Amazon Bedrock AgentCore services explained for AIP-C01

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

1. A company runs a scheduling agent on Amazon Bedrock AgentCore Runtime. The agent reads and updates each employee's calendar in a third-party SaaS calendar service that supports OAuth 2.0. Each employee must grant consent once, and the agent must then act with that employee's own permissions. The agent code must not store client secrets or refresh tokens. The company wants a managed service to hold and refresh the tokens. Which solution will meet these requirements with the LEAST operational overhead?

   Right. In the game that’s Renown for your Implementation and Integration building.

   Not that one: A is right. In the game your Implementation and Integration building would lose a little Renown, and this question would come back later.

   The answerA.Configure an OAuth2 credential provider for the calendar service in Amazon Bedrock AgentCore Identity. Have the agent obtain each employee's access token from AgentCore Identity before it calls the calendar API.AgentCore Identity is built for outbound, user-delegated access.Your answerB.Configure a JWT authorizer on the agent runtime with the calendar service's discovery URL. Have the agent forward each employee's inbound bearer token to the calendar API.A JWT authorizer validates inbound callers to the runtime; it does not obtain, store or refresh outbound OAuth tokens.Your answerC.Store each employee's refresh token in AWS Secrets Manager under the employee ID. Have the agent read the token, refresh it with the calendar service, and write the new token back before it calls the calendar API.Secrets Manager stores the tokens, but the agent still handles and refreshes every refresh token, which is what it must not do.Your answerD.Create a calendar service account with an API key that can edit every calendar. Store the key in AWS Secrets Manager, and have the agent read the key before it calls the calendar API.One shared API key acts with the service account's permissions, not with each employee's own permissions.

   Show the full explanation and doc quotes

   The guide says it enables "agents and tools to access AWS resources and third-party services on behalf of users". Its credential management "separates credential storage from credential access, helping to ensure that agents never have direct access to long-term secrets or refresh tokens." An OAuth2 credential provider for the calendar service gives the agent a per-employee access token after that employee's one-time consent.

   Written from docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity-outbound-credential-provider.html

2. An insurance company has built a claims triage agent with LangGraph. The agent runs a fixed graph of steps: classify the claim, retrieve the policy, check coverage rules, and draft a decision. The order of the steps must stay deterministic. The company wants to host the agent on Amazon Bedrock AgentCore with managed session isolation, scaling, and OAuth inbound authorization. The company must keep the existing LangGraph graph and must not rewrite the agent's logic. Which solution will meet these requirements with the LEAST operational overhead?

   Right. In the game that’s Renown for your Implementation and Integration building.

   Not that one: B is right. In the game your Implementation and Integration building would lose a little Renown, and this question would come back later.

   Your answerA.Rebuild the four steps as an Amazon Bedrock Flows flow with prompt, knowledge base, and condition nodes. Expose the flow as a tool through an AgentCore Gateway target.A flow can express the same four steps, but only by rebuilding them, which is exactly the rewrite the company ruled out.The answerB.Wrap the LangGraph application with the AgentCore SDK entrypoint, and package it as an ARM64 container image in Amazon ECR. Deploy the image to AgentCore Runtime, and configure OAuth inbound authorization.AgentCore offers two hosting models. The AgentCore harness vs.Your answerC.Deploy the LangGraph application as an AWS Lambda function behind Amazon API Gateway with an Amazon Cognito authorizer. Store the state of each session in an Amazon DynamoDB table.Lambda and API Gateway host the code, but the agent is no longer on AgentCore, and the company builds session isolation and state itself.Your answerD.Create an AgentCore harness that declares the model, system prompt, and tools as configuration. Supply the LangGraph code in a custom container image, and configure OAuth inbound authorization.The harness runs its own Strands-powered loop; it does not support a choice of agent framework or graph-style patterns, so the LangGraph graph would not run as written.

   Show the full explanation and doc quotes

   Runtime page says "AgentCore Runtime is a serverless hosting environment" and "You bring agent code - written in any framework or no framework - wrap it with the AgentCore SDK's BedrockAgentCoreApp entrypoint, package it into an ARM64 container, push it to Amazon ECR, and deploy." It adds that "The orchestration loop is yours", and that Runtime supplies "isolation, scaling, sessions, auth gating, and observability plumbing". The LangGraph graph runs unchanged.

   Written from docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-vs-runtime.html

3. A financial analytics company is building an agent on Amazon Bedrock AgentCore Runtime. Analysts upload CSV files of transaction data and ask questions that require aggregations, statistical calculations, and charts. Testing shows that the FM makes arithmetic errors when it calculates results in its text responses. The company wants the agent to write code and run it to produce each answer. The generated code must run in a sandbox that is isolated from the agent's own runtime environment. Which solution will meet these requirements with the LEAST operational overhead?

   Right. In the game that’s Renown for your Implementation and Integration building.

   Not that one: D is right. In the game your Implementation and Integration building would lose a little Renown, and this question would come back later.

   Your answerA.Add the Amazon Bedrock AgentCore Browser tool to the agent. The agent opens each uploaded file in a web-based spreadsheet application and then reads the calculated totals from the rendered page.A browser session can click through a web app, but it runs no code the agent writes, so the calculations are not the agent's own.Your answerB.Ingest each uploaded file into an Amazon Bedrock knowledge base. The agent calls the RetrieveAndGenerate API so that the FM answers each calculation question from the retrieved rows of the file.Retrieval only feeds rows back into the prompt. The FM would still add up the numbers in text, which is what fails today.Your answerC.Create an Amazon Bedrock AgentCore Memory resource with a semantic memory strategy. The agent stores the uploaded rows as memory records and recalls them when it calculates each answer.AgentCore Memory is for remembering context across turns. Recalling rows from memory does not make the arithmetic reliable.The answerD.Add the Amazon Bedrock AgentCore Code Interpreter tool to the agent. The agent generates Python code for each question and runs it in a sandbox against the file.AgentCore Code Interpreter is the managed sandbox for agent-written code.

   Show the full explanation and doc quotes

   The AgentCore guide says it "enables AI agents to write and execute code securely in sandbox environments", with pre-built runtimes and file upload support, so the agent computes aggregations and charts with real code instead of text arithmetic.

   Written from docs.aws.amazon.com/bedrock-agentcore/latest/devguide/code-interpreter-tool.html