konokenj.cdk-api-mcp-server 0.49.0__py3-none-any.whl → 0.51.0__py3-none-any.whl

cdk_api_mcp_server/resources/aws-cdk/constructs/@aws-cdk/aws-bedrock-agentcore-alpha/README.md

@@ -0,0 +1,796 @@
+# Amazon Bedrock AgentCore Construct Library
+
+<!--BEGIN STABILITY BANNER-->
+
+---
+
+![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)
+
+> The APIs of higher level constructs in this module are experimental and under active development.
+> They are subject to non-backward compatible changes or removal in any future version. These are
+> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be
+> announced in the release notes. This means that while you may use them, you may need to update
+> your source code when upgrading to a newer version of this package.
+
+---
+
+<!--END STABILITY BANNER-->
+
+| **Language**                                                                                   | **Package**                             |
+| :--------------------------------------------------------------------------------------------- | --------------------------------------- |
+| ![Typescript Logo](https://docs.aws.amazon.com/cdk/api/latest/img/typescript32.png) TypeScript | `@aws-cdk/aws-bedrock-agentcore-alpha` |
+
+[Amazon Bedrock AgentCore](https://aws.amazon.com/bedrock/agentcore/) enables you to deploy and operate highly capable AI agents securely, at scale. It offers infrastructure purpose-built for dynamic agent workloads, powerful tools to enhance agents, and essential controls for real-world deployment. AgentCore services can be used together or independently and work with any framework including CrewAI, LangGraph, LlamaIndex, and Strands Agents, as well as any foundation model in or outside of Amazon Bedrock, giving you ultimate flexibility. AgentCore eliminates the undifferentiated heavy lifting of building specialized agent infrastructure, so you can accelerate agents to production.
+
+This construct library facilitates the deployment of Bedrock AgentCore primitives, enabling you to create sophisticated AI applications that can interact with your systems and data sources.
+
+## Table of contents
+
+- [AgentCore Runtime](#agentcore-runtime)
+  - [Runtime Versioning](#runtime-versioning)
+  - [Runtime Endpoints](#runtime-endpoints)
+  - [AgentCore Runtime Properties](#agentcore-runtime-properties)
+  - [Runtime Endpoint Properties](#runtime-endpoint-properties)
+  - [Creating a Runtime](#creating-a-runtime)
+    - [Option 1: Use an existing image in ECR](#option-1-use-an-existing-image-in-ecr)
+    - [Managing Endpoints and Versions](#managing-endpoints-and-versions)
+    - [Option 2: Use a local asset](#option-2-use-a-local-asset)
+- [Browser Custom tool](#browser)
+  - [Browser properties](#browser-properties)
+  - [Browser Network modes](#browser-network-modes)
+  - [Basic Browser Creation](#basic-browser-creation)
+  - [Browser IAM permissions](#browser-iam-permissions)
+- [Code Interpreter Custom tool](#code-interpreter)
+  - [Code Interpreter properties](#code-interpreter-properties)
+  - [Code Interpreter Network Modes](#code-interpreter-network-modes)
+  - [Basic Code Interpreter Creation](#basic-code-interpreter-creation)
+  - [Code Interpreter IAM permissions](#code-interpreter-iam-permissions)
+
+
+## AgentCore Runtime
+
+The AgentCore Runtime construct enables you to deploy containerized agents on Amazon Bedrock AgentCore.
+This L2 construct simplifies runtime creation just pass your ECR repository name
+and the construct handles all the configuration with sensible defaults.
+
+### Runtime Endpoints
+
+Endpoints provide a stable way to invoke specific versions of your agent runtime, enabling controlled deployments across different environments.
+When you create an agent runtime, Amazon Bedrock AgentCore automatically creates a "DEFAULT" endpoint which always points to the latest version
+of runtime.
+
+You can create additional endpoints in two ways:
+
+1. **Using Runtime.addEndpoint()** - Convenient method when creating endpoints alongside the runtime.
+2. **Using RuntimeEndpoint** - Flexible approach for existing runtimes.
+
+For example, you might keep a "production" endpoint on a stable version while testing newer versions
+through a "staging" endpoint. This separation allows you to test changes thoroughly before promoting them
+to production by simply updating the endpoint to point to the newer version.
+
+### AgentCore Runtime Properties
+
+| Name | Type | Required | Description |
+|------|------|----------|-------------|
+| `runtimeName` | `string` | Yes | The name of the agent runtime. Valid characters are a-z, A-Z, 0-9, _ (underscore). Must start with a letter and can be up to 48 characters long |
+| `agentRuntimeArtifact` | `AgentRuntimeArtifact` | Yes | The artifact configuration for the agent runtime containing the container configuration with ECR URI |
+| `executionRole` | `iam.IRole` | No | The IAM role that provides permissions for the agent runtime. If not provided, a role will be created automatically |
+| `networkConfiguration` | `NetworkConfiguration` | No | Network configuration for the agent runtime. Defaults to `RuntimeNetworkConfiguration.usingPublicNetwork()` |
+| `description` | `string` | No | Optional description for the agent runtime |
+| `protocolConfiguration` | `ProtocolType` | No | Protocol configuration for the agent runtime. Defaults to `ProtocolType.HTTP` |
+| `authorizerConfiguration` | `RuntimeAuthorizerConfiguration` | No | Authorizer configuration for the agent runtime. Use `RuntimeAuthorizerConfiguration` static methods to create configurations for IAM, Cognito, JWT, or OAuth authentication |
+| `environmentVariables` | `{ [key: string]: string }` | No | Environment variables for the agent runtime. Maximum 50 environment variables |
+| `tags` | `{ [key: string]: string }` | No | Tags for the agent runtime. A list of key:value pairs of tags to apply to this Runtime resource |
+
+### Runtime Endpoint Properties
+
+| Name | Type | Required | Description |
+|------|------|----------|-------------|
+| `endpointName` | `string` | Yes | The name of the runtime endpoint. Valid characters are a-z, A-Z, 0-9, _ (underscore). Must start with a letter and can be up to 48 characters long |
+| `agentRuntimeId` | `string` | Yes | The Agent Runtime ID for this endpoint |
+| `agentRuntimeVersion` | `string` | Yes | The Agent Runtime version for this endpoint. Must be between 1 and 5 characters long.|
+| `description` | `string` | No | Optional description for the runtime endpoint |
+| `tags` | `{ [key: string]: string }` | No | Tags for the runtime endpoint |
+
+### Creating a Runtime
+
+#### Option 1: Use an existing image in ECR
+
+Reference an image available within ECR.
+
+```typescript
+const repository = new ecr.Repository(this, "TestRepository", {
+  repositoryName: "test-agent-runtime",
+});
+
+// The runtime by default create ECR permission only for the repository available in the account the stack is being deployed
+const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");
+
+// Create runtime using the built image
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifact
+});
+```
+
+To grant the runtime permission to invoke a Bedrock model or inference profile:
+
+```typescript fixture=default
+// Note: This example uses @aws-cdk/aws-bedrock-alpha which must be installed separately
+declare const runtime: agentcore.Runtime;
+
+// Create a cross-region inference profile for Claude 3.7 Sonnet
+const inferenceProfile = bedrock.CrossRegionInferenceProfile.fromConfig({
+  geoRegion: bedrock.CrossRegionInferenceProfileRegion.US,
+  model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_7_SONNET_V1_0
+});
+
+// Grant the runtime permission to invoke the inference profile
+inferenceProfile.grantInvoke(runtime);
+```
+
+#### Option 2: Use a local asset
+
+Reference a local directory containing a Dockerfile.
+Images are built from a local Docker context directory (with a Dockerfile), uploaded to Amazon Elastic Container Registry (ECR)
+by the CDK toolkit,and can be naturally referenced in your CDK app .
+
+```typescript
+const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromAsset(
+  path.join(__dirname, "path to agent dockerfile directory")
+);
+
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifact,
+});
+```
+
+### Runtime Versioning
+
+Amazon Bedrock AgentCore automatically manages runtime versioning to ensure safe deployments and rollback capabilities.
+When you create an agent runtime, AgentCore automatically creates version 1 (V1). Each subsequent update to the
+runtime configuration (such as updating the container image, modifying network settings, or changing protocol configurations)
+creates a new immutable version. These versions contain complete, self-contained configurations that can be referenced by endpoints,
+allowing you to maintain different versions for different environments or gradually roll out updates.
+
+#### Managing Endpoints and Versions
+
+Amazon Bedrock AgentCore automatically manages runtime versioning to provide safe deployments and rollback capabilities. You can follow
+the steps below to understand how to use versioning with runtime for controlled deployments across different environments.
+
+##### Step 1: Initial Deployment
+
+When you first create an agent runtime, AgentCore automatically creates Version 1 of your runtime. At this point, a DEFAULT endpoint is
+automatically created that points to Version 1. This DEFAULT endpoint serves as the main access point for your runtime.
+
+```ts
+const repository = new ecr.Repository(this, "TestRepository", {
+  repositoryName: "test-agent-runtime",
+});
+
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0"),
+});
+```
+
+##### Step 2: Creating Custom Endpoints
+
+After the initial deployment, you can create additional endpoints for different environments. For example, you might create a "production"
+endpoint that explicitly points to Version 1. This allows you to maintain stable access points for specific environments while keeping the
+flexibility to test newer versions elsewhere.
+
+```ts
+const repository = new ecr.Repository(this, "TestRepository", {
+  repositoryName: "test-agent-runtime",
+});
+
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0"),
+});
+
+const prodEndpoint = runtime.addEndpoint("production", {
+  version: "1",
+  description: "Stable production endpoint - pinned to v1"
+});
+```
+
+##### Step 3: Runtime Update Deployment
+
+When you update the runtime configuration (such as updating the container image, modifying network settings, or changing protocol
+configurations), AgentCore automatically creates a new version (Version 2). Upon this update:
+
+- Version 2 is created automatically with the new configuration
+- The DEFAULT endpoint automatically updates to point to Version 2
+- Any explicitly pinned endpoints (like the production endpoint) remain on their specified versions
+
+```ts
+const repository = new ecr.Repository(this, "TestRepository", {
+  repositoryName: "test-agent-runtime",
+});
+
+const agentRuntimeArtifactNew = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v2.0.0");
+
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifactNew,
+});
+```
+
+##### Step 4: Testing with Staging Endpoints
+
+Once Version 2 exists, you can create a staging endpoint that points to the new version. This staging endpoint allows you to test the
+new version in a controlled environment before promoting it to production. This separation ensures that production traffic continues
+to use the stable version while you validate the new version.
+
+```ts
+const repository = new ecr.Repository(this, "TestRepository", {
+  repositoryName: "test-agent-runtime",
+});
+
+const agentRuntimeArtifactNew = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v2.0.0");
+
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifactNew,
+});
+
+const stagingEndpoint = runtime.addEndpoint("staging", {
+  version: "2",
+  description: "Staging environment for testing new version"
+});
+```
+
+##### Step 5: Promoting to Production
+
+After thoroughly testing the new version through the staging endpoint, you can update the production endpoint to point to Version 2.
+This controlled promotion process ensures that you can validate changes before they affect production traffic.
+
+```ts
+const repository = new ecr.Repository(this, "TestRepository", {
+  repositoryName: "test-agent-runtime",
+});
+
+const agentRuntimeArtifactNew = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v2.0.0");
+
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifactNew,
+});
+
+const prodEndpoint = runtime.addEndpoint("production", {
+  version: "2",  // New version added here
+  description: "Stable production endpoint"
+});
+```
+
+### Creating Standalone Runtime Endpoints
+
+RuntimeEndpoint can also be created as a standalone resource.
+
+#### Example: Creating an endpoint for an existing runtime
+
+```typescript
+// Reference an existing runtime by its ID
+const existingRuntimeId = "abc123-runtime-id"; // The ID of an existing runtime
+
+// Create a standalone endpoint
+const endpoint = new agentcore.RuntimeEndpoint(this, "MyEndpoint", {
+  endpointName: "production",
+  agentRuntimeId: existingRuntimeId,
+  agentRuntimeVersion: "1", // Specify which version to use
+  description: "Production endpoint for existing runtime"
+});
+```
+
+### Runtime Authentication Configuration
+
+The AgentCore Runtime supports multiple authentication modes to secure access to your agent endpoints. Authentication is configured during runtime creation using the `RuntimeAuthorizerConfiguration` class's static factory methods.
+
+#### IAM Authentication (Default)
+
+IAM authentication is the default mode, when no authorizerConfiguration is set then the underlying service use IAM.
+
+#### Cognito Authentication
+
+To configure AWS Cognito User Pool authentication:
+
+```typescript
+const repository = new ecr.Repository(this, "TestRepository", {
+  repositoryName: "test-agent-runtime",
+});
+const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");
+
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifact,
+  authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingCognito(
+    "us-west-2_ABC123",  // User Pool ID (required)
+    "client123",         // Client ID (required)
+    "us-west-2"         // Region (optional, defaults to stack region)
+  ),
+});
+```
+
+#### JWT Authentication
+
+To configure custom JWT authentication with your own OpenID Connect (OIDC) provider:
+
+```typescript
+const repository = new ecr.Repository(this, "TestRepository", {
+  repositoryName: "test-agent-runtime",
+});
+const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");
+
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifact,
+  authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingJWT(
+    "https://example.com/.well-known/openid-configuration",  // Discovery URL (required)
+    ["client1", "client2"],  // Allowed Client IDs (optional)
+    ["audience1"]           // Allowed Audiences (optional)
+  ),
+});
+```
+
+**Note**: The discovery URL must end with `/.well-known/openid-configuration`.
+
+#### OAuth Authentication
+
+To configure OAuth 2.0 authentication:
+
+```typescript
+const repository = new ecr.Repository(this, "TestRepository", {
+  repositoryName: "test-agent-runtime",
+});
+const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");
+
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifact,
+  authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingOAuth(
+    "https://github.com/.well-known/openid-configuration",  
+    "oauth_client_123",  
+  ),
+});
+```
+
+#### Using a Custom IAM Role
+
+Instead of using the auto-created execution role, you can provide your own IAM role with specific permissions:
+The auto-created role includes all necessary baseline permissions for ECR access, CloudWatch logging, and X-Ray tracing. When providing a custom role, ensure these permissions are included.
+
+### Runtime Network Configuration
+
+The AgentCore Runtime supports two network modes for deployment:
+
+#### Public Network Mode (Default)
+
+By default, runtimes are deployed in PUBLIC network mode, which provides internet access suitable for less sensitive or open-use scenarios:
+
+```typescript
+const repository = new ecr.Repository(this, "TestRepository", {
+  repositoryName: "test-agent-runtime",
+});
+const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");
+
+// Explicitly using public network (this is the default)
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifact,
+  networkConfiguration: agentcore.RuntimeNetworkConfiguration.usingPublicNetwork(),
+});
+```
+
+#### VPC Network Mode
+
+For enhanced security and network isolation, you can deploy your runtime within a VPC:
+
+```typescript
+const repository = new ecr.Repository(this, "TestRepository", {
+  repositoryName: "test-agent-runtime",
+});
+const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");
+
+// Create or use an existing VPC
+const vpc = new ec2.Vpc(this, 'MyVpc', {
+  maxAzs: 2,
+});
+
+// Configure runtime with VPC
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifact,
+  networkConfiguration: agentcore.RuntimeNetworkConfiguration.usingVpc(this, {
+    vpc: vpc,
+    vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
+    // Optionally specify security groups, or one will be created automatically
+    // securityGroups: [mySecurityGroup],
+  }),
+});
+```
+
+#### Managing Security Groups with VPC Configuration
+
+When using VPC mode, the Runtime implements `ec2.IConnectable`, allowing you to manage network access using the `connections` property:
+
+```typescript
+
+const vpc = new ec2.Vpc(this, 'MyVpc', {
+  maxAzs: 2,
+});
+
+const repository = new ecr.Repository(this, "TestRepository", {
+  repositoryName: "test-agent-runtime",
+});
+const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");
+
+// Create runtime with VPC configuration
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifact,
+  networkConfiguration: agentcore.RuntimeNetworkConfiguration.usingVpc(this, {
+    vpc: vpc,
+    vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
+  }),
+});
+
+// Now you can manage network access using the connections property
+// Allow inbound HTTPS traffic from a specific security group
+const webServerSecurityGroup = new ec2.SecurityGroup(this, 'WebServerSG', { vpc });
+runtime.connections.allowFrom(webServerSecurityGroup, ec2.Port.tcp(443), 'Allow HTTPS from web servers');
+
+// Allow outbound connections to a database
+const databaseSecurityGroup = new ec2.SecurityGroup(this, 'DatabaseSG', { vpc });
+runtime.connections.allowTo(databaseSecurityGroup, ec2.Port.tcp(5432), 'Allow PostgreSQL connection');
+
+// Allow outbound HTTPS to anywhere (for external API calls)
+runtime.connections.allowToAnyIpv4(ec2.Port.tcp(443), 'Allow HTTPS outbound');
+```
+
+## Browser
+
+The Amazon Bedrock AgentCore Browser provides a secure, cloud-based browser that enables AI agents to interact with websites. It includes security features such as session isolation, built-in observability through live viewing, CloudTrail logging, and session replay capabilities.
+
+Additional information about the browser tool can be found in the [official documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser-tool.html)
+
+### Browser Network modes
+
+The Browser construct supports the following network modes:
+
+1. **Public Network Mode** (`BrowserNetworkMode.usingPublicNetwork()`) - Default
+
+   - Allows internet access for web browsing and external API calls
+   - Suitable for scenarios where agents need to interact with publicly available websites
+   - Enables full web browsing capabilities
+   - VPC mode is not supported with this option
+
+2. **VPC (Virtual Private Cloud)** (`BrowserNetworkMode.usingVpc()`)
+
+   - Select whether to run the browser in a virtual private cloud (VPC).
+   - By configuring VPC connectivity, you enable secure access to private resources such as databases, internal APIs, and services within your VPC.
+
+    While the VPC itself is mandatory, these are optional:
+    - Subnets - if not provided, CDK will select appropriate subnets from the VPC
+    - Security Groups - if not provided, CDK will create a default security group
+    - Specific subnet selection criteria - you can let CDK choose automatically
+
+For more information on VPC connectivity for Amazon Bedrock AgentCore Browser, please refer to the [official documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html).
+
+### Browser Properties
+
+| Name | Type | Required | Description |
+|------|------|----------|-------------|
+| `browserCustomName` | `string` | Yes | The name of the browser. Must start with a letter and can be up to 48 characters long. Pattern: `[a-zA-Z][a-zA-Z0-9_]{0,47}` |
+| `description` | `string` | No | Optional description for the browser. Can have up to 200 characters |
+| `networkConfiguration` | `BrowserNetworkConfiguration` | No | Network configuration for browser. Defaults to PUBLIC network mode |
+| `recordingConfig` | `RecordingConfig` | No | Recording configuration for browser. Defaults to no recording |
+| `executionRole` | `iam.IRole` | No | The IAM role that provides permissions for the browser to access AWS services. A new role will be created if not provided |
+| `tags` | `{ [key: string]: string }` | No | Tags to apply to the browser resource |
+
+### Basic Browser Creation
+
+```typescript fixture=default
+// Create a basic browser with public network access
+const browser = new agentcore.BrowserCustom(this, "MyBrowser", {
+  browserCustomName: "my_browser",
+  description: "A browser for web automation",
+});
+```
+
+### Browser with Tags
+
+```typescript fixture=default
+// Create a browser with custom tags
+const browser = new agentcore.BrowserCustom(this, "MyBrowser", {
+  browserCustomName: "my_browser",
+  description: "A browser for web automation with tags",
+  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingPublicNetwork(),
+  tags: {
+    Environment: "Production",
+    Team: "AI/ML",
+    Project: "AgentCore",
+  },
+});
+```
+
+### Browser with VPC
+
+```typescript fixture=default
+const browser = new agentcore.BrowserCustom(this, 'BrowserVpcWithRecording', {
+  browserCustomName: 'browser_recording',
+  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingVpc(this, {
+    vpc: new ec2.Vpc(this, 'VPC', { restrictDefaultSecurityGroup: false }),
+  }),
+});
+```
+
+Browser exposes a [connections](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Connections.html) property. This property returns a connections object, which simplifies the process of defining and managing ingress and egress rules for security groups in your AWS CDK applications. Instead of directly manipulating security group rules, you interact with the Connections object of a construct, which then translates your connectivity requirements into the appropriate security group rules. For instance:
+
+```typescript fixture=default
+const vpc = new ec2.Vpc(this, 'testVPC');
+
+const browser = new agentcore.BrowserCustom(this, 'test-browser', {
+  browserCustomName: 'test_browser',
+  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingVpc(this, {
+    vpc: vpc,
+  }),
+});
+
+browser.connections.addSecurityGroup(new ec2.SecurityGroup(this, 'AdditionalGroup', { vpc }));
+```
+
+So security groups can be added after the browser construct creation. You can use methods like allowFrom() and allowTo() to grant ingress access to/egress access from a specified peer over a given portRange. The Connections object automatically adds the necessary ingress or egress rules to the security group(s) associated with the calling construct.
+
+### Browser with Recording Configuration
+
+```typescript fixture=default
+// Create an S3 bucket for recordings
+const recordingBucket = new s3.Bucket(this, "RecordingBucket", {
+  bucketName: "my-browser-recordings",
+  removalPolicy: RemovalPolicy.DESTROY, // For demo purposes
+});
+
+// Create browser with recording enabled
+const browser = new agentcore.BrowserCustom(this, "MyBrowser", {
+  browserCustomName: "my_browser",
+  description: "Browser with recording enabled",
+  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingPublicNetwork(),
+  recordingConfig: {
+    enabled: true,
+    s3Location: {
+      bucketName: recordingBucket.bucketName,
+      objectKey: "browser-recordings/",
+    },
+  },
+});
+```
+
+### Browser with Custom Execution Role
+
+```typescript fixture=default
+// Create a custom execution role
+const executionRole = new iam.Role(this, "BrowserExecutionRole", {
+  assumedBy: new iam.ServicePrincipal("bedrock-agentcore.amazonaws.com"),
+  managedPolicies: [
+    iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonBedrockAgentCoreBrowserExecutionRolePolicy"),
+  ],
+});
+
+// Create browser with custom execution role
+const browser = new agentcore.BrowserCustom(this, "MyBrowser", {
+  browserCustomName: "my_browser",
+  description: "Browser with custom execution role",
+  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingPublicNetwork(),
+  executionRole: executionRole,
+});
+```
+
+### Browser with S3 Recording and Permissions
+
+```typescript fixture=default
+// Create an S3 bucket for recordings
+const recordingBucket = new s3.Bucket(this, "RecordingBucket", {
+  bucketName: "my-browser-recordings",
+  removalPolicy: RemovalPolicy.DESTROY, // For demo purposes
+});
+
+// Create browser with recording enabled
+const browser = new agentcore.BrowserCustom(this, "MyBrowser", {
+  browserCustomName: "my_browser",
+  description: "Browser with recording enabled",
+  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingPublicNetwork(),
+  recordingConfig: {
+    enabled: true,
+    s3Location: {
+      bucketName: recordingBucket.bucketName,
+      objectKey: "browser-recordings/",
+    },
+  },
+});
+
+// The browser construct automatically grants S3 permissions to the execution role
+// when recording is enabled, so no additional IAM configuration is needed
+```
+
+### Browser IAM Permissions
+
+The Browser construct provides convenient methods for granting IAM permissions:
+
+```typescript fixture=default
+// Create a browser
+const browser = new agentcore.BrowserCustom(this, "MyBrowser", {
+  browserCustomName: "my_browser",
+  description: "Browser for web automation",
+  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingPublicNetwork(),
+});
+
+// Create a role that needs access to the browser
+const userRole = new iam.Role(this, "UserRole", {
+  assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+});
+
+// Grant read permissions (Get and List actions)
+browser.grantRead(userRole);
+
+// Grant use permissions (Start, Update, Stop actions)
+browser.grantUse(userRole);
+
+// Grant specific custom permissions
+browser.grant(userRole, "bedrock-agentcore:GetBrowserSession");
+```
+
+## Code Interpreter
+
+The Amazon Bedrock AgentCore Code Interpreter enables AI agents to write and execute code securely in sandbox environments, enhancing their accuracy and expanding their ability to solve complex end-to-end tasks. This is critical in Agentic AI applications where the agents may execute arbitrary code that can lead to data compromise or security risks. The AgentCore Code Interpreter tool provides secure code execution, which helps you avoid running into these issues.
+
+For more information about code interpreter, please refer to the [official documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/code-interpreter-tool.html)
+
+### Code Interpreter Network Modes
+
+The Code Interpreter construct supports the following network modes:
+
+1. **Public Network Mode** (`CodeInterpreterNetworkMode.usingPublicNetwork()`) - Default
+
+   - Allows internet access for package installation and external API calls
+   - Suitable for development and testing environments
+   - Enables downloading Python packages from PyPI
+
+2. **Sandbox Network Mode** (`CodeInterpreterNetworkMode.usingSandboxNetwork()`)
+   - Isolated network environment with no internet access
+   - Suitable for production environments with strict security requirements
+   - Only allows access to pre-installed packages and local resources
+
+3. **VPC (Virtual Private Cloud)** (`CodeInterpreterNetworkMode.usingVpc()`)
+   - Select whether to run the browser in a virtual private cloud (VPC).
+   - By configuring VPC connectivity, you enable secure access to private resources such as databases, internal APIs, and services within your VPC.
+
+    While the VPC itself is mandatory, these are optional:
+    - Subnets - if not provided, CDK will select appropriate subnets from the VPC
+    - Security Groups - if not provided, CDK will create a default security group
+    - Specific subnet selection criteria - you can let CDK choose automatically
+
+For more information on VPC connectivity for Amazon Bedrock AgentCore Browser, please refer to the [official documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html).
+
+### Code Interpreter Properties
+
+| Name | Type | Required | Description |
+|------|------|----------|-------------|
+| `codeInterpreterCustomName` | `string` | Yes | The name of the code interpreter. Must start with a letter and can be up to 48 characters long. Pattern: `[a-zA-Z][a-zA-Z0-9_]{0,47}` |
+| `description` | `string` | No | Optional description for the code interpreter. Can have up to 200 characters |
+| `executionRole` | `iam.IRole` | No | The IAM role that provides permissions for the code interpreter to access AWS services. A new role will be created if not provided |
+| `networkConfiguration` | `CodeInterpreterNetworkConfiguration` | No | Network configuration for code interpreter. Defaults to PUBLIC network mode |
+| `tags` | `{ [key: string]: string }` | No | Tags to apply to the code interpreter resource |
+
+### Basic Code Interpreter Creation
+
+```typescript fixture=default
+// Create a basic code interpreter with public network access
+const codeInterpreter = new agentcore.CodeInterpreterCustom(this, "MyCodeInterpreter", {
+  codeInterpreterCustomName: "my_code_interpreter",
+  description: "A code interpreter for Python execution",
+});
+```
+
+### Code Interpreter with VPC
+
+```typescript fixture=default
+const codeInterpreter = new agentcore.CodeInterpreterCustom(this, "MyCodeInterpreter", {
+  codeInterpreterCustomName: "my_sandbox_interpreter",
+  description: "Code interpreter with isolated network access",
+  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingVpc(this, {
+    vpc: new ec2.Vpc(this, 'VPC', { restrictDefaultSecurityGroup: false }),
+  }),
+});
+```
+
+Code Interpreter exposes a [connections](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Connections.html) property. This property returns a connections object, which simplifies the process of defining and managing ingress and egress rules for security groups in your AWS CDK applications. Instead of directly manipulating security group rules, you interact with the Connections object of a construct, which then translates your connectivity requirements into the appropriate security group rules. For instance:
+
+```typescript fixture=default
+const vpc = new ec2.Vpc(this, 'testVPC');
+
+const codeInterpreter = new agentcore.CodeInterpreterCustom(this, "MyCodeInterpreter", {
+  codeInterpreterCustomName: "my_sandbox_interpreter",
+  description: "Code interpreter with isolated network access",
+  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingVpc(this, {
+    vpc: vpc,
+  }),
+});
+
+codeInterpreter.connections.addSecurityGroup(new ec2.SecurityGroup(this, 'AdditionalGroup', { vpc }));
+```
+
+So security groups can be added after the browser construct creation. You can use methods like allowFrom() and allowTo() to grant ingress access to/egress access from a specified peer over a given portRange. The Connections object automatically adds the necessary ingress or egress rules to the security group(s) associated with the calling construct.
+
+### Code Interpreter with Sandbox Network Mode
+
+```typescript fixture=default
+// Create code interpreter with sandbox network mode (isolated)
+const codeInterpreter = new agentcore.CodeInterpreterCustom(this, "MyCodeInterpreter", {
+  codeInterpreterCustomName: "my_sandbox_interpreter",
+  description: "Code interpreter with isolated network access",
+  networkConfiguration: agentcore.CodeInterpreterNetworkConfiguration.usingSandboxNetwork(),
+});
+```
+
+### Code Interpreter with Custom Execution Role
+
+```typescript fixture=default
+// Create a custom execution role
+const executionRole = new iam.Role(this, "CodeInterpreterExecutionRole", {
+  assumedBy: new iam.ServicePrincipal("bedrock-agentcore.amazonaws.com"),
+});
+
+// Create code interpreter with custom execution role
+const codeInterpreter = new agentcore.CodeInterpreterCustom(this, "MyCodeInterpreter", {
+  codeInterpreterCustomName: "my_code_interpreter",
+  description: "Code interpreter with custom execution role",
+  networkConfiguration: agentcore.CodeInterpreterNetworkConfiguration.usingPublicNetwork(),
+  executionRole: executionRole,
+});
+```
+
+### Code Interpreter IAM Permissions
+
+The Code Interpreter construct provides convenient methods for granting IAM permissions:
+
+```typescript fixture=default
+// Create a code interpreter
+const codeInterpreter = new agentcore.CodeInterpreterCustom(this, "MyCodeInterpreter", {
+  codeInterpreterCustomName: "my_code_interpreter",
+  description: "Code interpreter for Python execution",
+  networkConfiguration: agentcore.CodeInterpreterNetworkConfiguration.usingPublicNetwork(),
+});
+
+// Create a role that needs access to the code interpreter
+const userRole = new iam.Role(this, "UserRole", {
+  assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+});
+
+// Grant read permissions (Get and List actions)
+codeInterpreter.grantRead(userRole);
+
+// Grant use permissions (Start, Invoke, Stop actions)
+codeInterpreter.grantUse(userRole);
+
+// Grant specific custom permissions
+codeInterpreter.grant(userRole, "bedrock-agentcore:GetCodeInterpreterSession");
+```
+
+### Code interpreter with tags
+
+```typescript fixture=default
+// Create code interpreter with sandbox network mode (isolated)
+const codeInterpreter = new agentcore.CodeInterpreterCustom(this, "MyCodeInterpreter", {
+  codeInterpreterCustomName: "my_sandbox_interpreter",
+  description: "Code interpreter with isolated network access",
+  networkConfiguration: agentcore.CodeInterpreterNetworkConfiguration.usingPublicNetwork(),
+  tags: {
+    Environment: "Production",
+    Team: "AI/ML",
+    Project: "AgentCore",
+  },
+});
+```