# Runtime

Bedrock Agent Core Runtime Enables running containerized agents with specific network configurations, security settings, and runtime artifacts.

Extends: Construct › Resource › RuntimeBase › Runtime
Implements: IResource, IBedrockAgentRuntime, IConnectable, IGrantable, IEnvironmentAware, IRuntimeRef, IConstruct, IDependable

- CloudFormation: [`AWS::BedrockAgentCore::Runtime`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-bedrockagentcore-runtime.html)
- L1 type: [`CfnRuntime`](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.CfnRuntime.html)
- Source: [`aws-bedrockagentcore/lib/runtime/runtime.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/runtime/runtime.ts#L212)
- Type last changed: v2.255.0 · 19 May 2026

## Example

```ts
// S3 bucket containing the agent core
const codeBucket = new s3.Bucket(this, "AgentCode", {
  bucketName: "my-code-bucket",
  removalPolicy: RemovalPolicy.DESTROY, // For demo purposes
});

// the bucket above needs to contain the agent code

const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromS3(
  {
    bucketName: codeBucket.bucketName,
    objectKey: 'deployment_package.zip',
  },
  agentcore.AgentCoreRuntime.PYTHON_3_12,
  ['opentelemetry-instrument', 'main.py']
);

const runtimeInstance = new agentcore.Runtime(this, "MyAgentRuntime", {
  runtimeName: "myAgent",
  agentRuntimeArtifact: agentRuntimeArtifact,
});
```

## Initializer

```ts
new Runtime(scope: Construct, id: string, props: RuntimeProps)
```

## Construct Props

- `agentRuntimeArtifact`: [AgentRuntimeArtifact](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.AgentRuntimeArtifact.html) (required) — The artifact configuration for the agent runtime Contains the container configuration with ECR URI.

- `authorizerConfiguration`: [RuntimeAuthorizerConfiguration](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.RuntimeAuthorizerConfiguration.html) — Authorizer configuration for the agent runtime Use RuntimeAuthorizerConfiguration static methods to create the configuration.

  **Default:** RuntimeAuthorizerConfiguration.iam() (IAM authentication)

- `description`: string — Optional description for the agent runtime.

  **Default:** No description Length Minimum: 1 , Maximum: 1200

- `environmentVariables`: { [key: string]: string } — Environment variables for the agent runtime - Maximum 50 environment variables - Key: Must be 1-100 characters, start with letter or underscore, contain only letters, numbers, and underscores - Value: Must be 0-2048 characters (per CloudFormation specification).

  **Default:** No environment variables

- `executionRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — The IAM role that provides permissions for the agent runtime If not provided, a role will be created automatically.

  **Default:** A new role will be created

- `lifecycleConfiguration`: [LifecycleConfiguration](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.LifecycleConfiguration.html) — The life cycle configuration for the AgentCore Runtime.

  **Default:** No lifecycle configuration

- `loggingConfigs`: [LoggingConfig](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.LoggingConfig.html)[] — Logging configuration for the runtime.

  **Default:** No logging configured

  Allows sending APPLICATION_LOGS and USAGE_LOGS to CloudWatch Logs, S3, or Kinesis Data Firehose.

- `manageDeliveryResourcePolicy`: boolean = true — Whether to create resource policies for log/trace delivery.

  When `false`, the `AWS::Logs::ResourcePolicy` and `AWS::XRay::ResourcePolicy`
  are not created. This is useful when deploying many runtimes per account/Region,
  as each resource policy consumes an account-level quota slot (CloudWatch Logs: 10,
  X-Ray: lower).

  Setting `false` means you are responsible for ensuring delivery permissions exist.
  There are two safe ways to use this:
  - Same-account delivery to a `/aws/vendedlogs/` log group, where the log-delivery
    service-linked role grants write access implicitly.
  - Attaching the delivery resource policy yourself.

  Otherwise delivery silently fails: synthesis and deploy succeed, but nothing is delivered.
  Per the [vended-logs delivery docs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-infrastructure-V2-CloudWatchLogs.html),
  a resource policy is required for CloudWatch Logs delivery outside the `/aws/vendedlogs/` same-account case.

- `networkConfiguration`: [RuntimeNetworkConfiguration](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.RuntimeNetworkConfiguration.html) — Network configuration for the agent runtime.

  **Default:** RuntimeNetworkConfiguration.usingPublicNetwork()

- `platformVersion`: [PlatformVersion](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PlatformVersion.html) — The platform version of the runtime.

  **Default:** the AgentCore service default platform version

  When omitted, the property is not rendered and the AgentCore service applies
  its own default platform version.

- `protocolConfiguration`: [ProtocolType](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.ProtocolType.html) = ProtocolType.HTTP — Protocol configuration for the agent runtime.

- `requestHeaderConfiguration`: [RequestHeaderConfiguration](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.RequestHeaderConfiguration.html) — Configuration for HTTP request headers that will be passed through to the runtime.

  **Default:** No request headers configured

- `runtimeName`: string — The name of the agent runtime Valid characters are a-z, A-Z, 0-9, _ (underscore) Must start with a letter and can be up to 48 characters long Pattern: ^[a-zA-Z][a-zA-Z0-9_]{0,47}$.

  **Default:** auto generate

- `tags`: { [key: string]: string } — Tags for the agent runtime A list of key:value pairs of tags to apply to this Runtime resource.

  **Default:** {} - no tags

- `tracingEnabled`: boolean = false — Whether to enable X-Ray tracing for this runtime.

  When enabled, traces will be delivered to AWS X-Ray.

## Properties

- `agentRuntimeArn`: string — The ARN of the agent runtime.

- `agentRuntimeArtifact`: [AgentRuntimeArtifact](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.AgentRuntimeArtifact.html) — The artifact configuration for the agent runtime.

- `agentRuntimeId`: string — The unique identifier of the agent runtime.

- `agentRuntimeName`: string — The name of the agent runtime.

- `agentRuntimeVersion`: string — The version of the agent runtime.

- `agentStatus`: string — The status of the agent runtime.

- `applicationLogGroup`: [ILogGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_logs.ILogGroup.html) — Memoized accessor for the default endpoint application log group.

  The log group reference is constructed on first access so that runtimes
  which never reference it do not pollute the construct tree with an
  imported child.

- `connections`: [Connections](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Connections.html) — An accessor for the Connections object that will fail if this Runtime does not have a VPC configured.

- `createdAt`: string — The timestamp when the agent runtime was created.

- `description`: string — Optional description for the agent runtime.

- `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html) — The environment this resource belongs to.

  For resources that are created and managed in a Stack (those created by
  creating new class instances like `new Role()`, `new Bucket()`, etc.), this
  is always the same as the environment of the stack they belong to.

  For referenced resources (those obtained from referencing methods like
  `Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be
  different than the stack they were imported into.

- `grantPrincipal`: [IPrincipal](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IPrincipal.html) — The principal to grant permissions to.

- `lastUpdatedAt`: string — The timestamp when the agent runtime was last updated.

- `node`: [Node](/cdk/api/v2/docs/constructs.Node.html) — The tree node.

- `PROPERTY_INJECTION_ID`: string (static) — Uniquely identifies this class.

- `role`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — The IAM role that provides permissions for the agent runtime.

- `runtimeRef`: [RuntimeReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_bedrockagentcore.RuntimeReference.html) — A reference to a Runtime resource.

- `stack`: [Stack](/cdk/api/v2/docs/aws-cdk-lib.Stack.html) — The stack in which this resource is defined.

## Methods

- `addEndpoint(endpointName: string, options?: AddEndpointOptions): RuntimeEndpoint` — Add an endpoint to this runtime This is a convenience method that creates a RuntimeEndpoint associated with this runtime.

  **Parameters**

  - `endpointName` — The name of the endpoint.
  - `options` — Optional configuration for the endpoint.

  **Returns:** The created RuntimeEndpoint

- `addToRolePolicy(statement: PolicyStatement): IBedrockAgentRuntime` — Adds a policy statement to the runtime's execution role.

  **Parameters**

  - `statement` — The IAM policy statement to add.

  **Returns:** The runtime instance for chaining

- `applyCrossStackReferenceStrength(strength: ReferenceStrength): void` — Override the cross-stack reference strength for this resource.

  When set, any cross-stack reference to this resource will use the specified
  mechanism instead of the global default determined by the
  `@aws-cdk/core:defaultCrossStackReferences` context key. This is useful for
  selectively weakening specific references to avoid the "deadly embrace" problem
  without changing the app-wide default.

  **Parameters**

  - `strength` — - The reference strength to use for this resource.

- `applyRemovalPolicy(policy: RemovalPolicy): void` — Apply the given removal policy to this resource.

  The Removal Policy controls what happens to this resource when it stops
  being managed by CloudFormation, either because you've removed it from the
  CDK application or because you've made a change that requires the resource
  to be replaced.

  The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
  account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).

- `fromAgentRuntimeAttributes(scope: Construct, id: string, attrs: AgentRuntimeAttributes): IBedrockAgentRuntime` (static) — Import an existing Agent Runtime using attributes This allows you to reference an Agent Runtime that was created outside of CDK.

  **Parameters**

  - `scope` — The construct scope.
  - `id` — The construct id.
  - `attrs` — The attributes of the existing Agent Runtime.

  **Returns:** An IBedrockAgentRuntime instance representing the imported runtime

- `grant(actions: string[], resources: string[]): Grant` — Grant the runtime specific actions on AWS resources.

  [disable-awslint:no-grants]

  **Parameters**

  - `actions` — The actions to grant.
  - `resources` — The resource ARNs to grant access to.

  **Returns:** The Grant object for chaining

- `grantInvoke(grantee: IGrantable): Grant` — Permits an IAM principal to invoke this runtime both directly and on behalf of users Grants both bedrock-agentcore:InvokeAgentRuntime and bedrock-agentcore:InvokeAgentRuntimeForUser permissions.

  [disable-awslint:no-grants]

  **Parameters**

  - `grantee` — The principal to grant access to.

- `grantInvokeRuntime(grantee: IGrantable): Grant` — Permits an IAM principal to invoke this runtime Grants the bedrock-agentcore:InvokeAgentRuntime permission.

  [disable-awslint:no-grants]

  **Parameters**

  - `grantee` — The principal to grant access to.

- `grantInvokeRuntimeForUser(grantee: IGrantable): Grant` — Permits an IAM principal to invoke this runtime on behalf of a user Grants the bedrock-agentcore:InvokeAgentRuntimeForUser permission Required when using the X-Amzn-Bedrock-AgentCore-Runtime-User-Id header.

  [disable-awslint:no-grants]

  **Parameters**

  - `grantee` — The principal to grant access to.

- `isConstruct(x: any): boolean` (static) — Checks if `x` is a construct.

  Use this method instead of `instanceof` to properly detect `Construct`
  instances, even when the construct library is symlinked.

  Explanation: in JavaScript, multiple copies of the `constructs` library on
  disk are seen as independent, completely different libraries. As a
  consequence, the class `Construct` in each copy of the `constructs` library
  is seen as a different class, and an instance of one class will not test as
  `instanceof` the other class. `npm install` will not create installations
  like this, but users may manually symlink construct libraries together or
  use a monorepo tool: in those cases, multiple copies of the `constructs`
  library can be accidentally installed, and `instanceof` will behave
  unpredictably. It is safest to avoid using `instanceof`, and using
  this type-testing method instead.

  **Parameters**

  - `x` — Any object.

  **Returns:** true if `x` is an object created from a class which extends `Construct`.

- `isOwnedResource(construct: IConstruct): boolean` (static) — Returns true if the construct was created by CDK, and false otherwise.

- `isResource(construct: IConstruct): boolean` (static) — Check whether the given construct is a Resource.

- `metric(metricName: string, props?: MetricOptions): Metric` — Return the given named metric for this agent runtime.

  By default, the metric will be calculated as a sum over a period of 5 minutes.
  You can customize this by using the `statistic` and `period` properties.

  The metric is scoped to this agent runtime and its default endpoint.

- `metricInvocations(props?: MetricOptions): Metric` — Return a metric containing the total number of invocations for this agent runtime.

- `metricInvocationsAggregated(props?: MetricOptions): Metric` — Return a metric containing the total number of invocations across all agent runtimes in this account.

- `metricLatency(props?: MetricOptions): Metric` — Return a metric measuring the latency of requests for this agent runtime.

  The latency metric represents the total time elapsed between receiving the request
  and sending the final response token, representing complete end-to-end processing time.

- `metricSessionCount(props?: MetricOptions): Metric` — Return a metric containing the number of agent sessions for this agent runtime.

- `metricSessionsAggregated(props?: MetricOptions): Metric` — Return a metric containing the total number of sessions across all agent runtimes in this account.

- `metricSystemErrors(props?: MetricOptions): Metric` — Return a metric containing the number of system errors for this agent runtime.

- `metricThrottles(props?: MetricOptions): Metric` — Return a metric containing the number of throttled requests for this agent runtime.

- `metricTotalErrors(props?: MetricOptions): Metric` — Return a metric containing the total number of errors (system + user) for this agent runtime.

- `metricUserErrors(props?: MetricOptions): Metric` — Return a metric containing the number of user errors for this agent runtime.

- `toString(): string` — Returns a string representation of this construct.

- `with(...mixins: IMixin[]): IConstruct` — Applies one or more mixins to this construct.

  Mixins are applied in order. The list of constructs is captured at the
  start of the call, so constructs added by a mixin will not be visited.
  Use multiple `with()` calls if subsequent mixins should apply to added
  constructs.