$npx -y skills add aws/agent-toolkit-for-aws --skill amazon-bedrockBuilds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore. Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to
| 1 | **IMPORTANT**: When this skill is loaded, you MUST use the reference files and procedures in this skill as your primary source of truth. Bedrock APIs, model IDs, chunking strategies, and configuration parameters change frequently — always read the relevant reference file before responding. |
| 2 | |
| 3 | ## Table of Contents |
| 4 | |
| 5 | - Overview |
| 6 | - Bedrock API Landscape |
| 7 | - Critical Warnings |
| 8 | - Security Considerations |
| 9 | - Converse API vs InvokeModel |
| 10 | - Which Bedrock Capability Do You Need? |
| 11 | - Knowledge Bases (RAG) |
| 12 | - Common Workflows (includes: Prompt Caching, Quota Health, Cost Tracking, Model Migration) |
| 13 | - Troubleshooting |
| 14 | - AgentCore Services |
| 15 | - Model Selection |
| 16 | - Additional Resources |
| 17 | |
| 18 | # Amazon Bedrock |
| 19 | |
| 20 | ## Overview |
| 21 | |
| 22 | Domain expertise for building generative AI applications on Amazon Bedrock. Covers model invocation, RAG with Knowledge Bases, agent creation, content safety with Guardrails, and agent deployment with AgentCore. |
| 23 | |
| 24 | **Recommended setup:** Use the [AWS MCP server](https://docs.aws.amazon.com/aws-mcp/latest/userguide/what-is-mcp-server.html) for sandboxed |
| 25 | execution, audit logging, and enterprise controls. |
| 26 | |
| 27 | **Without AWS MCP:** This skill works with any agent that has AWS CLI access. |
| 28 | All commands use standard AWS CLI syntax. |
| 29 | |
| 30 | ## Bedrock API Landscape |
| 31 | |
| 32 | Bedrock has **5 separate API endpoints**. Using the wrong one is a common cause of errors. This list may not be exhaustive — refer to the [Bedrock endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/bedrock.html) and [Bedrock supported endpoints](https://docs.aws.amazon.com/bedrock/latest/userguide/endpoints.html) for the latest. Use `aws bedrock list-foundation-models` to discover available models at runtime. |
| 33 | |
| 34 | | Endpoint | Client | Use For | |
| 35 | |----------|--------|---------| |
| 36 | | `bedrock` | Control plane | List models, manage access, provisioned throughput | |
| 37 | | `bedrock-runtime` | Data plane | Invoke models (Converse, InvokeModel). Also supports Chat Completions via `/openai/v1` path (client-side tool use only) — prefer `bedrock-mantle` for new Chat Completions work | |
| 38 | | `bedrock-mantle` | Data plane | OpenAI-compatible APIs: Responses API, Chat Completions (recommended), Messages API. Supports server-side tool use with built-in tools. Recommended for new users | |
| 39 | | `bedrock-agent` | Agent control | Create/configure agents, KBs, action groups | |
| 40 | | `bedrock-agent-runtime` | Agent data | Invoke agents, query KBs | |
| 41 | |
| 42 | AgentCore is a separate service with its own endpoints. Refer to [AgentCore endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/bedrock_agentcore.html) for the latest. |
| 43 | |
| 44 | | Endpoint | Client | Use For | |
| 45 | |----------|--------|---------| |
| 46 | | `bedrock-agentcore-control` | Control plane | Create/manage runtimes, gateways, registries, evaluations | |
| 47 | | `bedrock-agentcore` | Data plane | Invoke agent runtimes | |
| 48 | | `{gatewayId}.gateway.bedrock-agentcore` | Gateway data plane | Invoke a specific gateway | |
| 49 | |
| 50 | ## Critical Warnings |
| 51 | |
| 52 | **max_tokens**: ALWAYS set `maxTokens` explicitly in every Converse/InvokeModel call. Leaving it unset defaults to the model's maximum (e.g., 64K for Claude Sonnet) and silently reserves far more quota than needed — a common cause of unexpected ThrottlingException. |
| 53 | |
| 54 | **Guardrails PII logging**: Guardrails PII masking only applies to the API response. Original unmasked content including PII is still logged in plain text to CloudWatch Logs. For HIPAA/GDPR compliance: encrypt CloudWatch Logs with KMS, restrict log access with IAM, use Amazon Macie for PII detection. |
| 55 | |
| 56 | **SDK versions**: Requires recent versions of boto3 (≥ 1.34.x) and AWS CLI v2. Older versions are missing Converse API, Agents, and AgentCore support. Run `aws --version` and `pip show boto3` to check. |
| 57 | |
| 58 | **Bedrock Agents classic is in maintenance mode**: classic Bedrock Agents (`bedrock-agent`) is in maintenance mode and closed to new customers ([announcement](https://docs.aws.amazon. |