Invoke an Amazon Bedrock AgentCore Runtime agent directly from Amazon EventBridge without AWS Lambda glue code, using an API Destination with Amazon Cognito M2M OAuth.
An Amazon EventBridge rule on a custom event bus sends matching events through an API Destination straight to an Amazon Bedrock AgentCore Runtime agent, with no AWS Lambda function in the path. The AWS CDK stack also builds and deploys the agent container, so one
cdk deploy gives you a working pattern.The EventBridge connection gets an access token from Amazon Cognito with the machine-to-machine (M2M)
client_credentials grant and sends it as a Bearer token. The AgentCore Runtime validates the JWT with a customJwtAuthorizer wired to the same Cognito user pool, so there's no manual step after deploy.API Destinations time out after 5 seconds, so the agent acknowledges each request at once and does the work in the background with the AgentCore SDK
@app.async_task decorator, which keeps the session alive. Deliveries that still fail after three retries go to an Amazon SQS dead-letter queue. Failures in the background work are logged to Amazon CloudWatch Logs.See the README for the endpoint URL format, idempotency, least-privilege IAM, and what to add for production.
< Back to all patterns
Clone repo
git clone https://github.com/aws-samples/serverless-patterns/cd serverless-patterns/eventbridge-apidestination-agentcore/typescript/cdkDeploy
cd cdknpm installcdk deployTesting
Publish a test event to the custom bus (the EventBusName output, agentcore-events):
aws events put-events --entries '[{"EventBusName":"agentcore-events","Source":"demo.orders","DetailType":"OrderCreated","Detail":"{\"orderId\":\"12345\",\"prompt\":\"Summarize this order and flag any anomalies.\"}"}]'Check the AgentCore Runtime's Amazon CloudWatch Logs (
/aws/bedrock-agentcore/runtimes/<AgentRuntimeId>-DEFAULT) to see the event arrive and the background processing run.Confirm the connection is usable:
aws events describe-connection --name agentcore-cognito-oauth should show AUTHORIZED.If delivery fails after retries, inspect the DLQ:
aws sqs receive-message --queue-url <DeadLetterQueueUrl output>.Cleanup
From the
cdk folder: cdk destroyAdditional resources
Created by:
