Bedrock Agents Advanced

Bedrock Agents enable foundation models to autonomously plan and execute multi-step tasks. Agents can use tools (action groups), access knowledge bases, and chain operations together to accomplish complex goals. This lesson covers agent architecture, action groups, and guardrails.

Agent Architecture

A Bedrock Agent consists of four components:

• Foundation model - The LLM that drives reasoning and planning (e.g., Claude 3.5 Sonnet)
• Instructions - System prompt that defines the agent's persona and behavior
• Action groups - Tools the agent can use, defined by OpenAPI schemas and backed by Lambda functions
• Knowledge bases - RAG-enabled data sources the agent can query for information

Creating an Action Group

{
  "openapi": "3.0.0",
  "paths": {
    "/get-order-status": {
      "get": {
        "summary": "Get the status of a customer order",
        "parameters": [{
          "name": "orderId",
          "in": "query",
          "required": true,
          "schema": {"type": "string"}
        }]
      }
    }
  }
}

Guardrails

Bedrock Guardrails protect your agent from generating harmful or off-topic content:

• Content filters - Block hate speech, violence, sexual content, and other harmful categories
• Denied topics - Prevent the agent from discussing specific topics (e.g., competitor products, legal advice)
• Word filters - Block specific words or phrases from appearing in responses
• PII redaction - Automatically detect and redact personally identifiable information
• Contextual grounding - Ensure responses are grounded in the provided context (reduce hallucination)

Agent Best Practices

• Keep action groups focused - Each action group should handle a specific domain (orders, inventory, support)
• Write clear API descriptions - The agent uses these descriptions to decide when to call each tool
• Implement idempotent actions - The agent may retry actions; ensure they are safe to execute multiple times
• Test with adversarial inputs - Try to break the agent with edge cases and prompt injection attempts