@aws/nx-plugin 1.0.0-rc.68 → 1.0.0-rc.69

package/src/utils/agent-core-constructs/files/cdk/app/agentcore-harness/__nameKebabCase__/__nameKebabCase__.ts.template

@@ -0,0 +1,366 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as url from 'node:url';
+import { CfnOutput, Lazy, Names, Stack } from 'aws-cdk-lib';
+import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import { Construct, IConstruct } from 'constructs';
+import { suppressRules } from '../../../core/checkov<% if (esm) { %>.js<% } %>';
+import { RuntimeConfig } from '../../../core/runtime-config<% if (esm) { %>.js<% } %>';
+import { findWorkspaceRoot } from '../../../core/workspace<% if (esm) { %>.js<% } %>';
+
+// Checkov rules flagging IAM statements whose resource cannot be scoped.
+const WILDCARD_IAM_RULES = ['CKV_AWS_107', 'CKV_AWS_111', 'CKV_AWS_356'];
+
+// Read at synth time, anchored on the workspace root so it still resolves once
+// this file compiles to dist/.
+const systemPrompt = fs.readFileSync(
+  path.join(
+    findWorkspaceRoot(url.fileURLToPath(new URL(<% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>))),
+    '<%- promptPathFromCdk %>',
+  ),
+  'utf-8',
+);
+
+/**
+ * Properties for the <%- nameClassName %> Harness. Any native Harness field
+ * supplied here takes precedence over the generated defaults.
+ */
+export interface <%- nameClassName %>Props
+  extends Partial<
+    Omit<agentcore.CfnHarnessProps, 'executionRoleArn' | 'allowedTools'>
+  > {
+  /** Existing execution role to use instead of the generated role. */
+  executionRole?: iam.IRole;
+  /** Model resources the generated execution role may invoke. */
+  modelResourceArns?: string[];
+  /** Tools the Harness may use. Deploys with none unless supplied here. */
+  allowedTools?: agentcore.CfnHarnessProps['allowedTools'];
+  /**
+   * Run the Harness in a VPC so it can reach private resources. Selects private
+   * subnets with egress unless `vpcSubnets` narrows it, and creates a security
+   * group unless `securityGroups` supplies them.
+   */
+  vpc?: ec2.IVpc;
+  /** Subnets to place the Harness in. Requires `vpc`. */
+  vpcSubnets?: ec2.SubnetSelection;
+  /** Security groups for the Harness. Requires `vpc`. */
+  securityGroups?: ec2.ISecurityGroup[];
+}
+
+/** A managed Amazon Bedrock AgentCore Harness, using IAM inbound auth. */
+export class <%- nameClassName %>
+  extends Construct
+  implements iam.IGrantable, ec2.IConnectable
+{
+  public readonly harness: agentcore.CfnHarness;
+  public readonly executionRole: iam.IRole;
+  private readonly _connections?: ec2.Connections;
+
+  constructor(scope: Construct, id: string, props?: <%- nameClassName %>Props) {
+    super(scope, id);
+
+    const stack = Stack.of(this);
+    const {
+      executionRole,
+      modelResourceArns = [
+        `arn:${stack.partition}:bedrock:*::foundation-model/*`,
+        `arn:${stack.partition}:bedrock:${stack.region}:${stack.account}:*`,
+      ],
+      vpc,
+      vpcSubnets,
+      securityGroups,
+      ...harnessProps
+    } = props ?? {};
+
+    if (!vpc && (vpcSubnets || securityGroups)) {
+      throw new Error(
+        'vpcSubnets and securityGroups require vpc to be supplied.',
+      );
+    }
+
+    if (vpc) {
+      this._connections = new ec2.Connections({
+        securityGroups: securityGroups ?? [
+          new ec2.SecurityGroup(this, 'SecurityGroup', {
+            vpc,
+            description: `Harness ${id}`,
+          }),
+        ],
+      });
+    }
+
+    // Harness names allow ASCII letters, digits and underscores, must start
+    // with a letter, and are at most 40 characters.
+    const uniqueName = Names.uniqueResourceName(this, {
+      maxLength: 39,
+      separator: '_',
+      allowedSpecialCharacters: '_',
+    });
+    const harnessName =
+      harnessProps.harnessName ??
+      (/^[A-Za-z]/.test(uniqueName) ? uniqueName : `H${uniqueName}`);
+
+    this.executionRole =
+      executionRole ??
+      new iam.Role(this, 'ExecutionRole', {
+        assumedBy: new iam.ServicePrincipal('bedrock-agentcore.amazonaws.com', {
+          conditions: {
+            StringEquals: { 'aws:SourceAccount': stack.account },
+            ArnLike: {
+              'aws:SourceArn': `arn:${stack.partition}:bedrock-agentcore:${stack.region}:${stack.account}:*`,
+            },
+          },
+        }),
+      });
+
+    if (!executionRole) {
+      // Baseline permissions from the AgentCore Harness security guidance:
+      // https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-security.html
+      [
+        new iam.PolicyStatement({
+          sid: 'BedrockModelInvocation',
+          actions: [
+            'bedrock:InvokeModel',
+            'bedrock:InvokeModelWithResponseStream',
+          ],
+          resources: modelResourceArns,
+        }),
+        new iam.PolicyStatement({
+          sid: 'EcrPublicTokenAccess',
+          actions: ['ecr-public:GetAuthorizationToken'],
+          resources: ['*'],
+        }),
+        new iam.PolicyStatement({
+          sid: 'StsForEcrPublicPull',
+          actions: ['sts:GetServiceBearerToken'],
+          resources: ['*'],
+        }),
+        new iam.PolicyStatement({
+          sid: 'XRayTracingAccess',
+          actions: [
+            'xray:PutTraceSegments',
+            'xray:PutTelemetryRecords',
+            'xray:GetSamplingRules',
+            'xray:GetSamplingTargets',
+          ],
+          resources: ['*'],
+        }),
+        new iam.PolicyStatement({
+          sid: 'CloudWatchLogsGroup',
+          actions: ['logs:CreateLogGroup', 'logs:DescribeLogStreams'],
+          resources: [
+            `arn:${stack.partition}:logs:${stack.region}:${stack.account}:log-group:/aws/bedrock-agentcore/runtimes/*`,
+          ],
+        }),
+        new iam.PolicyStatement({
+          sid: 'CloudWatchLogsDescribeGroups',
+          actions: ['logs:DescribeLogGroups'],
+          resources: [
+            `arn:${stack.partition}:logs:${stack.region}:${stack.account}:log-group:*`,
+          ],
+        }),
+        new iam.PolicyStatement({
+          sid: 'CloudWatchLogsStream',
+          actions: ['logs:CreateLogStream', 'logs:PutLogEvents'],
+          resources: [
+            `arn:${stack.partition}:logs:${stack.region}:${stack.account}:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*`,
+          ],
+        }),
+        new iam.PolicyStatement({
+          sid: 'CloudWatchMetricsPublish',
+          actions: ['cloudwatch:PutMetricData'],
+          resources: ['*'],
+          conditions: {
+            StringEquals: { 'cloudwatch:namespace': 'bedrock-agentcore' },
+          },
+        }),
+        new iam.PolicyStatement({
+          sid: 'AgentCoreWorkloadIdentity',
+          actions: [
+            'bedrock-agentcore:GetWorkloadAccessToken',
+            'bedrock-agentcore:GetWorkloadAccessTokenForJWT',
+          ],
+          resources: [
+            `arn:${stack.partition}:bedrock-agentcore:${stack.region}:${stack.account}:workload-identity-directory/default`,
+            `arn:${stack.partition}:bedrock-agentcore:${stack.region}:${stack.account}:workload-identity-directory/default/workload-identity/harness_${harnessName}-*`,
+          ],
+        }),
+        new iam.PolicyStatement({
+          sid: 'AgentCoreBrowserDefault',
+          actions: [
+            'bedrock-agentcore:StartBrowserSession',
+            'bedrock-agentcore:StopBrowserSession',
+            'bedrock-agentcore:GetBrowserSession',
+            'bedrock-agentcore:ListBrowserSessions',
+            'bedrock-agentcore:UpdateBrowserStream',
+            'bedrock-agentcore:ConnectBrowserAutomationStream',
+            'bedrock-agentcore:ConnectBrowserLiveViewStream',
+          ],
+          resources: [
+            `arn:${stack.partition}:bedrock-agentcore:${stack.region}:aws:browser/*`,
+          ],
+        }),
+        new iam.PolicyStatement({
+          sid: 'AgentCoreCodeInterpreterDefault',
+          actions: [
+            'bedrock-agentcore:StartCodeInterpreterSession',
+            'bedrock-agentcore:StopCodeInterpreterSession',
+            'bedrock-agentcore:GetCodeInterpreterSession',
+            'bedrock-agentcore:ListCodeInterpreterSessions',
+            'bedrock-agentcore:InvokeCodeInterpreter',
+          ],
+          resources: [
+            `arn:${stack.partition}:bedrock-agentcore:${stack.region}:aws:code-interpreter/*`,
+          ],
+        }),
+      ].forEach((statement) =>
+        this.executionRole.addToPrincipalPolicy(statement),
+      );
+
+      // These statements take no resource-level permission.
+      const isPolicy = (c: IConstruct) => c instanceof iam.Policy;
+      suppressRules(
+        this.executionRole,
+        WILDCARD_IAM_RULES,
+        'EcrPublicTokenAccess: ecr-public:GetAuthorizationToken has no resource-level permission.',
+        isPolicy,
+      );
+      suppressRules(
+        this.executionRole,
+        WILDCARD_IAM_RULES,
+        'StsForEcrPublicPull: sts:GetServiceBearerToken has no resource-level permission.',
+        isPolicy,
+      );
+      suppressRules(
+        this.executionRole,
+        WILDCARD_IAM_RULES,
+        'XRayTracingAccess: X-Ray segment and sampling APIs have no resource-level permission.',
+        isPolicy,
+      );
+    }
+
+    // Rendered lazily so security groups added through `connections` after
+    // construction are still picked up.
+    const environment: agentcore.CfnHarnessProps['environment'] | undefined = vpc
+      ? Lazy.any({
+          produce: () => ({
+            ...(harnessProps.environment as
+              | agentcore.CfnHarness.HarnessEnvironmentProviderProperty
+              | undefined),
+            agentCoreRuntimeEnvironment: {
+              ...(
+                harnessProps.environment as
+                  | agentcore.CfnHarness.HarnessEnvironmentProviderProperty
+                  | undefined
+              )?.agentCoreRuntimeEnvironment,
+              networkConfiguration: {
+                networkMode: 'VPC',
+                networkModeConfig: {
+                  subnets: vpc.selectSubnets(
+                    vpcSubnets ?? {
+                      subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
+                    },
+                  ).subnetIds,
+                  securityGroups: this._connections!.securityGroups.map(
+                    (group) => group.securityGroupId,
+                  ),
+                },
+              },
+            },
+          }),
+        })
+      : harnessProps.environment;
+
+    this.harness = new agentcore.CfnHarness(this, 'Harness', {
+      model: {
+        bedrockModelConfig: {
+          modelId: 'global.anthropic.claude-sonnet-4-6',
+        },
+      },
+      systemPrompt: [{ text: systemPrompt }],
+      ...harnessProps,
+      // Set after harnessProps so the deployed name always matches the
+      // execution role's workload-identity resource pattern.
+      harnessName,
+      executionRoleArn: this.executionRole.roleArn,
+      // Carries the VPC network configuration when `vpc` is supplied, and is
+      // the caller's own `environment` otherwise.
+      environment,
+    });
+
+    // The Harness provisions managed memory unless `memory` is supplied, and
+    // the service names it, so the grant scopes to the resulting ARN.
+    if (!executionRole && harnessProps.memory === undefined) {
+      this.executionRole.addToPrincipalPolicy(
+        new iam.PolicyStatement({
+          sid: 'AgentCoreManagedMemory',
+          actions: [
+            'bedrock-agentcore:CreateEvent',
+            'bedrock-agentcore:DeleteEvent',
+            'bedrock-agentcore:GetEvent',
+            'bedrock-agentcore:ListEvents',
+            'bedrock-agentcore:RetrieveMemoryRecords',
+          ],
+          resources: [
+            this.harness.attrMemoryManagedMemoryConfigurationArn,
+          ],
+        }),
+      );
+    }
+
+    const rc = RuntimeConfig.ensure(this);
+    rc.set('agentcore', 'harnesses', {
+      ...rc.get('agentcore').harnesses,
+      <%- nameClassName %>: this.harness.attrArn,
+    });
+
+    // Materialises the AppConfig resources so the entry above is deployed and
+    // the chat script's RUNTIME_CONFIG_APP_ID lookup resolves.
+    void rc.appConfigApplicationId;
+
+    new CfnOutput(this, 'HarnessArn', { value: this.harness.attrArn });
+  }
+
+  public get grantPrincipal(): iam.IPrincipal {
+    return this.executionRole.grantPrincipal;
+  }
+
+  /**
+   * Network connections for this Harness, for granting access to resources such
+   * as a database. Only available when the Harness runs in a VPC.
+   */
+  public get connections(): ec2.Connections {
+    if (!this._connections) {
+      throw new Error(
+        'Connections are only available when the Harness runs in a VPC. Supply the vpc prop.',
+      );
+    }
+    return this._connections;
+  }
+
+  /** The deployed Harness ARN. */
+  public get harnessArn(): string {
+    return this.harness.attrArn;
+  }
+
+  /** Add permissions required by tools, skills, memory, or custom models. */
+  public addToRolePolicy(
+    statement: iam.PolicyStatement,
+  ): iam.AddToPrincipalPolicyResult {
+    return this.executionRole.addToPrincipalPolicy(statement);
+  }
+
+  /** Grant an IAM principal permission to invoke this Harness. */
+  public grantInvokeAccess(grantee: iam.IGrantable): iam.Grant {
+    return iam.Grant.addToPrincipal({
+      grantee,
+      actions: [
+        'bedrock-agentcore:InvokeHarness',
+        'bedrock-agentcore:InvokeAgentRuntime',
+      ],
+      resourceArns: [this.harness.attrArn],
+    });
+  }
+}

package/src/utils/agent-core-constructs/files/terraform/app/agentcore-harness/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -0,0 +1,282 @@
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "<%- randomProviderVersion %>"
+    }
+  }
+}
+
+variable "model_id" {
+  description = "Amazon Bedrock model or inference profile used by default."
+  type        = string
+  default     = "global.anthropic.claude-sonnet-4-6"
+}
+
+variable "model_resource_arns" {
+  description = "Bedrock model and inference-profile ARNs the execution role may invoke. Defaults to every foundation model plus this account's Bedrock resources in the deployment region; replace with narrower ARNs to restrict baseline model access."
+  type        = set(string)
+  default     = null
+}
+
+variable "additional_execution_role_policy_statements" {
+  description = "Additional least-privilege IAM policy statements required by configured optional capabilities (e.g. customer-owned Gateways, memory, custom browsers or code interpreters, skills, secrets). Sid and Condition are optional; null fields are omitted from the rendered policy."
+  type = list(object({
+    Sid       = optional(string)
+    Effect    = string
+    Action    = list(string)
+    Resource  = list(string)
+    Condition = optional(any)
+  }))
+  default = []
+}
+
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+data "aws_region" "current" {}
+
+resource "random_id" "unique_suffix" {
+  byte_length = 4
+}
+
+locals {
+  account_id = data.aws_caller_identity.current.account_id
+  partition  = data.aws_partition.current.partition
+  region     = data.aws_region.current.region
+
+  # Capped at 31 characters so the suffix keeps the deployed Harness name
+  # within its 40-character limit.
+  harness_name_prefix = "<%- harnessNamePrefix %>"
+  harness_name        = "${local.harness_name_prefix}_${random_id.unique_suffix.hex}"
+
+  # Set var.model_resource_arns to narrow the default model access.
+  model_resource_arns = var.model_resource_arns != null ? var.model_resource_arns : [
+    "arn:${local.partition}:bedrock:*::foundation-model/*",
+    "arn:${local.partition}:bedrock:${local.region}:${local.account_id}:*",
+  ]
+}
+
+resource "aws_iam_role" "execution_role" {
+  name = "${local.harness_name_prefix}-HarnessRole-${random_id.unique_suffix.hex}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Principal = {
+        Service = "bedrock-agentcore.amazonaws.com"
+      }
+      Action = "sts:AssumeRole"
+      Condition = {
+        StringEquals = {
+          "aws:SourceAccount" = local.account_id
+        }
+        ArnLike = {
+          "aws:SourceArn" = "arn:${local.partition}:bedrock-agentcore:${local.region}:${local.account_id}:*"
+        }
+      }
+    }]
+  })
+}
+
+# Baseline permissions per the AgentCore Harness security guidance; extend for
+# customer-owned resources via var.additional_execution_role_policy_statements.
+# https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-security.html
+resource "aws_iam_role_policy" "execution_role" {
+  name = "${local.harness_name_prefix}-HarnessPolicy"
+  role = aws_iam_role.execution_role.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = concat([
+      {
+        Sid    = "BedrockModelInvocation"
+        Effect = "Allow"
+        Action = [
+          "bedrock:InvokeModel",
+          "bedrock:InvokeModelWithResponseStream",
+        ]
+        Resource = local.model_resource_arns
+      },
+      {
+        #checkov:skip=CKV_AWS_355:EcrPublicTokenAccess requires a wildcard resource; ecr-public:GetAuthorizationToken has no resource-level permission
+        Sid      = "EcrPublicTokenAccess"
+        Effect   = "Allow"
+        Action   = ["ecr-public:GetAuthorizationToken"]
+        Resource = ["*"]
+      },
+      {
+        #checkov:skip=CKV_AWS_355:StsForEcrPublicPull requires a wildcard resource; sts:GetServiceBearerToken has no resource-level permission
+        Sid      = "StsForEcrPublicPull"
+        Effect   = "Allow"
+        Action   = ["sts:GetServiceBearerToken"]
+        Resource = ["*"]
+      },
+      {
+        #checkov:skip=CKV_AWS_355:XRayTracingAccess requires a wildcard resource; the X-Ray segment and sampling APIs have no resource-level permission
+        #checkov:skip=CKV_AWS_290:XRayTracingAccess requires a wildcard resource; the X-Ray segment and sampling APIs have no resource-level permission
+        Sid    = "XRayTracingAccess"
+        Effect = "Allow"
+        Action = [
+          "xray:PutTraceSegments",
+          "xray:PutTelemetryRecords",
+          "xray:GetSamplingRules",
+          "xray:GetSamplingTargets",
+        ]
+        Resource = ["*"]
+      },
+      {
+        Sid    = "CloudWatchLogsGroup"
+        Effect = "Allow"
+        Action = [
+          "logs:CreateLogGroup",
+          "logs:DescribeLogStreams",
+        ]
+        Resource = [
+          "arn:${local.partition}:logs:${local.region}:${local.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*",
+        ]
+      },
+      {
+        Sid      = "CloudWatchLogsDescribeGroups"
+        Effect   = "Allow"
+        Action   = ["logs:DescribeLogGroups"]
+        Resource = ["arn:${local.partition}:logs:${local.region}:${local.account_id}:log-group:*"]
+      },
+      {
+        Sid    = "CloudWatchLogsStream"
+        Effect = "Allow"
+        Action = [
+          "logs:CreateLogStream",
+          "logs:PutLogEvents",
+        ]
+        Resource = [
+          "arn:${local.partition}:logs:${local.region}:${local.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*",
+        ]
+      },
+      {
+        #checkov:skip=CKV_AWS_355:CloudWatchMetricsPublish requires a wildcard resource; cloudwatch:PutMetricData is scoped by the namespace condition instead
+        #checkov:skip=CKV_AWS_290:CloudWatchMetricsPublish requires a wildcard resource; cloudwatch:PutMetricData is scoped by the namespace condition instead
+        Sid      = "CloudWatchMetricsPublish"
+        Effect   = "Allow"
+        Action   = ["cloudwatch:PutMetricData"]
+        Resource = ["*"]
+        Condition = {
+          StringEquals = {
+            "cloudwatch:namespace" = "bedrock-agentcore"
+          }
+        }
+      },
+      {
+        Sid    = "AgentCoreWorkloadIdentity"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:GetWorkloadAccessToken",
+          "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
+        ]
+        Resource = [
+          "arn:${local.partition}:bedrock-agentcore:${local.region}:${local.account_id}:workload-identity-directory/default",
+          "arn:${local.partition}:bedrock-agentcore:${local.region}:${local.account_id}:workload-identity-directory/default/workload-identity/harness_${local.harness_name}-*",
+        ]
+      },
+      # The service names the managed memory from the harness name plus a
+      # generated suffix, so this scopes to that prefix.
+      {
+        Sid    = "AgentCoreManagedMemory"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:CreateEvent",
+          "bedrock-agentcore:DeleteEvent",
+          "bedrock-agentcore:GetEvent",
+          "bedrock-agentcore:ListEvents",
+          "bedrock-agentcore:RetrieveMemoryRecords",
+        ]
+        Resource = [
+          "arn:${local.partition}:bedrock-agentcore:${local.region}:${local.account_id}:memory/${local.harness_name}-*",
+        ]
+      },
+      {
+        Sid    = "AgentCoreBrowserDefault"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:StartBrowserSession",
+          "bedrock-agentcore:StopBrowserSession",
+          "bedrock-agentcore:GetBrowserSession",
+          "bedrock-agentcore:ListBrowserSessions",
+          "bedrock-agentcore:UpdateBrowserStream",
+          "bedrock-agentcore:ConnectBrowserAutomationStream",
+          "bedrock-agentcore:ConnectBrowserLiveViewStream",
+        ]
+        Resource = [
+          "arn:${local.partition}:bedrock-agentcore:${local.region}:aws:browser/*",
+        ]
+      },
+      {
+        Sid    = "AgentCoreCodeInterpreterDefault"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:StartCodeInterpreterSession",
+          "bedrock-agentcore:StopCodeInterpreterSession",
+          "bedrock-agentcore:GetCodeInterpreterSession",
+          "bedrock-agentcore:ListCodeInterpreterSessions",
+          "bedrock-agentcore:InvokeCodeInterpreter",
+        ]
+        Resource = [
+          "arn:${local.partition}:bedrock-agentcore:${local.region}:aws:code-interpreter/*",
+        ]
+      },
+      ], [
+      # Null Sid/Condition fields are dropped from the rendered policy.
+      for statement in var.additional_execution_role_policy_statements :
+      { for key, value in statement : key => value if value != null }
+    ])
+  })
+}
+
+# Omitting authorizer_configuration uses IAM inbound authorization; add a
+# custom_jwt_authorizer block to change that.
+resource "aws_bedrockagentcore_harness" "this" {
+  harness_name       = local.harness_name
+  execution_role_arn = aws_iam_role.execution_role.arn
+
+  model {
+    bedrock_model_config {
+      model_id = var.model_id
+    }
+  }
+
+  # Read at plan time; the walk up from path.module reaches the workspace root.
+  system_prompt {
+    text = file("${path.module}/../../../../../../../<%- promptPathFromTerraform %>")
+  }
+
+  depends_on = [aws_iam_role_policy.execution_role]
+}
+
+module "add_harness_arn_to_runtime_config" {
+  source = "../../../core/runtime-config/entry"
+
+  namespace = "agentcore"
+  key       = "harnesses"
+  value     = { "<%- nameClassName %>" = aws_bedrockagentcore_harness.this.arn }
+}
+
+output "harness_id" {
+  description = "ID of the Amazon Bedrock AgentCore Harness"
+  value       = aws_bedrockagentcore_harness.this.harness_id
+}
+
+output "harness_arn" {
+  description = "ARN of the Amazon Bedrock AgentCore Harness"
+  value       = aws_bedrockagentcore_harness.this.arn
+}
+
+output "execution_role_arn" {
+  description = "ARN of the IAM role assumed by the Harness"
+  value       = aws_iam_role.execution_role.arn
+}