Amazon Bedrock
Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore (including the Harness managed agent loop). Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating/porting/converting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching, quota health checks and throttling diagnosis, cost attribution, migrating between Claude model generations, chunking strategies, API selection (Converse vs InvokeModel), and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Coinbase CDP, Stripe Privy, 402 Payment Required, paid endpoint). NOT for custom model training, Rekognition, or Comprehend.
- Skill ID
- aws/agent-toolkit-for-aws/amazon-bedrock
- Publisher
- aws
- Repository
- agent-toolkit-for-aws
- Installs
- 0
- Files
- 34
- Synced
- Sep 23, 2026
Open any RiverX project, open the Skills panel in the chat, and search for this identifier. The files are fetched from the source repository at install time.
aws/agent-toolkit-for-aws/amazon-bedrockInstalls these files- SKILL.md
- assets/kb_shim.py.tmpl
- assets/lambda_shim.py.tmpl
- assets/tool_schema.json.tmpl
- references/agentcore-credentials-and-security.md
- references/agentcore-gateway.md
- references/agentcore-harness.md
- references/agentcore-memory-observability.md
- references/agentcore-payments-setup-script.md
- references/agentcore-payments-wiring.md
- references/agentcore-payments.md
- references/agentcore-registry-evaluations.md
- references/agentcore-runtime-container-build.md
- references/agentcore-runtime.md
- references/agents-and-action-groups.md
- references/bedrock-agents-to-agentcore-harness/cli.md
- references/bedrock-agents-to-agentcore-harness/deploy.md
- references/bedrock-agents-to-agentcore-harness/discovery.md
- references/bedrock-agents-to-agentcore-harness/eligibility.md
- references/bedrock-agents-to-agentcore-harness/mapping.md
- references/cost-tracking.md
- references/guardrails.md
- references/knowledge-bases-retrieval.md
- references/knowledge-bases-setup.md
- references/migrate-bedrock-agents-to-agentcore-harness.md
- references/model-invocation.md
- references/model-migration.md
- references/model-selection-guide.md
- references/prompt-caching.md
- references/prompt-engineering-by-model.md
- references/quota-health.md
- references/sdk-converse-api-python.md
- references/sdk-converse-api-typescript.md
- scripts/fetch_bedrock_agent.py
What this skill tells the agent
IMPORTANT: When this skill is loaded, you MUST use the reference files and procedures in this skill as your primary source of truth. Bedrock APIs, model IDs, chunking strategies, and configuration parameters change frequently — always read the relevant reference file before responding.
Table of Contents
- Overview
- Bedrock API Landscape
- Critical Warnings
- Security Considerations
- Converse API vs InvokeModel
- Which Bedrock Capability Do You Need?
- Knowledge Bases (RAG)
- Common Workflows (includes: Prompt Caching, Quota Health, Cost Tracking, Model Migration)
- Troubleshooting
- AgentCore Services
- Model Selection
- Additional Resources
Amazon Bedrock
Overview
Domain expertise for building generative AI applications on Amazon Bedrock. Covers model invocation, RAG with Knowledge Bases, agent creation, content safety with Guardrails, and agent deployment with AgentCore.
Recommended setup: Use the AWS MCP server for sandboxed execution, audit logging, and enterprise controls.
Without AWS MCP: This skill works with any agent that has AWS CLI access. All commands use standard AWS CLI syntax.
Bedrock API Landscape
Bedrock has 5 separate API endpoints. Using the wrong one is a common cause of errors. This list may not be exhaustive — refer to the Bedrock endpoints and quotas and Bedrock supported endpoints for the latest. Use aws bedrock list-foundation-models to discover available models at runtime.
| Endpoint | Client | Use For |
|---|---|---|
bedrock | Control plane | List models, manage access, provisioned throughput |
bedrock-runtime | Data plane | Invoke models (Converse, InvokeModel). Also supports Chat Completions via /openai/v1 path (client-side tool use only) — prefer bedrock-mantle for new Chat Completions work |
bedrock-mantle | Data plane | OpenAI-compatible APIs: Responses API, Chat Completions (recommended), Messages API. Supports server-side tool use with built-in tools. Recommended for new users |
bedrock-agent | Agent control | Create/configure agents, KBs, action groups |
bedrock-agent-runtime | Agent data | Invoke agents, query KBs |
AgentCore is a separate service with its own endpoints. Refer to AgentCore endpoints and quotas for the latest.
| Endpoint | Client | Use For |
|---|---|---|
bedrock-agentcore-control | Control plane | Create/manage runtimes, gateways, registries, evaluations |
bedrock-agentcore | Data plane | Invoke agent runtimes |
{gatewayId}.gateway.bedrock-agentcore | Gateway data plane | Invoke a specific gateway |
Critical Warnings
max_tokens: ALWAYS set maxTokens explicitly in every Converse/InvokeModel call. Leaving it unset defaults to the model's maximum (e.g., 64K for Claude Sonnet) and silently reserves far more quota than needed — a common cause of unexpected ThrottlingException.
Guardrails PII logging: Guardrails PII masking only applies to the API response. Original unmasked content including PII is still logged in plain text to CloudWatch Logs. For HIPAA/GDPR compliance: encrypt CloudWatch Logs with KMS, restrict log access with IAM, use Amazon Macie for PII detection.
SDK versions: Requires recent versions of boto3 (≥ 1.34.x) and AWS CLI v2. Older versions are missing Converse API, Agents, and AgentCore support. Run aws --version and pip show boto3 to check.
Bedrock Agents classic is in maintenance mode: classic Bedrock Agents (bedrock-agent) is in maintenance mode and closed to new customers (announcement). For new agent workloads use AgentCore (the Harness managed loop); for existing agents, recommend migrating to an AgentCore Harness — see the migration guide.
Security Considerations
- Use IAM roles (not IAM users) for all Bedrock service access
- Scope IAM permissions to specific actions and resource ARNs — avoid
bedrock:*orAmazonBedrockFullAccess - Store API keys and OAuth secrets in AWS Secrets Manager with automatic rotation enabled
- Include confused deputy protection (
aws:SourceAccount,aws:SourceArnconditions) in all resource-based policies for Bedrock services - Treat all agent-generated parameters as untrusted input — validate before use in Lambda handlers or tool implementations
- Enable CloudTrail for all Bedrock and AgentCore API calls
- For PII workloads: encrypt CloudWatch Logs with KMS, configure retention limits, restrict log access
- Refer to the latest Bedrock security best practices for current security guidance
Converse API vs InvokeModel
For choosing between all Bedrock inference APIs (Responses API, Chat Completions, Converse, InvokeModel), see APIs supported by Amazon Bedrock.
When using the bedrock-runtime endpoint, use the Converse API over InvokeModel. It provides a unified request/response format across all models.
Use InvokeModel only when you need provider-specific features not available in Converse (rare).
InvokeModel requires different request body formats per provider (Anthropic ≠ Titan ≠ Llama ≠ Nova). Using the wrong format produces "Malformed input request". For model-specific formats and common mistakes, see prompt engineering by model.
Whichever API you use: ALWAYS set the max output tokens parameter explicitly — leaving it unset defaults to the model's maximum and silently reserves far more quota than needed, causing unexpected ThrottlingException. See Critical Warnings above and max_tokens quota mechanics.
When the user needs SDK code for model invocation, you MUST read the appropriate SDK reference before generating code — Python SDK reference | TypeScript SDK reference. Use the patterns from the reference file.
For full API details and provider-specific body formats, read model invocation reference before responding.
Which Bedrock Capability Do You Need?
| Goal | Use | Reference |
|---|---|---|
| Call a model (text, image, video) | Converse API | See above + model invocation |
| Build a RAG application | Knowledge Bases | KB setup |
| Create an agent that takes actions | Bedrock Agents | agent creation |
| Filter harmful/sensitive content | Guardrails | guardrails |
| Run a config-based managed agent loop on AgentCore (no code, no container) | AgentCore Harness | harness |
| Deploy and scale an agent loop you wrote yourself | AgentCore Runtime | runtime |
| Migrate an existing Bedrock Agent (classic) to an AgentCore Harness | Bedrock Agents to AgentCore harness Migration | migration guide |
| Expose REST APIs as MCP tools | AgentCore Gateway | gateway |
| Choose the right model | Model Selection | model guide |
| Set up or debug prompt caching | Prompt Caching | prompt caching |
| Diagnose throttling or audit quotas | Quota Health | quota health |
More from aws
Use this skill in a project
Open any RiverX project, search the Skills panel for aws/agent-toolkit-for-aws/amazon-bedrock, and install it in one click.