: Prerequisites). Now a single clean list.
Added IAM permissions note — explicitly tells users they need permissions for CloudFormation, IAM, Lambda, S3, Cognito, and AgentCore. This directly addresses the AccessDenied deployment failure.
Fixed step numbering — Deploy steps now run 1→2→3 cleanly.
The AccessDenied error itself is a credentials/IAM issue in the user's AWS account — the user needs to ensure their AWS CLI credentials have the necessary S3 permissions before running the deploy script.

… tests and scripts

New serverless pattern - strands-agentcore-smithy

c2fe5cd

julianwood assigned biswanathmukherjee and julianwood Jul 8, 2026

humem001 mentioned this pull request Jul 8, 2026

New pattern submission - Strands Agent on Lambda with AgentCore Smithy Bedrock Target #3222

Open

biswanathmukherjee requested changes Jul 19, 2026

View reviewed changes

biswanathmukherjee added the requested-changes label Jul 19, 2026

Address PR aws-samples#3221 review feedback - rename template, update…

3248976

… tests and scripts



		def create_mcp_client(gateway_url: str, token: str) -> MCPClient:
		"""Create an MCP client configured to connect to AgentCore Gateway.

Uh oh!

Conversation

humem001 commented Jul 8, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

`strands-agentcore-smithy % bash scripts/deploy.sh

Deploying stack: agentcore-smithy-bedrock in region: us-east-1

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants