feat(bedrock-agentcore-alpha): allow tagging service-created runtime application log group by gingeekrishna · Pull Request #37997 · aws/aws-cdk

gingeekrishna · 2026-05-25T17:51:42Z

Issue # (if applicable)

Adds applicationLogGroupTags to RuntimeProps so users can apply tags to the AgentCore-managed CloudWatch Log Group at /aws/bedrock-agentcore/runtimes/{agentRuntimeId}-DEFAULT.

Because the log group is provisioned by the AgentCore service (not by CloudFormation), CDK cannot tag it via the runtime resource itself. When applicationLogGroupTags is provided, CDK pre-creates the log group with RemovalPolicy.RETAIN so the required tags are present from the first runtime invocation onward.

Reason for this change

The AgentCore service automatically creates a CloudWatch Log Group at /aws/bedrock-agentcore/runtimes/{agentRuntimeId}-DEFAULT for runtime application logs. The existing RuntimeProps.tags only tags the AWS::BedrockAgentCore::Runtime resource itself — there is no supported way to tag this service-created log group through CDK.

This is a blocker in environments that enforce mandatory resource tags for PII data isolation, cost allocation, retention/compliance automation, or access governance.

Description of changes

Added applicationLogGroupTags?: { [key: string]: string } to RuntimeProps.
When the prop is provided and non-empty, the Runtime constructor pre-creates a AWS::Logs::LogGroup with:
- logGroupName computed from the runtime's AgentRuntimeId CloudFormation attribute (no hardcoding).
- RemovalPolicy.RETAIN so logs are preserved if the stack is deleted.
- Tags applied via Tags.of(logGroup).add(key, value).
Reuses the existing validateTags() method for consistent key/value validation.
When the prop is absent or empty, no extra resource is created — zero impact on existing stacks.
JSDoc documents the orphaned log group risk when a runtime is replaced and its agentRuntimeId changes.
README updated with usage example and retention behaviour note.

Describe any new or updated permissions being added

None. The execution role already has logs:CreateLogGroup and related permissions scoped to /aws/bedrock-agentcore/runtimes/*.

Description of how you validated changes

Added 5 unit tests under describe('Runtime applicationLogGroupTags tests'):

Log group is synthesized with the correct Fn::Join-based name and all specified tags in a single assertion (avoids false positives from separate resource matches).
No log group created when prop is omitted.
No log group created when prop is {}.
ValidationError thrown for an aws:-prefixed tag key.
DeletionPolicy: Retain / UpdateReplacePolicy: Retain verified.

Integration test added at test/agentcore/runtime/integ.runtime-application-log-group-tags.ts. Snapshot generation requires a full build pipeline (blocked locally due to environment constraints) — see exemption request below.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

…application log group Adds `applicationLogGroupTags` to `RuntimeProps` so users can apply tags to the AgentCore-managed CloudWatch Log Group at `/aws/bedrock-agentcore/runtimes/{agentRuntimeId}-DEFAULT`. Because the log group is provisioned by the AgentCore service (not by CloudFormation), CDK cannot tag it via the runtime resource itself. When `applicationLogGroupTags` is provided, CDK pre-creates the log group with `RemovalPolicy.RETAIN` so the required tags are present from the first runtime invocation onward. fixes aws#37983

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds support for tagging the AgentCore runtime application CloudWatch Log Group by pre-creating it in CDK when tags are provided.

Changes:

Introduces applicationLogGroupTags prop on RuntimeProps and creates a /aws/bedrock-agentcore/runtimes/{agentRuntimeId}-DEFAULT log group with RemovalPolicy.RETAIN.
Applies user-specified tags to the pre-created log group.
Adds unit tests covering creation/non-creation, invalid tag keys, and retain policies.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/runtime/runtime.ts	Adds a new runtime prop and pre-creates/tag the application log group with retain policy.
packages/@aws-cdk/aws-bedrock-agentcore-alpha/test/agentcore/runtime/runtime.test.ts	Adds tests validating log group creation, tagging behavior, validation, and retention.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

aws-cdk-automation

The pull request linter fails with the following errors:

❌ Features must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

gingeekrishna · 2026-05-25T17:54:15Z

Exemption Request
The failing check (pr-triage-manager) is caused by a pre-existing infrastructure issue in aws-github-ops/aws-issue-triage-manager@main using deprecated set-output commands (unrelated to this PR's changes). Tracked upstream: aws-github-ops/aws-issue-triage-manager#42

…nLogGroupTags - Combine LogGroupName and Tags assertions into a single hasResourceProperties call to prevent false positives from separate resource matches (Copilot review) - Expand JSDoc to document orphaned log group risk on runtime replacement (Copilot review) - Add README section with usage example and retention behaviour note - Add integration test for applicationLogGroupTags feature

gingeekrishna · 2026-05-25T18:00:50Z

Exemption Request

Integration test snapshot: The integ test file (integ.runtime-application-log-group-tags.ts) has been added. Snapshot generation requires a full build pipeline (the aws-bedrockagentcore generated L1 files are not present in the local environment). Unit tests provide comprehensive coverage of all synthesis paths. Requesting exemption for the snapshot until a maintainer can run the integ runner.
pr-triage-manager pipeline failure: Caused by a pre-existing infrastructure issue in aws-github-ops/aws-issue-triage-manager@main using deprecated set-output commands — unrelated to this PR. Tracked upstream: Replace deprecated set-output usage with GITHUB_OUTPUT environment files aws-github-ops/aws-issue-triage-manager#42

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

… comments - README: remove unused agentcore import from code example - integ test: update header comment to match actual test intent and add listTagsForResource assertion to verify log group tags after deployment - unit tests: extract shared App/Stack/artifact setup into beforeEach to eliminate repeated boilerplate across test cases

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

…ogGroupTags - Add migration caveat to RuntimeProps JSDoc warning about ResourceAlreadyExistsException when adding applicationLogGroupTags to an existing runtime whose log group was already created by the service - Add same migration caveat to README documentation - Rename test 'fails when...' to 'Should throw when...' for consistency with other tests in the describe block

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

+   * **Retention behaviour**: the pre-created log group always uses
+   * `RemovalPolicy.RETAIN`. This means:


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

…omments - Rename JSDoc heading 'Retention behaviour' to 'Removal behavior' with clarifying note distinguishing RemovalPolicy from CloudWatch Logs retention period - Extract Tags.of() outside loop in constructor to avoid repeated tag-manager lookup - Rephrase README wording: Tags.of(runtime) does not propagate to service-created log group - Replace brittle resourceCountIs('AWS::Logs::LogGroup', 0) assertions with targeted checks that filter by bedrock-agentcore name pattern - Loosen error-message regex from exact-quote match to case-insensitive substring match - Append ':*' suffix to log group ARN in integ test to match CloudWatch Logs ARN format expected by listTagsForResource

Copilot AI review requested due to automatic review settings May 25, 2026 17:51

gingeekrishna had a problem deploying to automation May 25, 2026 17:51 — with GitHub Actions Failure

gingeekrishna temporarily deployed to automation May 25, 2026 17:51 — with GitHub Actions Inactive

github-actions Bot added beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK p2 labels May 25, 2026

gingeekrishna temporarily deployed to automation May 25, 2026 17:51 — with GitHub Actions Inactive

Copilot AI reviewed May 25, 2026

View reviewed changes

Comment thread packages/@aws-cdk/aws-bedrock-agentcore-alpha/test/agentcore/runtime/runtime.test.ts Outdated

Comment thread packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/runtime/runtime.ts

aws-cdk-automation requested changes May 25, 2026

View reviewed changes

aws-cdk-automation added the pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. label May 25, 2026

aws-cdk-automation temporarily deployed to automation May 25, 2026 17:54 — with GitHub Actions Inactive

gingeekrishna temporarily deployed to automation May 25, 2026 18:00 — with GitHub Actions Inactive

gingeekrishna requested review from aws-cdk-automation and Copilot May 25, 2026 18:04

gingeekrishna mentioned this pull request May 25, 2026

(aws-bedrock-agentcore-alpha): allow tagging service-created runtime application log group #37983

Open

2 tasks

Copilot AI reviewed May 25, 2026

View reviewed changes

gingeekrishna temporarily deployed to automation May 25, 2026 18:10 — with GitHub Actions Inactive

gingeekrishna requested a review from Copilot May 25, 2026 18:11

Copilot AI reviewed May 25, 2026

View reviewed changes

Comment thread packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/runtime/runtime.ts

Comment thread packages/@aws-cdk/aws-bedrock-agentcore-alpha/README.md

Comment thread packages/@aws-cdk/aws-bedrock-agentcore-alpha/test/agentcore/runtime/runtime.test.ts Outdated

gingeekrishna temporarily deployed to automation May 26, 2026 04:52 — with GitHub Actions Inactive

gingeekrishna requested a review from Copilot May 26, 2026 05:48

Copilot AI reviewed May 26, 2026

View reviewed changes

Comment thread packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/runtime/runtime.ts Outdated

Comment thread packages/@aws-cdk/aws-bedrock-agentcore-alpha/README.md Outdated

Comment thread packages/@aws-cdk/aws-bedrock-agentcore-alpha/test/agentcore/runtime/runtime.test.ts Outdated

Potential fix for pull request finding

0f53fa6

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

gingeekrishna temporarily deployed to automation May 26, 2026 05:53 — with GitHub Actions Inactive

gingeekrishna requested a review from Copilot May 26, 2026 05:54

Copilot AI reviewed May 26, 2026

View reviewed changes

Potential fix for pull request finding

0c1591c

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

gingeekrishna temporarily deployed to automation May 26, 2026 05:58 — with GitHub Actions Inactive

gingeekrishna requested a review from Copilot May 26, 2026 05:58

Copilot AI reviewed May 26, 2026

View reviewed changes

gingeekrishna temporarily deployed to automation May 26, 2026 06:37 — with GitHub Actions Inactive

Bevis-Z approved these changes May 27, 2026

View reviewed changes

Merge branch 'main' into fix/37983-application-log-group-tags

3d649d7

gingeekrishna temporarily deployed to automation May 27, 2026 12:51 — with GitHub Actions Inactive

		* Retention behaviour: the pre-created log group always uses
		* `RemovalPolicy.RETAIN`. This means:

Conversation

gingeekrishna commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gingeekrishna commented May 25, 2026

Uh oh!

gingeekrishna commented May 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

gingeekrishna commented May 25, 2026 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading