> ## Documentation Index
> Fetch the complete documentation index at: https://docs.costgraph.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Bedrock AgentCore Runtime sandboxes

> Run CostGraph workflows and CI jobs in Amazon Bedrock AgentCore Runtime sandboxes: the key to create, its permissions, and its limits

Amazon Bedrock AgentCore Runtime runs your containerized agent in isolated per-session microVMs, and InvokeAgentRuntimeCommand runs shell commands inside a running session.

The following table shows what CostGraph runs on this provider.

| Workflows | CI runners | Connect with |
| - | - | - |
| Yes | Yes | Integrations or your own dispatcher |

## Connect

Connect Amazon Bedrock AgentCore Runtime on Integrations, and CostGraph starts sandboxes in your Amazon Bedrock AgentCore Runtime account. You don't run anything yourself.

1. In CostGraph, go to **Integrations > Sandbox > Amazon Bedrock AgentCore Runtime**.

2. Enter these fields:

   * **Runtime ARN** (`AGENTCORE_RUNTIME_ARN`, required): The ARN of the AgentCore Runtime sandboxes run in.

3. Click **Connect**.

### Your own dispatcher

To keep the key out of CostGraph or reach a private network, run your own dispatcher instead.
Set `provider` to `aws-agentcore` and the preceding fields as environment variables, as described in [Run your own dispatcher](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md#run-your-own-dispatcher).

## Key and permissions

AGENTCORE\_RUNTIME\_ARN is the ARN of an existing AgentCore Runtime (agent runtime) you created; its region is taken from the ARN. AWS credentials come from the standard AWS credential chain (IAM user/role access keys, SSO, or an assumed role) created in IAM.

IAM actions CostGraph calls, on the runtime ARN resource: bedrock-agentcore:InvokeAgentRuntimeCommand (create/ready/exec: a session is created implicitly by the first command on a new runtimeSessionId) and bedrock-agentcore:StopRuntimeSession (delete). There is no list call. Both permission names are stated in the AWS API/dev guide. If the runtime has a resource-based policy, it (and the endpoint policy) must also allow the caller.

Sources: [docs.aws.amazon.com: runtime execute command](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-execute-command.html), [docs.aws.amazon.com: API InvokeAgentRuntimeCommand](https://docs.aws.amazon.com/bedrock-agentcore/latest/APIReference/API_InvokeAgentRuntimeCommand.html), [docs.aws.amazon.com: runtime stop session](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-stop-session.html), [docs.aws.amazon.com: bedrock agentcore limits](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.html), [docs.aws.amazon.com: runtime lifecycle settings](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-lifecycle-settings.html).

## Limits

* Maximum hardware allocation per session is 2 vCPU / 8 GB (not adjustable). ([source](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.html))
* Maximum session duration 8 hours on microVMs (maxLifetime 60-28800 s); idle session timeout default 15 minutes (idleRuntimeSessionTimeout up to 8 hours). Both are runtime settings, not per session. ([source](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-lifecycle-settings.html))
* Per-command timeout default 300 s, max 3600 s; command max 65536 chars; runtimeSessionId at least 33 chars. ([source](https://docs.aws.amazon.com/bedrock-agentcore/latest/APIReference/API_InvokeAgentRuntimeCommand.html))
* Runtime containers must be ARM64 (arm64 only). ([source](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-http-protocol-contract.html))
* Active session workloads per account: 5,000 in us-east-1/us-west-2, 2,500 elsewhere (adjustable). ([source](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.html))

## Related

* [Supported sandbox providers](https://docs.costgraph.ai/costgraph/workflows/sandbox-providers.md)
* [Run workflows on a managed sandbox provider](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md)
* [Run CI jobs in sandboxes](https://docs.costgraph.ai/costgraph/autopilot/ci-sandboxes.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.