I built an API with authentication, streaming, and session management using Strands Agents + Lambda + API Gateway

git clone -b v1 https://github.com/yuu551/lambda-api-strands.git
cd lambda-api-strands
pnpm install
pnpm deploy

lambda-api-strands/
├── bin/
│   └── app.ts              # CDK entry point
├── lib/
│   └── agent-api-stack.ts   # Stack definition
├── lambda/
│   └── handler.ts           # Hono + Strands Agents (agent body)
├── cdk.json
├── package.json
└── tsconfig.json

pnpm init
pnpm add aws-cdk-lib constructs @strands-agents/sdk @aws-sdk/client-s3 hono zod @aws-cdk/aws-lambda-python-alpha
pnpm add -D aws-cdk typescript tsx esbuild @types/node

import { Hono } from 'hono'
import { streamHandle } from 'hono/aws-lambda'
import { streamText } from 'hono/streaming'
import { Agent, BedrockModel, SessionManager, tool } from '@strands-agents/sdk'
import { S3Storage } from '@strands-agents/sdk/storage'
import z from 'zod'

type Bindings = {
  event: {
    requestContext: {
      authorizer: {
        claims: { sub: string; email?: string }
      }
    }
  }
}

const SYSTEM_PROMPT = `You are a helpful assistant that responds in Japanese.
For questions that require the current time, use the get_current_time tool to answer accurately.
Keep your answers concise.`

const getCurrentTime = tool({
  name: 'get_current_time',
  description: 'Returns the current time in Japan Standard Time (JST).',
  inputSchema: z.object({}),
  callback: () =>
    new Date().toLocaleString('ja-JP', { timeZone: 'Asia/Tokyo' }),
})

const app = new Hono<{ Bindings: Bindings }>()

app.post('/invoke', async (c) => {
  const { prompt, sessionId } = await c.req.json<{ prompt: string; sessionId?: string }>()
  if (!prompt) {
    return c.json({ error: 'prompt is required' }, 400)
  }

  // Get the user-specific sub from Cognito JWT claims
  const userSub = c.env.event.requestContext.authorizer.claims.sub

  const sessionManager = new SessionManager({
    sessionId: sessionId ?? 'default',
    // Separate S3 prefix per user
    storage: new S3Storage(process.env.SESSION_BUCKET!, {
      prefix: `sessions/${userSub}/`,
    }),
  })

  const agent = new Agent({
    model: new BedrockModel({ modelId: process.env.MODEL_ID }),
    systemPrompt: SYSTEM_PROMPT,
    tools: [getCurrentTime],
    sessionManager,
    printer: false,
  })

  return streamText(c, async (stream) => {
    for await (const chunk of agent.stream(prompt)) {
      if (
        chunk.type === 'modelStreamUpdateEvent' &&
        chunk.event.type === 'modelContentBlockDeltaEvent' &&
        chunk.event.delta.type === 'textDelta'
      ) {
        await stream.write(chunk.event.delta.text)
      }
    }
  })
})

export const handler = streamHandle(app)

import * as cdk from 'aws-cdk-lib'
import * as apigateway from 'aws-cdk-lib/aws-apigateway'
import * as cognito from 'aws-cdk-lib/aws-cognito'
import * as iam from 'aws-cdk-lib/aws-iam'
import * as lambda from 'aws-cdk-lib/aws-lambda'
import { NodejsFunction, OutputFormat } from 'aws-cdk-lib/aws-lambda-nodejs'
import * as s3 from 'aws-cdk-lib/aws-s3'
import { Construct } from 'constructs'

const MODEL_ID = 'global.anthropic.claude-haiku-4-5-20251001-v1:0'

export class AgentApiStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props)

    // Cognito User Pool
    const userPool = new cognito.UserPool(this, 'AgentUserPool', {
      selfSignUpEnabled: false,
      signInAliases: { email: true },
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    })
    const userPoolClient = userPool.addClient('AgentApiClient', {
      authFlows: { userPassword: true },
    })

    // S3 bucket for session storage
    const sessionBucket = new s3.Bucket(this, 'SessionBucket', {
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
    })

    // Lambda (Hono + Strands Agents TypeScript SDK)
    const agentFunction = new NodejsFunction(this, 'AgentFunction', {
      entry: 'lambda/handler.ts',
      handler: 'handler',
      runtime: lambda.Runtime.NODEJS_24_X,
      architecture: lambda.Architecture.ARM_64,
      timeout: cdk.Duration.minutes(5),
      memorySize: 512,
      environment: {
        MODEL_ID,
        SESSION_BUCKET: sessionBucket.bucketName,
      },
      bundling: {
        format: OutputFormat.ESM,
        banner:
          "import { createRequire } from 'module'; const require = createRequire(import.meta.url);",
      },
    })
    sessionBucket.grantReadWrite(agentFunction)
    agentFunction.addToRolePolicy(
      new iam.PolicyStatement({
        actions: ['bedrock:InvokeModel', 'bedrock:InvokeModelWithResponseStream'],
        resources: ['*'],
      }),
    )

    // API Gateway (REST API) + Cognito authorizer + streaming
    const api = new apigateway.RestApi(this, 'AgentApi', {
      restApiName: 'strands-agent-api',
      deployOptions: { stageName: 'v1' },
    })
    const authorizer = new apigateway.CognitoUserPoolsAuthorizer(this, 'AgentApiAuthorizer', {
      cognitoUserPools: [userPool],
    })
    const methodOptions: apigateway.MethodOptions = {
      authorizer,
      authorizationType: apigateway.AuthorizationType.COGNITO,
    }

    // POST /invoke: respond with streaming
    api.root.addResource('invoke').addMethod(
      'POST',
      new apigateway.LambdaIntegration(agentFunction, {
        responseTransferMode: apigateway.ResponseTransferMode.STREAM,
        timeout: cdk.Duration.minutes(5),
      }),
      methodOptions,
    )

    new cdk.CfnOutput(this, 'ApiEndpoint', { value: api.url })
    new cdk.CfnOutput(this, 'UserPoolId', { value: userPool.userPoolId })
    new cdk.CfnOutput(this, 'UserPoolClientId', { value: userPoolClient.userPoolClientId })
  }
}

pnpm install
npx cdk deploy

✅  AgentApiStack

✨  Deployment time: 61.86s

Outputs:
AgentApiStack.ApiEndpoint = https://xxxxxxxxxx.execute-api.us-east-1.amazonaws.com/v1/
AgentApiStack.UserPoolClientId = xxxxxxxxxxxxxxxxxxxxxxxxxx
AgentApiStack.UserPoolId = us-east-1_xxxxxxxxx

USER_POOL_ID=us-east-1_xxxxxxxxx

aws cognito-idp admin-create-user \
  --user-pool-id $USER_POOL_ID \
  --username test@example.com \
  --message-action SUPPRESS

aws cognito-idp admin-set-user-password \
  --user-pool-id $USER_POOL_ID \
  --username test@example.com \
  --password 'YourPassword123!' \
  --permanent

curl -X POST "$API_ENDPOINT/invoke" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "Hello"}'

{"message":"Unauthorized"}

CLIENT_ID=xxxxxxxxxxxxxxxxxxxxxxxxxx

ID_TOKEN=$(aws cognito-idp initiate-auth \
  --auth-flow USER_PASSWORD_AUTH \
  --client-id $CLIENT_ID \
  --auth-parameters USERNAME=test@example.com,PASSWORD='YourPassword123!' \
  --query 'AuthenticationResult.IdToken' \
  --output text)

curl -N -X POST "$API_ENDPOINT/invoke" \
  -H "Content-Type: application/json" \
  -H "Authorization: $ID_TOKEN" \
  -d '{"prompt":"List 3 AWS services you like","sessionId":"test-1"}'

[+  1.51s] chunk 1: 'AWSの好きなサービスを3つ'
[+  1.54s] chunk 2: '挙げる'
[+  1.55s] chunk 3: 'とす'
(omitted)
[+  2.95s] chunk 63: '的なサービ'
[+  2.98s] chunk 66: 'スです。'
--- first: +1.51s, chunks: 74, done: +3.26s

curl -N -X POST "$API_ENDPOINT/invoke" \
  -H "Content-Type: application/json" \
  -H "Authorization: $ID_TOKEN" \
  -d '{"prompt":"Hello, I am Jinno. My favorite food is curry. Please remember that.","sessionId":"blog-test-1"}'

Hello, Jinno! Nice to meet you.

So your favorite food is curry. Curry is delicious!
Thank you for introducing yourself. I will keep this information in mind during our future conversations.

curl -N -X POST "$API_ENDPOINT/invoke" \
  -H "Content-Type: application/json" \
  -H "Authorization: $ID_TOKEN" \
  -d '{"prompt":"Do you remember my name and favorite food?","sessionId":"blog-test-1"}'

Yes, I remember!

Your name: Jinno
Favorite food: Curry

That's right. I will make use of this information in our future questions and conversations!

sessions/94085448-7071-7023-fd3e-d4866412213a/session/blog-test-1/scopes/agent/agent/snapshots/snapshot_latest.json

import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore'

// AgentCore Memory (align paths with RetrievalConfig on the Python side)
const memory = new agentcore.Memory(this, 'AgentMemory', {
  memoryName: 'lambda_api_strands_memory',
  expirationDuration: cdk.Duration.days(7),
  memoryStrategies: [
    agentcore.MemoryStrategy.usingUserPreference({
      strategyName: 'UserPreference',
      namespaces: ['/preferences/{actorId}/'],
    }),
    agentcore.MemoryStrategy.usingSemantic({
      strategyName: 'SemanticFacts',
      namespaces: ['/facts/{actorId}/'],
    }),
    agentcore.MemoryStrategy.usingSummarization({
      strategyName: 'SessionSummary',
      namespaces: ['/summaries/{actorId}/{sessionId}/'],
    }),
  ],
})
const cfnMemory = memory.node.findChild('Memory') as agentcore.CfnMemory
cfnMemory.applyRemovalPolicy(cdk.RemovalPolicy.DESTROY)

import json
import os
from datetime import datetime, timedelta, timezone

from bedrock_agentcore.memory.integrations.strands.config import (
    AgentCoreMemoryConfig,
    RetrievalConfig,
)
from bedrock_agentcore.memory.integrations.strands.session_manager import (
    AgentCoreMemorySessionManager,
)
from fastapi import FastAPI, Request
from fastapi.responses import JSONResponse, StreamingResponse
from pydantic import BaseModel
from strands import Agent, tool

SYSTEM_PROMPT = """You are a helpful assistant that responds in Japanese.
For questions that require the current time, use the get_current_time tool to answer accurately.
Keep your answers concise.
"""

app = FastAPI()

@tool
def get_current_time() -> str:
    """Returns the current time in Japan Standard Time (JST)."""
    jst = timezone(timedelta(hours=9))
    return datetime.now(jst).strftime("%Y-%m-%d %H:%M:%S")

class InvokeRequest(BaseModel):
    prompt: str
    session_id: str | None = None

def _get_user_sub(request: Request) -> str | None:
    """Returns the Cognito sub. Returns None if it cannot be obtained (caller handles 401)."""
    # LWA (response streaming mode) passes requestContext in x-amzn-request-context
    raw = request.headers.get("x-amzn-request-context")
    if not raw:
        return None
    try:
        ctx = json.loads(raw)
        sub = ctx.get("authorizer", {}).get("claims", {}).get("sub")
        return sub if isinstance(sub, str) and sub else None
    except (json.JSONDecodeError, TypeError, AttributeError):
        return None

@app.post("/invoke-memory")
async def invoke_memory(req: InvokeRequest, request: Request):
    # actor_id is the user isolation boundary for Memory, so do not fall back to a shared ID
    user_sub = _get_user_sub(request)
    if user_sub is None:
        return JSONResponse({"message": "Unauthorized"}, status_code=401)

    session_id = req.session_id or "default"

    config = AgentCoreMemoryConfig(
        memory_id=os.environ["MEMORY_ID"],
        session_id=session_id,
        actor_id=user_sub,
        retrieval_config={
            "/preferences/{actorId}/": RetrievalConfig(top_k=5, relevance_score=0.5),
            "/facts/{actorId}/": RetrievalConfig(top_k=10, relevance_score=0.3),
            "/summaries/{actorId}/{sessionId}/": RetrievalConfig(
                top_k=3, relevance_score=0.5
            ),
        },
    )
    session_manager = AgentCoreMemorySessionManager(
        config, region_name=os.environ.get("MEMORY_REGION", "us-east-1")
    )

    agent = Agent(
        model=os.environ["MODEL_ID"],
        system_prompt=SYSTEM_PROMPT,
        tools=[get_current_time],
        session_manager=session_manager,
        callback_handler=None,
    )

    async def generate():
        # Ensure flushing even if an exception or client disconnection occurs midway
        try:
            async for event in agent.stream_async(req.prompt):
                if "data" in event:
                    yield event["data"]
        finally:
            session_manager.close()

    return StreamingResponse(generate(), media_type="text/plain; charset=utf-8")

import * as python from '@aws-cdk/aws-lambda-python-alpha'

curl -N -X POST "$API_ENDPOINT/invoke-memory" \
  -H "Content-Type: application/json" \
  -H "Authorization: $ID_TOKEN" \
  -d '{"prompt":"こんにちは、私は神野です。TypeScriptが好きで、趣味はスーパーマーケット巡りです。覚えてね。","session_id":"ltm-test-1"}'

Hello, Kamino-san! Nice to meet you.

I will remember the following about you:
- Name: Kamino-san
- Favorite programming language: TypeScript
- Hobby: Visiting supermarkets

What a wonderful hobby! I will keep this information in mind to be helpful in future conversations.

curl -N -X POST "$API_ENDPOINT/invoke-memory" \
  -H "Content-Type: application/json" \
  -H "Authorization: $ID_TOKEN" \
  -d '{"prompt":"私について何か知ってることある？","session_id":"ltm-cross-session"}'

Yes, I know some things about you, Kamino-san!

- Name: Kamino-san
- Favorite language: TypeScript
- Hobby: Visiting supermarkets

TypeScript is indeed a great language. It has type safety and good development efficiency.
Also, I think visiting supermarkets is a wonderful hobby where you can discover unique products and local food culture from various places!

{"context":"The user explicitly stated in their self-introduction that they like TypeScript.",
 "preference":"Likes TypeScript",
 "categories":["Programming","Technology"]}

{"context":"The user explicitly stated in their self-introduction that their hobby is visiting supermarkets.",
 "preference":"Hobby is visiting supermarkets",
 "categories":["Hobbies","Shopping"]}

lambda-api-strands/
├── bin/app.ts
├── lib/
│   ├── agent-api-stack.ts       # API GW + Lambda + Cognito + CloudFront
│   └── model-catalog.ts         # Haiku / Sonnet switching definition
├── lambda/
│   ├── handler.ts               # Hono + S3 SessionManager (SSE)
│   ├── validate-request.ts
│   └── memory/main.py           # FastAPI + AgentCore Memory (SSE)
├── frontend/                    # React + Vite chat UI
│   ├── public/app-config.json   # Cognito / endpoint / model definitions
│   └── src/
│       ├── components/          # Header, ChatMessage, EndpointSelector ...
│       ├── hooks/useChat.ts     # Manages sending and stream state
│       └── lib/sse.ts           # SSE parser (shared between TS and Python versions)
└── package.json

sessions/<userSub>/session/<sessionId>/
└── scopes/
    └── agent/
        └── <agentId>/
            └── snapshots/
                └── snapshot_latest.json

npx cdk destroy