bedrock-agentcore-starter-toolkit 0.1.23__tar.gz → 0.1.25__tar.gz

{bedrock_agentcore_starter_toolkit-0.1.23 → bedrock_agentcore_starter_toolkit-0.1.25}/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.1.25] - 2025-10-13
+
+### Changes
+
+- docs: remove preview verbiage following Bedrock AgentCore GA release (#277) (232f172)
+- chore: Add InvokeAgentRuntimeForUser permissions (#275) (9c8a50e)
+- chore: bump version to 0.1.24 (#276) (316fc02)
+
+## [0.1.24] - 2025-10-13
+
+### Changes
+
+- chore: remove workload access permissions from runtime execution policy (#274) (0f5ca36)
+- docs: Add non-admin user permissions to quickstart (#271) (4599529)
+- chore: bump version to 0.1.23 (#272) (598b292)
+
 ## [0.1.23] - 2025-10-11
 
 ### Changes

{bedrock_agentcore_starter_toolkit-0.1.23 → bedrock_agentcore_starter_toolkit-0.1.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bedrock-agentcore-starter-toolkit
-Version: 0.1.23
+Version: 0.1.25
 Summary: A starter toolkit for using Bedrock AgentCore
 Project-URL: Homepage, https://github.com/aws/bedrock-agentcore-starter-toolkit
 Project-URL: Bug Tracker, https://github.com/aws/bedrock-agentcore-starter-toolkit/issues
@@ -121,10 +121,6 @@ AgentCore Import-Agent enables seamless migration of existing Amazon Bedrock Age
 **[Import Agent Quick Start](https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/import-agent/quickstart.html)**
 
 
-## ⚠️ Preview Status
-
-Bedrock AgentCore is currently in public preview.
-
 ## Installation
 
 ### Quick Start

{bedrock_agentcore_starter_toolkit-0.1.23 → bedrock_agentcore_starter_toolkit-0.1.25}/README.md

@@ -74,10 +74,6 @@ AgentCore Import-Agent enables seamless migration of existing Amazon Bedrock Age
 **[Import Agent Quick Start](https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/import-agent/quickstart.html)**
 
 
-## ⚠️ Preview Status
-
-Bedrock AgentCore is currently in public preview.
-
 ## Installation
 
 ### Quick Start

{bedrock_agentcore_starter_toolkit-0.1.23 → bedrock_agentcore_starter_toolkit-0.1.25}/documentation/docs/examples/agentcore-quickstart-example.md

@@ -1,18 +1,16 @@
-
 # AgentCore Quickstart
 
 ## Introduction
 
 Build and deploy a production-ready AI agent in minutes with runtime hosting, memory, secure code execution, and observability. This guide shows how to use [AgentCore Runtime](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agents-tools-runtime.html), [Memory](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/memory.html), [Code Interpreter](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/code-interpreter-tool.html), and [Observability](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability.html).
 
-For Gateway and Identity features, see the [Gateway quickstart](https://github.com/aws/bedrock-agentcore-starter-toolkit/blob/main/documentation/docs/user-guide/gateway/quickstart.md) and [
-Identity quickstart](https://github.com/aws/bedrock-agentcore-starter-toolkit/blob/main/documentation/docs/user-guide/identity/quickstart.md).
+For Gateway and Identity features, see the [Gateway quickstart](https://github.com/aws/bedrock-agentcore-starter-toolkit/blob/main/documentation/docs/user-guide/gateway/quickstart.md) and [Identity quickstart](https://github.com/aws/bedrock-agentcore-starter-toolkit/blob/main/documentation/docs/user-guide/identity/quickstart.md).
 
 ## Prerequisites
 
-- **AWS Permissions** Root users or admin/privileged credentials can skip this step. Others need to attach the [required IAM policy](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-permissions.html#runtime-permissions-starter-toolkit) to their IAM user or role.
+- **AWS Permissions**: Root users or privileged roles (such as admins) can skip this step. Others need to attach the [starter toolkit policy](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-permissions.html#runtime-permissions-starter-toolkit) and [AmazonBedrockAgentCoreFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/BedrockAgentCoreFullAccess.html) managed policy.
 - [AWS CLI version 2.0 or later](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) configured (`aws configure`)
-- **Amazon Bedrock model access enabled for Claude 3.7 Sonnet** (Go to AWS Console → Bedrock → Model access → Enable “Claude 3.7 Sonnet” in your region). For information about using a different model with Strands Agents, see the Model Providers section in the [Strands Agents SDK](https://strandsagents.com/latest/documentation/docs/) documentation.
+- **Amazon Bedrock model access enabled for Claude 3.7 Sonnet** (Go to AWS Console → Bedrock → Model access → Enable "Claude 3.7 Sonnet" in your region). For information about using a different model with Strands Agents, see the Model Providers section in the [Strands Agents SDK](https://strandsagents.com/latest/documentation/docs/) documentation.
 - Python 3.10 or newer
 
 > **Important: Ensure AWS Region Consistency**
@@ -20,7 +18,7 @@ Identity quickstart](https://github.com/aws/bedrock-agentcore-starter-toolkit/bl
 > Ensure the following are all configured to use the **same AWS region**:
 >
 > - Your `aws configure` default region
-> - The region where you’ve enabled Bedrock model access
+> - The region where you've enabled Bedrock model access
 > - All resources created during deployment will use this region
 
 ### Installation
@@ -138,17 +136,21 @@ The AgentCore CLI automates deployment with provisioning.
 ```bash
 agentcore configure -e agentcore_starter_strands.py
 
-# Interactive prompts:
-#   - Execution role (press Enter to auto-create)
-#   - ECR repository (press Enter to auto-create)
-#   - Memory configuration:
-#     - If existing memories found: Choose from list or press Enter to create new
-#     - If creating new: Enable long-term memory extraction? (yes/no) → yes
-#     - **Note**: Short-term memory is always enabled by default
+#Interactive prompts you'll see:
+
+# 1. Execution Role: Press Enter to auto-create or provide existing role ARN/name
+# 2. ECR Repository: Press Enter to auto-create or provide existing ECR URI
+# 3. OAuth Configuration: Configure OAuth authorizer? (yes/no) - Type `no` for this tutorial
+# 4. Request Header Allowlist: Configure request header allowlist? (yes/no) - Type `no` for this tutorial
+# 5. Memory Configuration:
+#    - If existing memories found: Choose from list or press Enter to create new
+#    - If creating new: Enable long-term memory extraction? (yes/no) - Type `yes` for this tutorial
+#    - Note: Short-term memory is always enabled by default
 ```
-**For this tutorial**: When prompted for the execution role, press Enter to auto-create a new role with all required permissions for Runtime, Memory, Code Interpreter, and Observability.
+**For this tutorial**: When prompted for the execution role, press Enter to auto-create a new role with all required permissions for Runtime, Memory, Code Interpreter, and Observability. When prompted for long-term memory, type **yes** for this tutorial.
+
+**Note**: If the memory configuration prompts do not appear during `agentcore configure`, refer to the [Troubleshooting](#troubleshooting) section (Memory Configuration Not Appearing) to ensure the correct toolkit version is installed.
 
-**Note**: If the memory configuration prompts do not appear during `agentcore configure`, refer to the [Memory Configuration Not Appearing](#memory-configuration-not-appearing) troubleshooting section to ensure the correct toolkit version is installed.
 
 ### Deploy to AgentCore
 
@@ -167,15 +169,22 @@ agentcore launch
 **Expected output:**
 
 ```text
-✅ Memory created: bedrock_agentcore_memory_ci_agent_memory-abc123
+✅ Memory created: agentcore_starter_strands_mem-abc123
 Observability is enabled, configuring Transaction Search...
 ✅ Transaction Search configured: resource_policy, trace_destination, indexing_rule
 🔍 GenAI Observability Dashboard:
    https://console.aws.amazon.com/cloudwatch/home?region=us-west-2#gen-ai-observability/agent-core
 ✅ Container deployed to Bedrock AgentCore
-Agent ARN: arn:aws:bedrock-agentcore:us-west-2:123456789:runtime/starter_agent-xyz
+Agent ARN: arn:aws:bedrock-agentcore:us-west-2:123456789:runtime/agentcore_starter_strands-xyz
 ```
 
+**If deployment encounters errors or behaves unexpectedly**, check your configuration:
+```bash
+cat .bedrock_agentcore.yaml  # Review deployed configuration
+agentcore status              # Verify resource provisioning status
+```
+Refer to the [Troubleshooting](#troubleshooting) section if you see any issues.
+
 ## Step 3: Monitor Deployment
 
 Check deployment status:
@@ -184,7 +193,7 @@ Check deployment status:
 agentcore status
 
 # Shows:
-#   Memory ID: bedrock_agentcore_memory_ci_agent_memory-abc123
+#   Memory ID: agentcore_starter_strands_mem-abc123
 #   Memory Status: CREATING (if still provisioning)
 #   Memory Type: STM+LTM (provisioning...) (if creating with LTM)
 #   Memory Type: STM+LTM (3 strategies) (when active with strategies)
@@ -198,7 +207,7 @@ agentcore status
 
 ### Test Short-Term Memory (STM)
 
-Tesing within a single session:
+Testing within a single session:
 
 ```bash
 # Store information (session IDs must be 33+ characters)
@@ -299,43 +308,65 @@ agentcore destroy
 
 ## Troubleshooting
 
-### Memory Configuration Not Appearing
+<details>
+<summary><strong>Memory Configuration Not Appearing</strong></summary>
 
-**“Memory option not showing during `agentcore configure`”:**
+**"Memory option not showing during `agentcore configure`":**
 
 This typically occurs when using an outdated version of the starter toolkit. Ensure you have version 0.1.21 or later installed:
 
 ```bash
-# 1. Verify you're in the correct virtual environment
-which python  # Should show path to .venv/bin/python
+# Step 1: Verify current state
+which python   # Should show .venv/bin/python
+which agentcore  # Currently showing global path
 
-# 2. Check current version
-pip show bedrock-agentcore-starter-toolkit
+# Step 2: Deactivate and reactivate venv to reset PATH
+deactivate
+source .venv/bin/activate
 
-# 3. Force reinstall with cache clearing (version 0.1.21 or later required)
-pip uninstall bedrock-agentcore-starter-toolkit -y
-pip install --no-cache-dir --upgrade "bedrock-agentcore-starter-toolkit>=0.1.21"
+# Step 3: Check if that fixed it
+which agentcore
+# If NOW showing .venv/bin/agentcore -> RESOLVED, skip to Step 7
+# If STILL showing global path -> continue to Step 4
 
-# 4. Verify the installation
-pip show bedrock-agentcore-starter-toolkit
-which agentcore  # Should show path in your .venv/bin/
+# Step 4: Force local venv to take precedence in PATH
+export PATH="$(pwd)/.venv/bin:$PATH"
 
-# 5. If issues persist, create a fresh virtual environment:
-deactivate  # Exit current environment
-rm -rf .venv  # Remove old environment
-python3 -m venv .venv  # Create new environment
-source .venv/bin/activate  # On Windows: .venv\Scripts\activate
+# Step 5: Check again
+which agentcore
+# If NOW showing .venv/bin/agentcore -> RESOLVED, skip to Step 7
+# If STILL showing global path -> continue to Step 6
+
+# Step 6: Reinstall in local venv with forced precedence
+pip install --force-reinstall --no-cache-dir "bedrock-agentcore-starter-toolkit>=0.1.21"
+
+# Step 7: Final verification
+which agentcore  # Must show: /path/to/your-project/.venv/bin/agentcore
+pip show bedrock-agentcore-starter-toolkit  # Verify version >= 0.1.21
+agentcore --version  # Double check it's working
+
+# Step 8: Try configure again
+agentcore configure -e agentcore_starter_strands.py
+
+#If Step 6 still doesn't work, the nuclear option:
+cd ..
+mkdir fresh-agentcore-project && cd fresh-agentcore-project
+python3 -m venv .venv
+source .venv/bin/activate
 pip install --no-cache-dir "bedrock-agentcore-starter-toolkit>=0.1.21" strands-agents boto3
+# Copy your agent code here, then reconfigure
 ```
 
 **Additional checks:**
 
-- Ensure you’re running `agentcore configure` from within the activated virtual environment
+- Ensure you're running `agentcore configure` from within the activated virtual environment
 - If using an IDE (VSCode, PyCharm), restart the IDE after reinstalling
 - Verify no system-wide agentcore installation conflicts: `pip list | grep bedrock-agentcore`
 
+</details>
 
-### Region Misconfiguration
+<details>
+<summary><strong>Region Misconfiguration</strong></summary>
 
 **If you need to change your region configuration:**
 
@@ -357,24 +388,32 @@ pip install --no-cache-dir "bedrock-agentcore-starter-toolkit>=0.1.21" strands-a
    # Or reconfigure for the correct region:
    aws configure set region <your-desired-region>
    ```
+
 3. Ensure Bedrock model access is enabled in the target region (AWS Console → Bedrock → Model access)
+
 4. Copy your agent code and requirements.txt to the new folder, then return to **Step 2: Configure and Deploy**
 
-### Memory Issues
+</details>
 
-**“Memory status is not active” error:**
+<details>
+<summary><strong>Memory Issues</strong></summary>
+
+**"Memory status is not active" error:**
 
 - Run `agentcore status` to check memory status
-- If showing “provisioning”, wait 2-3 minutes
-- Retry after status shows “STM+LTM (3 strategies)”
+- If showing "provisioning", wait 2-3 minutes
+- Retry after status shows "STM+LTM (3 strategies)"
 
 **Cross-session memory not working:**
 
-- Verify LTM is active (not “provisioning”)
+- Verify LTM is active (not "provisioning")
 - Wait 15-30 seconds after storing facts for extraction
 - Check extraction logs for completion
 
-### Observability Issues
+</details>
+
+<details>
+<summary><strong>Observability Issues</strong></summary>
 
 **No traces appearing:**
 
@@ -388,9 +427,13 @@ pip install --no-cache-dir "bedrock-agentcore-starter-toolkit>=0.1.21" strands-a
 - Check log group exists: `/aws/vendedlogs/bedrock-agentcore/memory/APPLICATION_LOGS/<memory-id>`
 - Verify IAM role has CloudWatch Logs permissions
 
+</details>
+
+---
+
 ## Summary
 
-You’ve deployed a production agent with:
+You've deployed a production agent with:
 
 - **Runtime** for managed container orchestration
 - **Memory** with STM for immediate context and LTM for cross-session persistence
@@ -398,4 +441,4 @@ You’ve deployed a production agent with:
 - **AWS X-Ray Tracing** automatically configured for distributed tracing
 - **CloudWatch Integration** for logs and metrics with Transaction Search enabled
 
-All services are automatically instrumented with X-Ray tracing, providing complete visibility into agent behavior, memory operations, and tool executions through the CloudWatch dashboard.​​​​​​​​​​​​​​​​
+All services are automatically instrumented with X-Ray tracing, providing complete visibility into agent behavior, memory operations, and tool executions through the CloudWatch dashboard.

{bedrock_agentcore_starter_toolkit-0.1.23 → bedrock_agentcore_starter_toolkit-0.1.25}/documentation/docs/index.md

@@ -12,8 +12,6 @@ Amazon Bedrock AgentCore is a comprehensive platform for deploying and operating
   <a href="https://github.com/awslabs/amazon-bedrock-agentcore-samples" class="md-button">Samples</a>
 </div>
 
-!!! warning "Preview Status"
-    Amazon Bedrock AgentCore is currently in preview release. APIs may change as we refine the platform.
 
 ## 🚀 From Local Development to Bedrock AgentCore
 

{bedrock_agentcore_starter_toolkit-0.1.23 → bedrock_agentcore_starter_toolkit-0.1.25}/documentation/docs/user-guide/runtime/permissions.md

@@ -61,121 +61,131 @@ Attach the following policy to your IAM user or role:
 
 ```json
 {
-	"Version": "2012-10-17",
-	"Statement": [
-		{
-			"Sid": "IAMRoleManagement",
-			"Effect": "Allow",
-			"Action": [
-				"iam:CreateRole",
-				"iam:DeleteRole",
-				"iam:GetRole",
-				"iam:PutRolePolicy",
-				"iam:DeleteRolePolicy",
-				"iam:AttachRolePolicy",
-				"iam:DetachRolePolicy",
-				"iam:TagRole",
-				"iam:ListRolePolicies",
-				"iam:ListAttachedRolePolicies"
-			],
-			"Resource": [
-				"arn:aws:iam::*:role/*BedrockAgentCore*",
-				"arn:aws:iam::*:role/service-role/*BedrockAgentCore*"
-			]
-		},
-		{
-			"Sid": "CodeBuildProjectAccess",
-			"Effect": "Allow",
-			"Action": [
-				"codebuild:StartBuild",
-				"codebuild:BatchGetBuilds",
-				"codebuild:ListBuildsForProject",
-				"codebuild:CreateProject",
-				"codebuild:UpdateProject",
-				"codebuild:BatchGetProjects"
-			],
-			"Resource": [
-				"arn:aws:codebuild:*:*:project/bedrock-agentcore-*",
-				"arn:aws:codebuild:*:*:build/bedrock-agentcore-*"
-			]
-		},
-		{
-			"Sid": "CodeBuildListAccess",
-			"Effect": "Allow",
-			"Action": [
-				"codebuild:ListProjects"
-			],
-			"Resource": "*"
-		},
-		{
-			"Sid": "IAMPassRoleAccess",
-			"Effect": "Allow",
-			"Action": [
-				"iam:PassRole"
-			],
-			"Resource": [
-				"arn:aws:iam::*:role/AmazonBedrockAgentCore*",
-				"arn:aws:iam::*:role/service-role/AmazonBedrockAgentCore*"
-			]
-		},
-		{
-			"Sid": "CloudWatchLogsAccess",
-			"Effect": "Allow",
-			"Action": [
-				"logs:GetLogEvents",
-				"logs:DescribeLogGroups",
-				"logs:DescribeLogStreams"
-			],
-			"Resource": [
-				"arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/*",
-				"arn:aws:logs:*:*:log-group:/aws/codebuild/*"
-			]
-		},
-		{
-			"Sid": "S3Access",
-			"Effect": "Allow",
-			"Action": [
-				"s3:GetObject",
-				"s3:PutObject",
-				"s3:ListBucket",
-				"s3:CreateBucket",
-				"s3:PutLifecycleConfiguration"
-			],
-			"Resource": [
-				"arn:aws:s3:::bedrock-agentcore-*",
-				"arn:aws:s3:::bedrock-agentcore-*/*"
-			]
-		},
-		{
-			"Sid": "ECRRepositoryAccess",
-			"Effect": "Allow",
-			"Action": [
-				"ecr:CreateRepository",
-				"ecr:DescribeRepositories",
-				"ecr:GetRepositoryPolicy",
-				"ecr:InitiateLayerUpload",
-				"ecr:CompleteLayerUpload",
-				"ecr:PutImage",
-				"ecr:UploadLayerPart",
-				"ecr:BatchCheckLayerAvailability",
-				"ecr:GetDownloadUrlForLayer",
-				"ecr:BatchGetImage",
-				"ecr:ListImages",
-				"ecr:TagResource"
-			],
-			"Resource": [
-				"arn:aws:ecr:*:*:repository/bedrock-agentcore-*"
-			]
-		},
-		{
-			"Sid": "ECRAuthorizationAccess",
-			"Effect": "Allow",
-			"Action": [
-				"ecr:GetAuthorizationToken"
-			],
-			"Resource": "*"
-		}
-	]
+  "Version": "2012-10-17",
+  "Statement": [{
+      "Sid": "IAMRoleManagement",
+      "Effect": "Allow",
+      "Action": [
+        "iam:CreateRole",
+        "iam:DeleteRole",
+        "iam:GetRole",
+        "iam:PutRolePolicy",
+        "iam:DeleteRolePolicy",
+        "iam:AttachRolePolicy",
+        "iam:DetachRolePolicy",
+        "iam:TagRole",
+        "iam:ListRolePolicies",
+        "iam:ListAttachedRolePolicies"
+      ],
+      "Resource": [
+        "arn:aws:iam::*:role/*BedrockAgentCore*",
+        "arn:aws:iam::*:role/service-role/*BedrockAgentCore*"
+      ]
+    },
+    {
+      "Sid": "CodeBuildProjectAccess",
+      "Effect": "Allow",
+      "Action": [
+        "codebuild:StartBuild",
+        "codebuild:BatchGetBuilds",
+        "codebuild:ListBuildsForProject",
+        "codebuild:CreateProject",
+        "codebuild:UpdateProject",
+        "codebuild:BatchGetProjects"
+      ],
+      "Resource": [
+        "arn:aws:codebuild:*:*:project/bedrock-agentcore-*",
+        "arn:aws:codebuild:*:*:build/bedrock-agentcore-*"
+      ]
+    },
+    {
+      "Sid": "CodeBuildListAccess",
+      "Effect": "Allow",
+      "Action": [
+        "codebuild:ListProjects"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "IAMPassRoleAccess",
+      "Effect": "Allow",
+      "Action": [
+        "iam:PassRole"
+      ],
+      "Resource": [
+        "arn:aws:iam::*:role/AmazonBedrockAgentCore*",
+        "arn:aws:iam::*:role/service-role/AmazonBedrockAgentCore*"
+      ]
+    },
+    {
+      "Sid": "CloudWatchLogsAccess",
+      "Effect": "Allow",
+      "Action": [
+        "logs:GetLogEvents",
+        "logs:DescribeLogGroups",
+        "logs:DescribeLogStreams"
+      ],
+      "Resource": [
+        "arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/*",
+        "arn:aws:logs:*:*:log-group:/aws/codebuild/*"
+      ]
+    },
+    {
+      "Sid": "S3Access",
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject",
+        "s3:PutObject",
+        "s3:ListBucket",
+        "s3:CreateBucket",
+        "s3:PutLifecycleConfiguration"
+      ],
+      "Resource": [
+        "arn:aws:s3:::bedrock-agentcore-*",
+        "arn:aws:s3:::bedrock-agentcore-*/*"
+      ]
+    },
+    {
+      "Sid": "ECRRepositoryAccess",
+      "Effect": "Allow",
+      "Action": [
+        "ecr:CreateRepository",
+        "ecr:DescribeRepositories",
+        "ecr:GetRepositoryPolicy",
+        "ecr:InitiateLayerUpload",
+        "ecr:CompleteLayerUpload",
+        "ecr:PutImage",
+        "ecr:UploadLayerPart",
+        "ecr:BatchCheckLayerAvailability",
+        "ecr:GetDownloadUrlForLayer",
+        "ecr:BatchGetImage",
+        "ecr:ListImages",
+        "ecr:TagResource"
+      ],
+      "Resource": [
+        "arn:aws:ecr:*:*:repository/bedrock-agentcore-*"
+      ]
+    },
+    {
+      "Sid": "ECRAuthorizationAccess",
+      "Effect": "Allow",
+      "Action": [
+        "ecr:GetAuthorizationToken"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "BedrockAgentCoreRuntimeIdentityServiceLinkedRolePermissions",
+      "Effect": "Allow",
+      "Action": "iam:CreateServiceLinkedRole",
+      "Resource": "arn:aws:iam::*:role/aws-service-role/runtime-identity.bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreRuntimeIdentity",
+      "Condition": {
+        "StringEquals": {
+          "iam:AWSServiceName": "runtime-identity.bedrock-agentcore.amazonaws.com"
+        }
+      }
+    }
+  ]
 }
 ```
 
@@ -316,19 +326,6 @@ The Runtime Execution Role is an IAM role that AgentCore Runtime assumes to run
                 }
             }
         },
-        {
-            "Sid": "GetAgentAccessToken",
-            "Effect": "Allow",
-            "Action": [
-                "bedrock-agentcore:GetWorkloadAccessToken",
-                "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
-                "bedrock-agentcore:GetWorkloadAccessTokenForUserId"
-            ],
-            "Resource": [
-                "arn:aws:bedrock-agentcore:region:accountId:workload-identity-directory/default",
-                "arn:aws:bedrock-agentcore:region:accountId:workload-identity-directory/default/workload-identity/agentName-*"
-            ]
-        },
         {
             "Sid": "BedrockModelInvocation",
             "Effect": "Allow",

{bedrock_agentcore_starter_toolkit-0.1.23 → bedrock_agentcore_starter_toolkit-0.1.25}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bedrock-agentcore-starter-toolkit"
-version = "0.1.23"
+version = "0.1.25"
 description = "A starter toolkit for using Bedrock AgentCore"
 readme = "README.md"
 requires-python = ">=3.10"

{bedrock_agentcore_starter_toolkit-0.1.23 → bedrock_agentcore_starter_toolkit-0.1.25}/src/bedrock_agentcore_starter_toolkit/utils/runtime/templates/execution_role_policy.json.j2

@@ -73,7 +73,8 @@
       "Sid": "BedrockAgentCoreRuntime",
       "Effect": "Allow",
       "Action": [
-        "bedrock-agentcore:InvokeAgentRuntime"
+        "bedrock-agentcore:InvokeAgentRuntime",
+        "bedrock-agentcore:InvokeAgentRuntimeForUser"
       ],
       "Resource": [
         "arn:aws:bedrock-agentcore:{{ region }}:{{ account_id }}:runtime/*"
@@ -143,19 +144,6 @@
         "arn:aws:bedrock-agentcore:{{ region }}:{{ account_id }}:workload-identity-directory/default/workload-identity/{{ agent_name }}-*"
       ]
     },
-    {
-      "Sid": "BedrockAgentCoreIdentityGetWorkloadAccessToken",
-      "Effect": "Allow",
-      "Action": [
-        "bedrock-agentcore:GetWorkloadAccessToken",
-        "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
-        "bedrock-agentcore:GetWorkloadAccessTokenForUserId"
-      ],
-      "Resource": [
-        "arn:aws:bedrock-agentcore:{{ region }}:{{ account_id }}:workload-identity-directory/default",
-        "arn:aws:bedrock-agentcore:{{ region }}:{{ account_id }}:workload-identity-directory/default/workload-identity/{{ agent_name }}-*"
-      ]
-    },
     {
       "Sid": "BedrockModelInvocation",
       "Effect": "Allow",

{bedrock_agentcore_starter_toolkit-0.1.23 → bedrock_agentcore_starter_toolkit-0.1.25}/tests/utils/runtime/test_policy_template.py

@@ -129,9 +129,6 @@ class TestPolicyTemplate:
             "xray:GetSamplingRules",
             "xray:GetSamplingTargets",
             "cloudwatch:PutMetricData",
-            "bedrock-agentcore:GetWorkloadAccessToken",
-            "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
-            "bedrock-agentcore:GetWorkloadAccessTokenForUserId",
             "bedrock:InvokeModel",
             "bedrock:InvokeModelWithResponseStream",
         ]

{bedrock_agentcore_starter_toolkit-0.1.23 → bedrock_agentcore_starter_toolkit-0.1.25}/uv.lock

@@ -113,7 +113,7 @@ wheels = [
 
 [[package]]
 name = "bedrock-agentcore-starter-toolkit"
-version = "0.1.23"
+version = "0.1.25"
 source = { editable = "." }
 dependencies = [
     { name = "autopep8" },