# RuntimeProps

Properties for creating a Bedrock Agent Core Runtime resource.

Extends: RuntimeProps
Used as props by: Runtime

- Source: [`aws-bedrockagentcore/lib/runtime/runtime.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/runtime/runtime.ts#L55)
- Type last changed: v2.273.0 · 8 Oct 2026

## Example

```ts
// S3 bucket containing the agent core
const codeBucket = new s3.Bucket(this, "AgentCode", {
  bucketName: "my-code-bucket",
  removalPolicy: RemovalPolicy.DESTROY, // For demo purposes
});

// the bucket above needs to contain the agent code

const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromS3(
  {
    bucketName: codeBucket.bucketName,
    objectKey: 'deployment_package.zip',
  },
  agentcore.AgentCoreRuntime.PYTHON_3_12,
  ['opentelemetry-instrument', 'main.py']
);

const runtimeInstance = new agentcore.Runtime(this, "MyAgentRuntime", {
  runtimeName: "myAgent",
  agentRuntimeArtifact: agentRuntimeArtifact,
});
```

## Properties

- `agentRuntimeArtifact`: [AgentRuntimeArtifact](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.AgentRuntimeArtifact.html) (required) — The artifact configuration for the agent runtime Contains the container configuration with ECR URI.

- `authorizerConfiguration`: [RuntimeAuthorizerConfiguration](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.RuntimeAuthorizerConfiguration.html) — Authorizer configuration for the agent runtime Use RuntimeAuthorizerConfiguration static methods to create the configuration.

  **Default:** RuntimeAuthorizerConfiguration.iam() (IAM authentication)

- `description`: string — Optional description for the agent runtime.

  **Default:** No description Length Minimum: 1 , Maximum: 1200

- `environmentVariables`: { [key: string]: string } — Environment variables for the agent runtime - Maximum 50 environment variables - Key: Must be 1-100 characters, start with letter or underscore, contain only letters, numbers, and underscores - Value: Must be 0-2048 characters (per CloudFormation specification).

  **Default:** No environment variables

- `executionRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — The IAM role that provides permissions for the agent runtime If not provided, a role will be created automatically.

  **Default:** A new role will be created

- `lifecycleConfiguration`: [LifecycleConfiguration](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.LifecycleConfiguration.html) — The life cycle configuration for the AgentCore Runtime.

  **Default:** No lifecycle configuration

- `loggingConfigs`: [LoggingConfig](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.LoggingConfig.html)[] — Logging configuration for the runtime.

  **Default:** No logging configured

  Allows sending APPLICATION_LOGS and USAGE_LOGS to CloudWatch Logs, S3, or Kinesis Data Firehose.

- `manageDeliveryResourcePolicy`: boolean = true — Whether to create resource policies for log/trace delivery.

  When `false`, the `AWS::Logs::ResourcePolicy` and `AWS::XRay::ResourcePolicy`
  are not created. This is useful when deploying many runtimes per account/Region,
  as each resource policy consumes an account-level quota slot (CloudWatch Logs: 10,
  X-Ray: lower).

  Setting `false` means you are responsible for ensuring delivery permissions exist.
  There are two safe ways to use this:
  - Same-account delivery to a `/aws/vendedlogs/` log group, where the log-delivery
    service-linked role grants write access implicitly.
  - Attaching the delivery resource policy yourself.

  Otherwise delivery silently fails: synthesis and deploy succeed, but nothing is delivered.
  Per the [vended-logs delivery docs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-infrastructure-V2-CloudWatchLogs.html),
  a resource policy is required for CloudWatch Logs delivery outside the `/aws/vendedlogs/` same-account case.

- `networkConfiguration`: [RuntimeNetworkConfiguration](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.RuntimeNetworkConfiguration.html) — Network configuration for the agent runtime.

  **Default:** RuntimeNetworkConfiguration.usingPublicNetwork()

- `platformVersion`: [PlatformVersion](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PlatformVersion.html) — The platform version of the runtime.

  **Default:** the AgentCore service default platform version

  When omitted, the property is not rendered and the AgentCore service applies
  its own default platform version.

- `protocolConfiguration`: [ProtocolType](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.ProtocolType.html) = ProtocolType.HTTP — Protocol configuration for the agent runtime.

- `requestHeaderConfiguration`: [RequestHeaderConfiguration](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.RequestHeaderConfiguration.html) — Configuration for HTTP request headers that will be passed through to the runtime.

  **Default:** No request headers configured

- `runtimeName`: string — The name of the agent runtime Valid characters are a-z, A-Z, 0-9, _ (underscore) Must start with a letter and can be up to 48 characters long Pattern: ^[a-zA-Z][a-zA-Z0-9_]{0,47}$.

  **Default:** auto generate

- `tags`: { [key: string]: string } — Tags for the agent runtime A list of key:value pairs of tags to apply to this Runtime resource.

  **Default:** {} - no tags

- `tracingEnabled`: boolean = false — Whether to enable X-Ray tracing for this runtime.

  When enabled, traces will be delivered to AWS X-Ray.