amazon-bedrock

About amazon-bedrock

Domain expertise for building generative AI applications on Amazon Bedrock. It covers model invocation through the Converse API and InvokeModel, retrieval-augmented generation with Knowledge Bases, Bedrock Agents, content safety with Guardrails, and agent deployment and scaling with AgentCore. Use it when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, troubleshooting Bedrock errors such as ThrottlingException and AccessDeniedException, or choosing among models like Claude, Llama, Nova, and Titan. It also addresses prompt caching, quota health checks, cost tracking, model migration, chunking strategies, and AgentCore Payments, but it is explicitly not for custom model training, Rekognition, or Comprehend. Because Bedrock APIs, model IDs, and configuration parameters change frequently, the skill insists on reading its bundled reference files as the primary source of truth before responding.

A major theme is the Bedrock API landscape, which exposes five separate endpoints whose misuse is a common source of errors: the bedrock control plane for listing models and managing access; bedrock-runtime for invoking models via Converse or InvokeModel; bedrock-mantle for OpenAI-compatible APIs (recommended for new users); and bedrock-agent and bedrock-agent-runtime for agent configuration and invocation. AgentCore is a separate service with its own control and data plane endpoints. The skill recommends the AWS MCP server for sandboxed execution and audit logging but works with any agent that has AWS CLI access.

It foregrounds critical warnings and security practices. maxTokens should always be set explicitly because leaving it unset reserves far more quota than needed and causes unexpected throttling; Guardrails PII masking applies only to responses while unmasked content is still logged to CloudWatch; and recent boto3 and AWS CLI v2 versions are required. Security guidance favors IAM roles over users, scoped permissions, Secrets Manager, confused-deputy protection, and treating agent-generated parameters as untrusted input. The Converse API is preferred over InvokeModel for a unified request/response format, with capability and model-selection tables pointing to deeper reference files.

FAQ

Which Bedrock API should I use to invoke a model?

On the bedrock-runtime endpoint the skill recommends the Converse API over InvokeModel because it provides a unified request/response format across all models. InvokeModel is reserved for rare provider-specific features, and bedrock-mantle is recommended for new OpenAI-compatible work.

Why does it stress setting maxTokens on every call?

Leaving maxTokens unset defaults to the model's maximum (for example 64K for Claude Sonnet) and silently reserves far more quota than needed, which is a common cause of unexpected ThrottlingException.

How many Bedrock API endpoints are there and what are they for?

Five: bedrock (control plane), bedrock-runtime (invoke models), bedrock-mantle (OpenAI-compatible APIs), bedrock-agent (configure agents and KBs), and bedrock-agent-runtime (invoke agents and query KBs). AgentCore is a separate service with its own endpoints.

What does the skill warn about Guardrails and PII?

Guardrails PII masking only applies to the API response; the original unmasked content, including PII, is still logged in plain text to CloudWatch Logs. For HIPAA/GDPR compliance it recommends encrypting those logs with KMS and restricting access.

Is this skill suitable for training custom models or using Rekognition?

No. It explicitly states it is not for custom model training, Rekognition, or Comprehend. It focuses on model invocation, RAG, agents, guardrails, and AgentCore.

All Files