Configure a {custom} area identify for the Amazon Bedrock AgentCore runtime agent

by root August 31, 2025

written by root August 31, 2025 0 comment 135 views

When deploying AI brokers to the Amazon Bedrock AgentCore runtime (at present previewing), clients need to use {custom} domains to create an expert, seamless expertise.

By default, the AgentCore runtime agent makes use of an endpoint https://bedrock-agentcore.{area}.amazonaws.com/runtimes/{EncodedAgentARN}/invocations.

On this put up, we’ll present you how you can convert these endpoints to a user-friendly {custom} area ( https://agent.yourcompany.com) Use Amazon CloudFront because the reverse proxy. This resolution combines CloudFront, Amazon Route 53, and AWS Certificates Supervisor (ACM) to create a safe, scalable {custom} area setup that works seamlessly with current brokers.

Advantages of the Amazon Bedrock Agentcore Runtime

For those who’re constructing an AI agent, you are in all probability coping with internet hosting challenges like managing infrastructure, dealing with authentication, scaling, and sustaining safety. The Amazon Bedrock AgentCore runtime can assist you deal with these points.

The Amazon Bedrock AgentCore runtime is framework dependent. Can be utilized collectively Langgraph, Kuruwai, Strand Agentor a {custom} agent you constructed from scratch. It helps as much as 8 hours of prolonged execution instances, making it preferrred for advanced inference duties that conventional serverless capabilities can not deal with. Every consumer session runs in its personal remoted Mycroph, offering crucial safety for enterprise purposes.

A consumption-based pricing mannequin means you solely pay for what you provide. Additionally, in contrast to different internet hosting options, the Amazon Bedrock AgentCore runtime consists of built-in authentication {and professional} observability for AI brokers.

Advantages of {custom} domains

In case you are utilizing the Amazon Bedrock AgentCore runtime Public approval (OAuth) Authentication, the appliance makes HTTPS requests on to the service endpoint. This works, however {custom} domains provide a number of benefits.

Customized Branding – Show branded domains as an alternative of AWS infrastructure particulars in client-side purposes (net browsers, cell apps) community requests
Enhance the developer expertise – Growth groups can use memorable branded endpoints as an alternative of copying and pasting lengthy AWS endpoints throughout their codebase and configuration
Simplified upkeep – Customized domains make it simpler to handle endpoints when deploying a number of brokers or updating configurations throughout environments

Answer overview

This resolution makes use of CloudFront as a reverse proxy to transform requests from a {custom} area to Amazon Bedrock AgentCore runtime API calls. As a substitute of utilizing the default endpoint, the appliance could make requests to a user-friendly URL https://agent.yourcompany.com/.

The next diagram illustrates the answer structure.

The workflow consists of the next steps:

The shopper utility is authenticated with Amazon Cognito and receives a bearer token.
The shopper makes HTTPS requests to the {custom} area.
Route 53 resolves DNS requests to CloudFront.
CloudFront forwards authenticated requests to the Amazon Bedrock Runtime agent.
The agent processes the request and returns a response through the identical path.

You should use the identical cloud entrance distribution to supply each front-end purposes and back-end brokers endpoints. Cross-Origin Resource Sharing (CORS) It causes issues as all the things comes from the identical area.

Conditions

To observe this walkthrough, you could:

The Amazon Bedrock AgentCore runtime will be in different supported AWS areas, however CloudFront requires you to make use of an SSL certificates. us-east-1 area.

You’ll be able to select from the next area choices:

Use an current area – Add a subdomain agent.yourcompany.com
Register a brand new area – Register should you wouldn’t have a site utilizing route 53
Use the default URL for CloudFront – No area registration or configuration required

If you wish to rapidly take a look at your resolution earlier than configuring your {custom} area, select the third possibility.

Create an agent with inbound authentication

For those who already deploy the agent utilizing OAUTH authentication, you’ll be able to skip to the following part to arrange your {custom} area. In any other case, observe these steps to create a brand new agent utilizing Amazon Cognito as your OAuth supplier:

Create a brand new listing for the agent with the next construction:

your_project_directory/
├── agent_example.py # Your primary agent code
├── necessities.txt # Dependencies on your agent
└── __init__.py # Makes the listing a Python package deal

Create the principle agent code agent_example.py:

# agent_example.py
from strands import Agent
from bedrock_agentcore.runtime import BedrockAgentCoreApp

agent = Agent()
app = BedrockAgentCoreApp()
@app.entrypoint
def invoke(payload):
    """Course of consumer enter and return a response"""
    user_message = payload.get("immediate", "Howdy")
    response = agent(user_message)
    return str(response) # response ought to be json serializable
if __name__ == "__main__":
    app.run()

Add a dependency to necessities.txt:

# necessities.txt
strands-agents
bedrock-agentcore

Run the next command to create an Amazon Cognito consumer pool and a take a look at consumer:

# Create Person Pool and seize Pool ID
export POOL_ID=$(aws cognito-idp create-user-pool 
  --pool-name "MyUserPool" 
  --policies '{"PasswordPolicy":{"MinimumLength":8}}' 
  --region us-east-1 | jq -r '.UserPool.Id')

# Create App Consumer and seize Consumer ID
export CLIENT_ID=$(aws cognito-idp create-user-pool-client 
  --user-pool-id $POOL_ID 
  --client-name "MyClient" 
  --no-generate-secret 
  --explicit-auth-flows "ALLOW_USER_PASSWORD_AUTH" "ALLOW_REFRESH_TOKEN_AUTH" 
  --region us-east-1 | jq -r '.UserPoolClient.ClientId')

# Create and configure a take a look at consumer
aws cognito-idp admin-create-user 
  --user-pool-id $POOL_ID 
  --username "testuser" 
  --temporary-password "Temp1234" 
  --region us-east-1 
  --message-action SUPPRESS

aws cognito-idp admin-set-user-password 
  --user-pool-id $POOL_ID 
  --username "testuser" 
  --password "MyPassword123" 
  --region us-east-1 
  --permanent

echo "Pool ID: $POOL_ID"
echo "Discovery URL: https://cognito-idp.us-east-1.amazonaws.com/$POOL_ID/.well-known/openid-configuration"
echo "Consumer ID: $CLIENT_ID"

Deploy the agent utilizing the Amazon Bedrock AgentCore command line interface (CLI) supplied by the Starter Toolkit.

pip set up bedrock-agentcore-starter-toolkit #set up the starter toolkit

agentcore configure --entrypoint agent_example.py 
--name my_agent 
--execution-role your-execution-role-arn 
--requirements-file necessities.txt 
--authorizer-config "{"customJWTAuthorizer":{"discoveryUrl":"https://cognito-idp.us-east-1.amazonaws.com/$POOL_ID/.well-known/openid-configuration","allowedClients":["$CLIENT_ID"]}}"

agentcore launch

After deployment, take note of the Agent Runtime Amazon Useful resource Identify (ARN). That is required for {custom} area configurations.

For extra examples and extra data, see Authentication and Authorization with Inbound and Outbound AUTH.

Arrange a {custom} area resolution

Subsequent, let’s implement a {custom} area resolution utilizing the AWS CDK. This part exhibits you how you can create a CloudFront Distribution to create a {custom} area request to Amazon Bedrock Agentcore runtime endpoint to create a proxy proxy.

Create a brand new listing and initialize the AWS CDK venture.

mkdir agentcore-custom-domain
cd agentcore-custom-domain
cdk init app --language python
supply .venv/bin/activate
pip set up aws-cdk-lib constructs

Encode the agent ARN and put together the CloudFront Origin configuration.

# agentcore_custom_domain_stack.py 
import urllib.parse

agent_runtime_arn = "arn:aws:bedrock-agentcore:us-east-1:accountId:runtime/my_agent-xbcDkz4FR9"
encoded_arn = urllib.parse.quote(agent_runtime_arn, protected="") # URL-encode the ARN
area = agent_runtime_arn.cut up(':')[3]  # Extract area from ARN

If the front-end utility is operating in a unique area than the agent endpoint, you could configure the CORS header. That is widespread when the frontend is hosted in a unique area (for instance, https://app.yourcompany.com telephone https://agent.yourcompany.com), or in case you are creating regionally (for instance, http://localhost:3000 (Invokes the endpoint of the manufacturing agent).

To deal with CORS necessities, create a cloud entrance response header coverage.

# agentcore_custom_domain_stack.py 
from aws_cdk.aws_cloudfront import ResponseHeadersPolicy, ResponseHeadersCorsBehavior

# Create CORS response headers coverage
cors_policy = ResponseHeadersPolicy(self, 'CorsPolicy',
    cors_behavior=ResponseHeadersCorsBehavior(
        access_control_allow_origins=['*'], # Or specify your frontend domains
        access_control_allow_headers=[
            'Authorization',
            'Content-Type', 
            'X-Amzn-*',
            'X-Requested-With'
        ],
        access_control_allow_methods=['GET', 'POST', 'OPTIONS'],
        access_control_allow_credentials=False,
        access_control_expose_headers=['*'],
        origin_override=True # Overrides CORS headers from origin
    )
)

Create a cloud entrance supply that acts as a reverse proxy for the agent endpoint.

# agentcore_custom_domain_stack.py
 from aws_cdk.aws_cloudfront import (
    Distribution, BehaviorOptions, CachePolicy, 
    AllowedMethods, ViewerProtocolPolicy,
    OriginProtocolPolicy, OriginRequestPolicy
)
from aws_cdk.aws_cloudfront_origins import HttpOrigin

bedrock_agentcore_hostname = f"bedrock-agentcore.{area}.amazonaws.com"
origin_path = f"/runtimes/{encoded_arn}/invocations"

distribution = Distribution(self, 'Distribution',
    default_behavior=BehaviorOptions(
        origin=HttpOrigin(
            bedrock_agentcore_hostname,
            origin_path=origin_path, 
            protocol_policy=OriginProtocolPolicy.HTTPS_ONLY,
            read_timeout=Period.seconds(120) # Elective: for responses >30s, regulate as wanted
        ),
        viewer_protocol_policy=ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
        cache_policy=CachePolicy.CACHING_DISABLED,  # Important for dynamic APIs
        allowed_methods=AllowedMethods.ALLOW_ALL,
        response_headers_policy=cors_policy,  # Add CORS coverage if created
        origin_request_policy=OriginRequestPolicy.ALL_VIEWER,  # Ahead headers for MCP
    ),
    # Add area configuration if utilizing {custom} domains
    domain_names=[domain_name] if domain_name else None,
    certificates=certificates if domain_name else None,
)

set cache_policy=CachePolicy.CACHING_DISABLED Be certain that the agent response is dynamic and never cached by CloudFront.

In case you are utilizing a {custom} area, add the SSL certificates and DNS configuration to the stack.

# agentcore_custom_domain_stack.py 
from aws_cdk.aws_certificatemanager import Certificates, CertificateValidation
from aws_cdk.aws_route53 import HostedZone, ARecord, RecordTarget
from aws_cdk.aws_route53_targets import CloudFrontTarget

# For current domains
hosted_zone = HostedZone.from_lookup(self, 'HostedZone',
    domain_name="yourcompany.com"
)
# SSL certificates with computerized DNS validation
certificates = Certificates(self, 'Certificates',
    domain_name="my-agent.yourcompany.com",
    validation=CertificateValidation.from_dns(hosted_zone),
)
# DNS report pointing to CloudFront
ARecord(self, 'AliasRecord',
    zone=hosted_zone,
    record_name="my-agent.yourcompany.com",
    goal=RecordTarget.from_alias(CloudFrontTarget(distribution)),
)

The next code is an entire AWS CDK stack that mixes all of the elements:

# agentcore_custom_domain_stack.py
import urllib.parse
from aws_cdk import Stack, CfnOutput, Period
from aws_cdk.aws_cloudfront import (
    Distribution, BehaviorOptions,
    CachePolicy, AllowedMethods,
    ViewerProtocolPolicy, OriginProtocolPolicy,
    ResponseHeadersPolicy, ResponseHeadersCorsBehavior,
    OriginRequestPolicy
)
from aws_cdk.aws_cloudfront_origins import HttpOrigin
from aws_cdk.aws_certificatemanager import Certificates, CertificateValidation
from aws_cdk.aws_route53 import HostedZone, ARecord, RecordTarget
from aws_cdk.aws_route53_targets import CloudFrontTarget
from constructs import Assemble

class AgentcoreCustomDomainStack(Stack):
    def __init__(self, scope: Assemble, construct_id: str, **kwargs) -> None:
        tremendous().__init__(scope, construct_id, **kwargs)

        # Configuration - Replace these on your setup
        agent_runtime_arn = "arn:aws:bedrock-agentcore:us-east-1:accountId:runtime/my_agent-xbcDkz4FR9"
        area = agent_runtime_arn.cut up(':')[3]  # Extract area from ARN
        domain_name = "agent.yourcompany.com"  # Utilizing your hosted zone
        hosted_zone_id = "Z1234567890ABC"  # Your hosted zone ID
        enable_cors = True  # Set to False if serving frontend and backend from identical area

        # Encode the agent ARN for the origin path
        encoded_arn = urllib.parse.quote(agent_runtime_arn, protected="")
        bedrock_agentcore_hostname = f"bedrock-agentcore.{area}.amazonaws.com"
        origin_path = f"/runtimes/{encoded_arn}/invocations"

        # Create CORS response headers coverage if wanted
        cors_policy = None
        if enable_cors:
            cors_policy = ResponseHeadersPolicy(self, 'CorsPolicy',
                cors_behavior=ResponseHeadersCorsBehavior(
                    access_control_allow_origins=['*'],  # Or specify your frontend domains
                    access_control_allow_headers=[
                        'Authorization',
                        'Content-Type', 
                        'X-Amzn-*',
                        'X-Requested-With'
                    ],
                    access_control_allow_methods=['GET', 'POST', 'OPTIONS'],
                    access_control_expose_headers=['*'],
                    access_control_allow_credentials=False,
                    origin_override=True  # Overrides CORS headers from origin
                )
            )

        # Base distribution configuration
        distribution_props = {
            "default_behavior": BehaviorOptions(
                origin=HttpOrigin(
                    bedrock_agentcore_hostname,
                    origin_path=origin_path,  # Direct path to agent endpoint
                    protocol_policy=OriginProtocolPolicy.HTTPS_ONLY,
                    read_timeout=Period.seconds(120) # Elective: for responses >30s, regulate as wanted
                ),
                viewer_protocol_policy=ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
                cache_policy=CachePolicy.CACHING_DISABLED,
                allowed_methods=AllowedMethods.ALLOW_ALL,
                response_headers_policy=cors_policy,  # Add CORS coverage if enabled
                origin_request_policy=OriginRequestPolicy.ALL_VIEWER,  # Ahead headers for MCP
            )
        }

        # Elective: Add {custom} area
        if domain_name:
            # Use from_hosted_zone_attributes for particular zone
            hosted_zone = HostedZone.from_hosted_zone_attributes(self, 'HostedZone',
                                                                 zone_name="yourcompany.com",  # Your root area
                                                                 hosted_zone_id=hosted_zone_id
                                                                 )

            certificates = Certificates(self, 'Certificates',
                                      domain_name=domain_name,
                                      validation=CertificateValidation.from_dns(
                                          hosted_zone),
                                      )

            # Add {custom} area to distribution
            distribution_props["domain_names"] = [domain_name]
            distribution_props["certificate"] = certificates

        distribution = Distribution(self, 'Distribution', **distribution_props)

        # Create DNS report if utilizing {custom} area
        if domain_name:
            ARecord(self, 'AliasRecord',
                    zone=hosted_zone,
                    record_name=domain_name,
                    goal=RecordTarget.from_alias(
                        CloudFrontTarget(distribution)),
                    )

        # Outputs
        if domain_name:
            domain_url = f"https://{domain_name}/"
            CfnOutput(self, "AgentEndpoint",
                      worth=domain_url,
                      description="Your {custom} area endpoint"
                      )

        CfnOutput(self, "CloudFrontDistribution",
                  worth=f"https://{distribution.distribution_domain_name}/",
                  description="CloudFront default area (works with out {custom} area)"
                  )

Configure the AWS CDK app Entry Level:

# app.py
#!/usr/bin/env python3
import aws_cdk as cdk
from agentcore_custom_domain.agentcore_custom_domain_stack import AgentCoreCustomDomainStack

app = cdk.App()
AgentcoreCustomDomainStack(app, "AgentCoreCustomDomainStack",
    # CloudFront requires certificates in us-east-1
    env=cdk.Atmosphere(area='us-east-1'),
)
app.synth()

Develop a {custom} area

Now you’ll be able to deploy the answer and confirm that it really works with each the {custom} and default domains. Full the next steps:

Replace the next worth to agentcore_custom_domain_stack.py:
- Amazon Bedrock Agentcore Runtime Arn
- Area identify (in case you are utilizing a {custom} area)
- Hosted Zone ID (if utilizing a {custom} area)
Deploy utilizing the AWS CDK:

Take a look at the endpoint

After you deploy a {custom} area, you’ll be able to take a look at the endpoint utilizing both a {custom} area or a CloudFront default area.

export TOKEN=$(aws cognito-idp initiate-auth 
  --client-id "your-client-id" 
  --auth-flow USER_PASSWORD_AUTH 
  --auth-parameters USERNAME='testuser',PASSWORD='MyPassword123' 
  --region us-east-1 | jq -r '.AuthenticationResult.AccessToken')

Take a look at it on a {custom} area utilizing the next code:

curl -X POST "https://my-agent.yourcompany.com/" 
  -H "Authorization: Bearer $TOKEN" 
  -H "Content material-Kind: utility/json" 
  -H "X-Amzn-Bedrock-AgentCore-Runtime-Session-Id: session-12345678901234567890123456789012345" 
  -d '{"immediate": "Howdy, how are you going to assist me as we speak?"}'

Alternatively, use the next code to check it within the default area of the cloud entrance:

curl -X POST "https://d1234567890123.cloudfront.internet/" 
  -H "Authorization: Bearer $TOKEN" 
  -H "Content material-Kind: utility/json" 
  -H "X-Amzn-Bedrock-AgentCore-Runtime-Session-Id: session-12345678901234567890123456789012345" 
  -d '{"immediate": "Howdy, how are you going to assist me as we speak?"}'

If all the things works appropriately, you’ll obtain a response from the agent by means of both endpoint. I efficiently created a {custom} area for the Amazon Bedrock AgentCore Runtime Agent!

Issues

When implementing this resolution in manufacturing, the next are some vital issues:

Value influence – CloudFront provides information switch and requests prices. Examine Amazon CloudFront costs to grasp the influence of utilization patterns.
Enhanced safety – Contemplate implementing the next safety measures:
- AWS WAF guidelines to assist shield towards widespread net exploits.
- Charge limits that assist stop abuse.
- Geography restrictions if the agent is simply accessible from a selected area.
Monitoring – Allow Cloud Entrance Entry Logging and arrange Amazon CloudWatch alarms to observe error charges, latency, and request volumes.

cleansing

To keep away from ongoing prices, take away assets after they not want them.

Chances are you’ll must manually delete the Root 53 Hosted Zone and ACM Certificates from the respective Service Console.

Conclusion

On this put up, we confirmed you how you can use CloudFront as a reverse proxy to create a {custom} area identify on your Amazon Bedrock AgentCore Runtime Agent Agent agent endpoint. This resolution affords a number of vital advantages: Simplified integration of your improvement crew, {custom} domains matching your group, cleaner infrastructure abstractions, and simple upkeep when endpoints have to be up to date. Through the use of CloudFront as a reverse proxy, you can even present each front-end purposes and back-end agent endpoints from the identical area, avoiding the widespread CORS challenges.

We suggest exploring this resolution additional by adapting to your particular wants. It is strongly recommended to reinforce it with further security measures, arrange monitoring, and combine it with current infrastructure.

For extra details about constructing and deploying AI brokers, see the Amazon Bedrock AgentCore Developer Information. For superior configurations and greatest practices utilizing Cloud Entrance, see the Amazon CloudFront documentation. You’ll find extra details about SSL certificates within the AWS Certificates Supervisor documentation and area administration in Amazon Route 53 paperwork.

Amazon Bedrock AgentCore is at present previewed and topic to vary. Commonplace AWS pricing applies to further companies akin to CloudFront, Route 53, and Certificates Supervisor.

In regards to the creator

Rahmat Fedayizada I’m Senior Options Architect for the AWS Power and Utilities crew. He works with power firms to design and implement scalable, safe, and extremely obtainable architectures. Rahmat is captivated with reworking advanced technical necessities into actionable options that drive enterprise worth.

Parabuba He’s Senior Supervisor at Options Structure at AWS and leads a crew of Options Architects to assist power clients innovate and speed up their transformation. Beginning as a Options Architect in 2012, Para is captivated with architecting scalable options and constructing organizations targeted on utility modernization and AI initiatives.

Welcome to Ivugangingo!

At Ivugangingo, we're passionate about delivering insightful content that empowers and informs our readers across a spectrum of crucial topics. Whether you're delving into the world of insurance, navigating the complexities of cryptocurrency, or seeking wellness tips in health and fitness, we've got you covered.

Configure a {custom} area identify for the Amazon Bedrock AgentCore runtime agent

Advantages of the Amazon Bedrock Agentcore Runtime

Advantages of {custom} domains

Answer overview

Conditions

Create an agent with inbound authentication

Arrange a {custom} area resolution

Develop a {custom} area

Take a look at the endpoint

Issues

cleansing

Conclusion

In regards to the creator

Web3 Computing has a belief drawback, however the answer is evident

These newly found cells breathe in two methods

Converter

Editors Pick

Newsletter

Categories

Related Posts