Amazon Bedrock AgentCore 入門 - AI エージェントを自作しながら 「ハーネス」 の仕組みを学んでみた

AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Bedrock AgentCore hands-on, part 1 of 2.
  Creates the tool Lambda function, its read-only execution role, and the IAM
  service role that AgentCore Gateway assumes. Create this stack before creating
  the gateway in the AgentCore console, and specify GatewayServiceRoleArn as the
  gateway service role instead of letting the console generate one.

Parameters:
  NamePrefix:
    Type: String
    Default: agentcore-handson
    Description: Prefix for the names of the resources created by this stack

  GatewayNamePrefix:
    Type: String
    Default: agentcore-handson-gateway
    Description: >
      Name you will give the gateway in the AgentCore console. The gateway service
      role trust policy is scoped to gateway ARNs starting with this value, so the
      gateway name must begin with exactly this string.

Resources:
  # ---------------------------------------------------------------
  # Lambda execution role (read-only)
  # ---------------------------------------------------------------
  ToolFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${NamePrefix}-lambda-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: describe-alarms-readonly
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              # Read-only on alarms. No write or delete actions are granted.
              - Sid: CloudWatchAlarmsReadOnly
                Effect: Allow
                Action:
                  - cloudwatch:DescribeAlarms
                Resource: '*'
              - Sid: LambdaBasicExecution
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${NamePrefix}-*'

  # ---------------------------------------------------------------
  # The tool itself (Lambda function invoked through AgentCore Gateway)
  # ---------------------------------------------------------------
  ToolFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${NamePrefix}-check-alarms'
      Description: Returns CloudWatch alarms currently in ALARM state (AgentCore tool)
      Runtime: python3.13
      # The handler name must match the function name defined in the code below.
      Handler: index.lambda_handler
      Role: !GetAtt ToolFunctionRole.Arn
      Timeout: 30
      MemorySize: 256
      Code:
        ZipFile: |
          import boto3

          cloudwatch = boto3.client("cloudwatch")

          def lambda_handler(event, context):
              """Return alarms currently in ALARM state (read-only)."""
              resp = cloudwatch.describe_alarms(StateValue="ALARM")

              alarms = []

              # Metric alarms
              for a in resp.get("MetricAlarms", []):
                  alarms.append({
                      "AlarmName": a["AlarmName"],
                      "AlarmType": "Metric",
                      "StateReason": a.get("StateReason"),
                  })

              # Composite alarms are included as well
              for a in resp.get("CompositeAlarms", []):
                  alarms.append({
                      "AlarmName": a["AlarmName"],
                      "AlarmType": "Composite",
                      "StateReason": a.get("StateReason"),
                  })

              return {
                  "alarm_count": len(alarms),
                  "alarms": alarms,
              }

  # ---------------------------------------------------------------
  # IAM service role assumed by AgentCore Gateway.
  #
  # The console can generate this role automatically, but creating it up front
  # avoids the IAM propagation race that makes target creation fail with
  # "Gateway service is not authorized to perform AssumeRole on Gateway role".
  # ---------------------------------------------------------------
  GatewayServiceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${NamePrefix}-gateway-service-role'
      Description: Service role assumed by AgentCore Gateway to invoke the tool Lambda
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AgentCoreGatewayAssumeRole
            Effect: Allow
            Principal:
              Service: bedrock-agentcore.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              # Confused deputy protection: restrict to this account and to
              # gateways whose name starts with GatewayNamePrefix.
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub 'arn:aws:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:gateway/${GatewayNamePrefix}-*'
      Policies:
        - PolicyName: gateway-base
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: GetGateway
                Effect: Allow
                Action:
                  - bedrock-agentcore:GetGateway
                Resource: !Sub 'arn:aws:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:gateway/${GatewayNamePrefix}-*'
              - Sid: GetConfigurationBundleVersion
                Effect: Allow
                Action:
                  - bedrock-agentcore:GetConfigurationBundleVersion
                Resource: !Sub 'arn:aws:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:configuration-bundle/*'
                Condition:
                  StringEquals:
                    aws:ResourceAccount: !Ref AWS::AccountId
                    aws:RequestedRegion: !Ref AWS::Region
        - PolicyName: gateway-invoke-lambda
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              # Scoped to the single tool function created by this stack.
              - Sid: InvokeToolFunction
                Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: !GetAtt ToolFunction.Arn

Outputs:
  ToolFunctionArn:
    Description: Lambda function ARN to specify as the gateway target
    Value: !GetAtt ToolFunction.Arn
  ToolFunctionName:
    Description: Lambda function name
    Value: !Ref ToolFunction
  GatewayServiceRoleArn:
    Description: Specify this ARN as the gateway service role in the AgentCore console
    Value: !GetAtt GatewayServiceRole.Arn
  RequiredGatewayNamePrefix:
    Description: The gateway name must start with this string to satisfy the trust policy
    Value: !Ref GatewayNamePrefix

AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Bedrock AgentCore hands-on, part 2 of 2.
  Creates a CloudWatch alarm that is intentionally kept in ALARM state, so the
  agent has something to detect. Create this stack after the gateway and the
  harness are ready, right before testing in the playground.

Parameters:
  NamePrefix:
    Type: String
    Default: agentcore-handson
    Description: Prefix for the names of the resources created by this stack

Resources:
  # ---------------------------------------------------------------
  # Alarm used to verify the agent behavior.
  #
  # It watches a custom metric that never receives any data point, and missing
  # data is treated as breaching. As a result the alarm settles into ALARM state
  # without publishing any metric.
  # ---------------------------------------------------------------
  AlwaysAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub '${NamePrefix}-always-alarm'
      AlarmDescription: Kept in ALARM state on purpose for the AgentCore hands-on
      Namespace: !Sub '${NamePrefix}/Dummy'
      MetricName: DummyMetric
      Statistic: Sum
      Period: 60
      EvaluationPeriods: 1
      Threshold: 0
      ComparisonOperator: LessThanOrEqualToThreshold
      # No data is ever published, so the alarm falls to the ALARM side.
      TreatMissingData: breaching

Outputs:
  AlarmName:
    Description: Name of the alarm the agent should detect
    Value: !Ref AlwaysAlarm