【CDK】Amazon Bedrock AgentCore L2 ConstructでStrands Agentsをデプロイしてみた

.
├── agent/
│   ├── agent.py              # Python Agent
│   ├── requirements.txt      # Python依存関係
│   ├── Dockerfile           # コンテナ定義
│   └── .dockerignore
├── lib/
│   └── sample-agentcore-l2-stack.ts  # CDK Stack
├── bin/
│   └── sample-agentcore-l2.ts        # CDK App
└── package.json

cdk init --language=typescript

{
  "dependencies": {
    "aws-cdk-lib": "2.221.0",
    "@aws-cdk/aws-bedrock-agentcore-alpha": "2.221.0-alpha.0",
    "constructs": "^10.0.0"
  }
}

npm install

"""
Simple Strands Agent for AgentCore Runtime
Uses BedrockAgentCoreApp for simplified deployment
"""
from strands import Agent, tool
from strands.models import BedrockModel
from bedrock_agentcore.runtime import BedrockAgentCoreApp

# Initialize the AgentCore app
app = BedrockAgentCoreApp()

@tool
def get_weather(city: str) -> str:
    """
    Get the current weather for a specified city.

    Args:
        city: The name of the city

    Returns:
        A string describing the weather
    """
    # This is a dummy implementation for demonstration
    # In a real application, you would call a weather API
    weather_data = {
        "Tokyo": "晴れ、気温25度",
        "東京": "晴れ、気温25度",
        "Osaka": "曇り、気温22度",
        "大阪": "曇り、気温22度",
        "New York": "Rainy, 18°C",
        "London": "Foggy, 15°C",
    }

    return weather_data.get(city, f"{city}の天気情報は現在利用できません")

@app.entrypoint
async def entrypoint(payload):
    """
    Main entrypoint for the agent.
    This function is called when the agent is invoked.

    Args:
        payload: The input payload containing prompt and optional model config

    Yields:
        Streaming messages from the agent
    """
    # Extract message and model configuration from payload
    message = payload.get("prompt", "")
    model_config = payload.get("model", {})
    model_id = model_config.get("modelId", "anthropic.claude-3-5-haiku-20241022-v1:0")

    # Initialize Bedrock model
    model = BedrockModel(
        model_id=model_id,
        params={"max_tokens": 4096, "temperature": 0.7},
        region="us-west-2"
    )

    # Create agent with the weather tool
    agent = Agent(
        model=model,
        tools=[get_weather],
        system_prompt="""あなたは親切なAIアシスタントです。
ユーザーの質問に丁寧に答えてください。
天気情報が必要な場合は、get_weatherツールを使用してください。"""
    )

    # Stream responses back to the caller
    stream_messages = agent.stream_async(message)
    async for msg in stream_messages:
        if "event" in msg:
            yield msg

if __name__ == "__main__":
    # Run the app when executed directly
    app.run()

strands-agents
bedrock-agentcore

# Dockerfile for AgentCore Runtime
# Must be ARM64 architecture for AgentCore Runtime

FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim

WORKDIR /app

# Configure UV for container environment
ENV UV_SYSTEM_PYTHON=1 \
    UV_COMPILE_BYTECODE=1

# Copy requirements and install dependencies
COPY requirements.txt requirements.txt
RUN uv pip install -r requirements.txt

# Install OpenTelemetry for observability
RUN uv pip install aws-opentelemetry-distro>=0.10.1

# Set AWS region environment variables
ENV AWS_REGION=us-west-2 \
    AWS_DEFAULT_REGION=us-west-2

# Signal that this is running in Docker
ENV DOCKER_CONTAINER=1

# Create non-root user for security
RUN useradd -m -u 1000 bedrock_agentcore
USER bedrock_agentcore

# Expose required ports
EXPOSE 8080
EXPOSE 8000

# Copy application code
COPY . .

# Run the application with OpenTelemetry instrumentation
CMD ["opentelemetry-instrument", "python", "-m", "agent"]

import * as cdk from "aws-cdk-lib";
import * as path from "path";
import { Construct } from "constructs";
import * as agentcore from "@aws-cdk/aws-bedrock-agentcore-alpha";

export class SampleAgentcoreL2Stack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // ローカルのDockerイメージをビルド
    const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromAsset(
      path.join(__dirname, "../agent"),
    );

    // AgentCore Runtime (L2 Construct)
    const runtime = new agentcore.Runtime(this, "StrandsAgentRuntime", {
      runtimeName: "simpleStrandsAgent",
      agentRuntimeArtifact: agentRuntimeArtifact,
      description: "Simple Strands Agent with weather tool",
    });

    // 出力
    new cdk.CfnOutput(this, "RuntimeArn", {
      value: runtime.agentRuntimeArn,
    });
  }
}

cdk deploy

 ✅  SampleAgentcoreL2Stack

✨  Deployment time: 37.77s

Outputs:
SampleAgentcoreL2Stack.RuntimeArn = arn:aws:bedrock-agentcore:us-west-2:123456789012:runtime/simpleStrandsAgent-XXXXX
SampleAgentcoreL2Stack.RuntimeId = simpleStrandsAgent-XXXXX
Stack ARN:
arn:aws:cloudformation:us-west-2:123456789012:stack/SampleAgentcoreL2Stack/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

✨  Total time: 42.09s

{
    "prompt": "こんにちは"
}

出力を生成中...data: {"error": "An error occurred (AccessDeniedException) when calling the ConverseStream operation: User: arn:aws:sts::123456789012:assumed-role/SampleAgentcoreL2Stack-StrandsAgentRuntimeExecution-XXXXX/BedrockAgentCore-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx is not authorized to perform: bedrock:InvokeModelWithResponseStream on resource: arn:aws:bedrock:us-west-2::foundation-model/anthropic.claude-3-5-haiku-20241022-v1:0 because no identity-based policy allows the bedrock:InvokeModelWithResponseStream action", "error_type": "AccessDeniedException", "message": "An error occurred during streaming"}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "logs:CreateLogGroup",
                "logs:DescribeLogStreams"
            ],
            "Resource": "arn:aws:logs:us-west-2:123456789012:log-group:/aws/bedrock-agentcore/runtimes/*",
            "Effect": "Allow",
            "Sid": "LogGroupAccess"
        },
        {
            "Action": "logs:DescribeLogGroups",
            "Resource": "arn:aws:logs:us-west-2:123456789012:log-group:*",
            "Effect": "Allow",
            "Sid": "DescribeLogGroups"
        },
        {
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:us-west-2:123456789012:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*",
            "Effect": "Allow",
            "Sid": "LogStreamAccess"
        },
        {
            "Action": [
                "xray:GetSamplingRules",
                "xray:GetSamplingTargets",
                "xray:PutTelemetryRecords",
                "xray:PutTraceSegments"
            ],
            "Resource": "*",
            "Effect": "Allow",
            "Sid": "XRayAccess"
        },
        {
            "Condition": {
                "StringEquals": {
                    "cloudwatch:namespace": "bedrock-agentcore"
                }
            },
            "Action": "cloudwatch:PutMetricData",
            "Resource": "*",
            "Effect": "Allow",
            "Sid": "CloudWatchMetrics"
        },
        {
            "Action": [
                "bedrock-agentcore:GetWorkloadAccessToken",
                "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
                "bedrock-agentcore:GetWorkloadAccessTokenForUserId"
            ],
            "Resource": [
                "arn:aws:bedrock-agentcore:us-west-2:123456789012:workload-identity-directory/default",
                "arn:aws:bedrock-agentcore:us-west-2:123456789012:workload-identity-directory/default/workload-identity/*"
            ],
            "Effect": "Allow",
            "Sid": "GetAgentAccessToken"
        },
        {
            "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:BatchGetImage",
                "ecr:GetDownloadUrlForLayer"
            ],
            "Resource": "arn:aws:ecr:us-west-2:123456789012:repository/cdk-XXXXX-container-assets-123456789012-us-west-2",
            "Effect": "Allow"
        },
        {
            "Action": "ecr:GetAuthorizationToken",
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

import * as cdk from "aws-cdk-lib";
import * as path from "path";
import { Construct } from "constructs";
import * as agentcore from "@aws-cdk/aws-bedrock-agentcore-alpha";
import * as iam from "aws-cdk-lib/aws-iam";

export class SampleAgentcoreL2Stack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromAsset(
      path.join(__dirname, "../agent"),
    );

    const runtime = new agentcore.Runtime(this, "StrandsAgentRuntime", {
      runtimeName: "simpleStrandsAgent",
      agentRuntimeArtifact: agentRuntimeArtifact,
      description: "Simple Strands Agent with weather tool",
    });

    // Bedrock の呼び出し権限を追加！
    runtime.addToRolePolicy(
      new iam.PolicyStatement({
        effect: iam.Effect.ALLOW,
        actions: [
          "bedrock:InvokeModel",
          "bedrock:InvokeModelWithResponseStream",
        ],
        resources: [
          `arn:aws:bedrock:${this.region}::foundation-model/*`,
        ],
      }),
    );

    new cdk.CfnOutput(this, "RuntimeArn", {
      value: runtime.agentRuntimeArn,
      description: "ARN of the AgentCore Runtime",
      exportName: "AgentRuntimeArn",
    });

    new cdk.CfnOutput(this, "RuntimeId", {
      value: runtime.agentRuntimeId,
      description: "ID of the AgentCore Runtime",
      exportName: "AgentRuntimeId",
    });
  }
}

npm run build
cdk deploy

npm install @aws-cdk/aws-bedrock-alpha

import * as cdk from "aws-cdk-lib";
import * as path from "path";
import { Construct } from "constructs";
import * as agentcore from "@aws-cdk/aws-bedrock-agentcore-alpha";
import * as bedrock from "@aws-cdk/aws-bedrock-alpha";

export class SampleAgentcoreL2Stack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromAsset(
      path.join(__dirname, "../agent"),
    );

    const runtime = new agentcore.Runtime(this, "StrandsAgentRuntime", {
      runtimeName: "simpleStrandsAgent",
      agentRuntimeArtifact: agentRuntimeArtifact,
      description: "Simple Strands Agent with weather tool",
    });

    // BedrockFoundationModelを使った権限付与
    const model = bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_HAIKU_V1_0;
    model.grantInvoke(runtime);

    // 出力は省略
  }
}

import * as cdk from "aws-cdk-lib";
import * as path from "path";
import { Construct } from "constructs";
import * as agentcore from "@aws-cdk/aws-bedrock-agentcore-alpha";
import * as bedrock from "@aws-cdk/aws-bedrock-alpha";

export class SampleAgentcoreL2Stack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromAsset(
      path.join(__dirname, "../agent"),
    );

    const runtime = new agentcore.Runtime(this, "StrandsAgentRuntime", {
      runtimeName: "simpleStrandsAgent",
      agentRuntimeArtifact: agentRuntimeArtifact,
      description: "Simple Strands Agent with weather tool",
    });

    // CrossRegionInferenceProfileを使った権限付与
    const inferenceProfile = bedrock.CrossRegionInferenceProfile.fromConfig({
      geoRegion: bedrock.CrossRegionInferenceProfileRegion.US,
      model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_HAIKU_V1_0
    });
    inferenceProfile.grantInvoke(runtime);

    // 出力は省略
  }
}

{
    "prompt": "東京の天気を教えて"
}

const repository = new ecr.Repository(this, "TestRepository", {
  repositoryName: "test-agent-runtime",
});

// The runtime by default create ECR permission only for the repository available in the account the stack is being deployed
const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");

// Create runtime using the built image
const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
  runtimeName: "myAgent",
  agentRuntimeArtifact: agentRuntimeArtifact
});