New pattern - lambda-strands-agent-bedrock-cdk#3093
Conversation
…bda with Bedrock Deploy a Strands Agents SDK agent on AWS Lambda using the official Lambda layer, with Amazon Bedrock as the model provider and custom Python tool use. Zero patterns exist for Strands Agents in the repo.
|
Hi @biswanathmukherjee 👋 This is the first Strands Agents pattern — AWS's new open-source agent framework (launched 2026). Shows Lambda + Strands Agent Layer + Bedrock tool use. Unique service integration with zero existing coverage. Deployed and tested. |
|
Hi @bfreiberg 👋 — friendly nudge on this pattern. It's been deployed and tested end-to-end on a live AWS account. Happy to address any feedback. Thank you! |
marcojahn
left a comment
marcojahn
left a comment
There was a problem hiding this comment.
Hello @NithinChandranR-AWS, thanks for your contribution, please find a few comments/requests for changes attached. Please review
|
All comments addressed and pushed. Thanks for the thorough review, @marcojahn , Appreciate your time and help. |
|
Hi @marcojahn — all 5 items from your review are fixed and pushed. Thanks again for the thorough feedback. |
marcojahn
left a comment
marcojahn
left a comment
There was a problem hiding this comment.
Verification failed — the invoke step errors out
I deployed and tested the sample (samples account, eu-central-1) following the README. Step 1 (describe-stacks) works, but step 2 (lambda invoke) fails: StatusCode 200 with FunctionError: "Unhandled", and output.json contains a Bedrock AccessDeniedException — the expected 1188 answer is never returned.
AccessDeniedException when calling ConverseStream: ... is not authorized to perform:
bedrock:InvokeModelWithResponseStream on resource:
arn:aws:bedrock:eu-central-1:<account>:inference-profile/eu.anthropic.claude-sonnet-4-20250514-v1:0
Root cause — us. vs eu. mismatch:
index.pynever reads theMODEL_IDenv var —Agent(system_prompt=..., tools=[calculate])is called with no model id, so the Strands SDK uses its default, which resolves to theeu.inference profile in eu-central-1.- The IAM policy in the stack only grants the
us.inference-profile ARN. The runtime call hitseu., so the grant doesn't match → access denied.
Fix direction: make the handler read MODEL_ID and pass it to the agent, and make the model id + IAM inference-profile ARN region-aware (or document/enforce that the sample is us-*-only) so the granted profile always matches the one actually invoked.
…-portable IAM, add architecture diagram - Handler now reads MODEL_ID env var and passes to Agent(model=...) - MODEL_ID auto-derives region prefix (us/eu/apac) from deploy region - IAM policy uses wildcard for cross-region inference profile routing - Updated model from legacy sonnet-4-20250514 to current sonnet-4-6 - Added text architecture diagram per reviewer request - Fixed bare service names and <code> tags
|
Thank you for the thorough deploy test, Marco. You're right -- the handler wasn't reading MODEL_ID from the environment. Fixed: the agent now explicitly reads and passes it, and the CDK derives the correct regional prefix. Re-deployed and verified in us-east-1. |
3 participants
Description
Deploy a Strands Agents SDK agent on AWS Lambda using the official Lambda layer (no custom packaging), with Amazon Bedrock as the model provider and custom Python tool use.
Features
arn:aws:lambda:{region}:856699698935:layer:strands-agents-py3_12-x86_64:1)@tooldecorator for calculator toolChecklist