Amazon Bedrock AgentCore Session Endpoints Enable Live Web App Previews
· Engineer's Notes · Cem Koyluoglu
Session endpoints let coding agents run a Vite site in an isolated microVM, providing authenticated live previews via local endpoints.
What happened
Amazon Bedrock AgentCore provides a runtime that executes each agent session inside an isolated microVM. The runtime exposes Session endpoints, which generate an authenticated URL for each session. The URL forwards HTTP methods, query strings, bodies, and WebSocket connections to ports that are explicitly allowed via the allowedPorts parameter when CreateAgentRuntime is called. Allowed ports can be up to five entries, each a single port or a range within 8000–12000, excluding reserved platform ports. In the sample, the coding agent listens on port 8080, the Vite development server serves the website on port 8090, and a status route is exposed on port 8081. Only ports 8090 and 8081 are listed in allowedPorts; port 8080 is reachable directly via the runtime endpoint, not through the Session endpoint.
The workflow starts by invoking InvokeAgentRuntime, which creates a session, starts the Vite server, and returns the Session endpoint URL in the X-Amzn-Bedrock-AgentCore-Runtime-Session-Endpoint-Url response header. A local endpoint on localhost:8088 is opened by the SDK; it injects the caller’s AWS credentials (SigV4 signature or JWT bearer token) into each request before forwarding to the Session endpoint. The preview page runs on localhost:8087, displaying the live website on the right and a chat interface on the left. When a user prompts the agent to modify the site (e.g., switch to a dark theme), the agent calls Claude Haiku 5.5, reads and writes files, and the Vite server pushes the changes over its hot‑reload WebSocket. The WebSocket traffic traverses the Session endpoint and the local endpoint, updating the browser without a full refresh.
Why it matters in production
The design isolates development workloads in microVMs, reducing cross‑tenant risk while allowing rapid iteration. Authenticated Session endpoints enforce per‑request SigV4 or JWT validation, preventing unauthorized access even if the URL is exposed. Because the endpoint forwards only the ports listed in allowedPorts, the attack surface is limited to explicitly exposed services. The use of a local proxy to add credentials means standard browsers can interact with the preview without custom signing logic, simplifying developer tooling.
Latency is minimized by keeping the Vite server inside the same microVM; file changes propagate through the hot‑reload WebSocket in seconds, avoiding full deployment cycles. However, Session endpoints are intended for short‑lived preview sessions; they are not suitable for serving production traffic, which should use a dedicated hosting service such as AWS Amplify. The requirement for public HTTPS and the lack of PrivateLink support for inbound connections may affect network security policies in restricted environments.
Engineering takeaways
- Define
allowedPortsnarrowly (e.g., only 8090 and 8081) to limit exposure of services inside the microVM. - Use the Session endpoint for interactive development and testing; switch to a runtime endpoint and external hosting for production deployments.
- Ensure all requests include proper IAM SigV4 signatures or JWT tokens; the endpoint validates each request independently of URL knowledge.
- Deploy agents as zip bundles to S3 with Node.js 22 runtime to avoid Docker/ECR complexity; this aligns with the sample’s direct code deployment model.
- Verify that the Vite server binds to
0.0.0.0and disables host header checks, as the Session endpoint forwards requests under a runtime‑assigned hostname.
Related work on this site
- Agentic & LLM Automation — Multi-step LLM pipelines that run unattended: model cascades with fallbacks, validation gates, scheduled automation and alerting when something breaks.
- RAG & Grounded LLM Systems — LLM features that answer from the right source instead of from memory: document-grounded assistants, transcript-grounded chat and quality gates around generated output.
- YouTube AI Summarizer — Open-source Chrome extension on the Chrome Web Store: AI summaries, key points, deep analysis, a two-host AI podcast (Gemini TTS) and transcript-grounded chat for any YouTube video, using Groq or Ollama Cloud with the user’s own key.
- Automated AI News Pipeline (this site) — The pipeline behind this site’s Tech News: scheduled GitHub Actions scrape sources, an LLM cascade on Groq rewrites and enhances articles, and layered quality gates (date integrity, language checks, instruction-leak detection, duplicate detection) decide what gets published, with Telegram alerts.
This note was drafted with AI assistance from the primary source credited on this page, and automatically checked against that source before publishing.