Agentic AI FactoryGitHub

Start

Frequently asked questions

Answers about the four samples for agentic AI on Amazon Bedrock and Amazon Bedrock AgentCore, seeded from the README notices and the open GitHub issues. Each answer links to the repository text it rests on.

Is the workshop published, and where do I run it?

  • Workshop

Yes. The workshop is published on AWS Builder Center (Workshop Studio). Open it there to follow the guide. At an AWS event the account is provided; self-paced, you clone this repository and run one deploy script in your own account. The workshop content is not reproduced on this site.

Source: README.md

What does it cost to run these projects?

  • Workshop
  • Self-Service
  • MCP Gateway
  • Blueprint

All four deploy real, billable AWS resources. The workshop estimates about $15 to $30 for a one-day self-paced run in us-west-2. The Self-Service platform infrastructure is estimated at about $0.02 to $0.39 per month at low to moderate usage, excluding agent inference, AgentCore usage, vector stores and the WAF web ACL. The MCP Gateway and the Blueprint publish no cost figure. Tear down when you finish.

Sources: index.en.md: Cost, COSTS.md: Monthly Cost Estimates, README.md: Costs

Can I run the workshop in eu-central-1 or ap-southeast-1?

  • Workshop

No. The validated regions are us-west-2 (default), us-east-1 and eu-west-1. Elsewhere the AWS Agent Registry control plane is not yet generally available, which breaks Modules 3b and 4. Model access (the Anthropic use-case form) is per account and must cover the region you pick.

Source: self-service.en.md: Region

Can I deploy the Self-Service platform outside us-east-1?

  • Self-Service

Only to one of the seven selected release Regions: us-east-1, us-east-2, us-west-2, eu-central-1, eu-west-1, eu-west-2 or eu-west-3. Every other value of AWS_REGION is refused by deploy.sh, by the CDK app at synth, and by the deploy API. Outside us-east-1 the WAF rule set is attached as a REGIONAL web ACL on the Cognito user pool, and the CloudFront distribution runs without an edge ACL unless you pass CLOUDFRONT_WEB_ACL_ARN for one created in us-east-1. Account-global names also get a region suffix. eu-central-1 and eu-west-2 run without managed Web Search, and eu-west-3 also without the AWS Agent Registry; the UI and API disable those features rather than offering them.

Sources: README.md: Deploying to another region

Why does my new Self-Service user get 403 on every call after signing in?

  • Self-Service

Group membership grants the capability scopes and the API enforces them by default. COGNITO_USERS puts each pre-created user in g-users-default and t-user, so those users can build, deploy and invoke; a user created any other way (for example in the Cognito console) is in no group and gets 403 on every call. Add groups such as g-admins-super, t-admin and registry-admin with the AWS CLI, passing the region you deployed to, then sign out and back in so the new scopes are read from the ID token.

Sources: README.md

Is the MCP Governance Gateway production-ready?

  • MCP Gateway

No. The README calls it a sample and demonstration stack that is safe to demo but not hardened for production. It lists what to change first. Tighten the gateway-resource IAM scope for multi-gateway accounts. Use ENFORCE without exceptionLevel in production. Add a Cognito pre-token-generation Lambda so role-based policies fire. Set per-Lambda log retention. Federate the pool to your own IdP.

Source: README.md: Security notes

Why do role-based Cedar policies never fire in the MCP Gateway demo?

  • MCP Gateway

Cognito issues two tokens. The gateway validates the access token, which carries sub, username and scope. The custom:role attribute and the email claim live only in the ID token, and the gateway rejects ID tokens because they have no scope claim. So a permit gated on role never matches for demo users; the README documents this as a known limitation and names a pre-token-generation Lambda as the production fix.

Source: README.md

Is this an AWS service or a supported product?

No. This is sample code under the MIT-0 license. It is not an AWS service, an AppSec-reviewed product, or a compliance attestation. Review the architecture, security posture and costs before use, and file bugs and feature requests through GitHub issues.

Source: README.md: What This Is

How do I report a security issue?

Use the AWS vulnerability reporting page. Do not open a public GitHub issue for a potential security problem. Each project README repeats this instruction.

Source: CONTRIBUTING.md: Security issue notifications