A static snapshot of a Marshal ledger. Search, filters and dependency lookups work in marshal web.
Agents / basic-runtime/template/AgentRuntime
basic-runtime/template/AgentRuntimeprod current
basic-runtime/template/AgentRuntime · bedrock-agentcore · v1 · sha256:09712e3fa41e…
Completeness
50%
Tools
0
Knowledge sources
0
Identity
service_principal
Environments
| Environment | Shipped | Live | Confirmed | State |
|---|---|---|---|---|
| prod | v1 | – | 2026-09-12 by ci | current |
Definition
- Model
- unknown
- Provider
- unknown
- Identity
- service_principal
- Principal
- iam-role/AgentExecutionRole
- Source
- basic-runtime/template.yamlresource type AWS::BedrockAgentCore::Runtime
Tools
No tools.
Knowledge
No knowledge sources.
Permissions
| Target | Privilege | Scope |
|---|---|---|
| other/aws.${ECRRepository.Arn} | ecr:BatchGetImage | read |
| other/aws.${ECRRepository.Arn} | ecr:GetDownloadUrlForLayer | read |
| other/aws.${ECRRepository.Arn} | ecr:BatchCheckLayerAvailability | write |
| other/aws.* | ecr:GetAuthorizationToken | read |
| other/aws.* | logs:DescribeLogStreams | read |
| other/aws.* | logs:CreateLogGroup | write |
| other/aws.* | logs:DescribeLogGroups | read |
| other/aws.* | logs:CreateLogStream | write |
| other/aws.* | logs:PutLogEvents | write |
| other/aws.* | xray:PutTraceSegments | write |
| other/aws.* | xray:PutTelemetryRecords | write |
| other/aws.* | xray:GetSamplingRules | read |
| other/aws.* | xray:GetSamplingTargets | read |
| other/aws.* | cloudwatch:PutMetricData | write |
| other/aws.arn:aws:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:workload-identity-directory/default | bedrock-agentcore:GetWorkloadAccessToken | read |
| other/aws.arn:aws:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:workload-identity-directory/default/workload-identity/* | bedrock-agentcore:GetWorkloadAccessToken | read |
| other/aws.arn:aws:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:workload-identity-directory/default | bedrock-agentcore:GetWorkloadAccessTokenForJWT | read |
| other/aws.arn:aws:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:workload-identity-directory/default/workload-identity/* | bedrock-agentcore:GetWorkloadAccessTokenForJWT | read |
| other/aws.arn:aws:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:workload-identity-directory/default | bedrock-agentcore:GetWorkloadAccessTokenForUserId | read |
| other/aws.arn:aws:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:workload-identity-directory/default/workload-identity/* | bedrock-agentcore:GetWorkloadAccessTokenForUserId | read |
| other/aws.* | bedrock:InvokeModel | execute |
| other/aws.* | bedrock:InvokeModelWithResponseStream | execute |
Portability
Score out of 100| Platform | Score | Main limitations |
|---|---|---|
| Amazon Bedrock Agents | 100 | |
| Microsoft Copilot Studio | 70 | identity service_principal: other identities |
| Salesforce Agentforce | 100 | |
| Google ADK on Vertex AI Agent Engine | 85 | |
| Databricks (Apps and Genie) | 100 |
History
| When | Event | Environment | Version | Channel | By |
|---|---|---|---|---|---|
| 2026-09-12 17:56 | shipped | prod | v1 | ci |