Amazon Web Services (AWS) has introduced a significant enhancement to its Amazon Bedrock AgentCore platform, enabling developers to preview web applications live as their coding agents build them. This new capability, powered by the AgentCore runtime and its Session endpoints, aims to streamline the development and review process by allowing instant visualization of changes made by AI agents.
The Chenab Times has learned that the AgentCore runtime facilitates the development, connection, and optimization of AI agents at scale, offering flexibility in choosing agent frameworks and foundation models. A key feature, Session endpoints, runs each agent session within an isolated microVM, providing authenticated URLs that allow developers to access and interact with applications directly from their browsers as they are being built.
This integration significantly speeds up the iterative development cycle. Traditionally, developers would need to redeploy applications to see changes made by coding agents, a process that could be time-consuming and slow down the review process. With Session endpoints, changes made by the agent are reflected in the browser in near real-time, enhancing productivity.
How Session Endpoints Function
Session endpoints are central to this new functionality. Each session is assigned a unique Session endpoint, which is configured with specific parameters to control access and functionality. Developers can define a set of allowed ports (between 8000 and 12000) that the endpoint can reach, ensuring that only designated application ports are accessible. The endpoint itself is accessible via a unique, authenticated URL, which is included in the response headers from the InvokeAgentRuntime API call.
Authentication is a critical aspect of Session endpoints. Requests made through these endpoints are authenticated using AWS Identity and Access Management (IAM) with Signature Version 4 (SigV4) or an inbound JSON Web Token (JWT) authorizer. This ensures that only authorized users can access the running application. The hostname used in the URL dictates the specific port within the session that the request is directed to, enabling access to multiple services running concurrently within the same session.
The Session endpoint supports various protocols, including HTTP/1.1, HTTP/2, and WebSocket connections, making it versatile for different types of web applications and real-time features like hot-reloading. Critically, each Session endpoint is scoped to a single session, meaning its URL is valid only for the duration of that session, thereby enhancing security. For production deployments, AWS recommends hosting applications on services like AWS Amplify Hosting.
A Practical Demonstration
The implementation demonstrated involves a coding agent capable of building and modifying a Vite website. The agent starts a Vite development server on port 8090 within its session. Developers can then use a local endpoint on their machine to securely connect to this development server. The preview application, running on http://localhost:8087, interacts with the agent through InvokeAgentRuntime, sending prompts and receiving feedback. As the agent modifies website files, the Vite server’s hot-reload WebSocket pushes these changes, updating the preview page without requiring a manual refresh.
The architecture illustrates how the preview page loads the website through the local endpoint and the Session endpoint, which forwards requests to the Vite development server. User prompts are sent to the agent, which interacts with foundation models like Claude Haiku 5.5 in Amazon Bedrock to determine necessary code changes. The agent then modifies files, and Vite’s hot-reload mechanism ensures these changes are immediately visible in the browser.
Furthermore, the system allows access to a second port within the same session, for instance, port 8081, which can be used to serve status information or other agent-related data. This demonstrates the flexibility of Session endpoints in providing access to multiple services running within an agent’s environment.
Security and Access Control
Access to sessions is rigorously protected. Requests are authenticated before being forwarded to the application, and the runtime strips its own authentication headers to ensure the application receives clean requests. All requests made through Session endpoints are logged in AWS CloudTrail under InvokeAgentRuntimeProxy events. The local endpoint itself is designed to listen only on 127.0.0.1, restricting access to the local machine and further enhancing security.
While Session endpoints provide access to applications within a session, they do not separate the website from the agent itself. Developers are advised to grant the execution role only the necessary permissions. For agents handling sensitive data or interacting with potentially untrusted prompts, Amazon Bedrock Guardrails can be employed to filter harmful content before it is processed or displayed.
Deployment and Cleanup
The process involves deploying the AgentCore runtime, configuring its protocol and allowed ports, and then starting a preview session. The sample code, available on GitHub, guides users through cloning the repository, running a notebook, and deploying the agent and its associated website. After use, a cleanup process is provided to stop the preview, delete the session, and remove the created AWS resources to avoid ongoing charges.
This new feature in Amazon Bedrock AgentCore runtime empowers developers by providing a more efficient and interactive way to build and test AI-generated web applications, bridging the gap between agent development and immediate visual feedback.
❤️ Support Independent Journalism
Your contribution keeps our reporting free, fearless, and accessible to everyone.
Or make a one-time donation
Secure via Razorpay • 12 monthly payments • Cancel anytime before next cycle
(We don't allow anyone to copy content. For Copyright or Use of Content related questions, visit here.)
The Chenab Times News Desk
