akeyless-agentcore-runtime

Fetch Akeyless secrets at runtime on AWS Bedrock AgentCore. Authenticate with cloud identity (AWS IAM) — no long-lived API keys in your agent deployment. Application secrets stay in Akeyless, not AWS Secrets Manager.

Built on the Akeyless Python SDK with AgentCore-specific auth, path conventions, caching, and optional MCP tools.

Repository: github.com/akeyless-community/bedrock-agentcore-akeyless-runtime

Documentation

Why this integration?

AgentCore Runtime provides an IAM execution role with ambient AWS credentials. This library uses those credentials to generate an Akeyless cloud ID and authenticate — the same pattern used by EKS, Lambda, and other Akeyless integrations.

Install

No git clone needed. Add to your agent project and install with pip.

From PyPI (recommended)

pip install akeyless-agentcore-runtime

See docs/PYPI_PUBLISHING.md for maintainer setup. The package is not on PyPI yet — use GitHub install below until the first release is published.

From GitHub (available now)

pip install "akeyless-agentcore-runtime @ git+https://github.com/akeyless-community/bedrock-agentcore-akeyless-runtime.git@v0.3.0"

Add to your AgentCore requirements.txt:

akeyless-agentcore-runtime @ git+https://github.com/akeyless-community/bedrock-agentcore-akeyless-runtime.git@v0.3.0
bedrock-agentcore>=0.1.0

Full install guide (extras, MCP CLI, verification): docs/INSTALL.md

Requires Python 3.10+.

Quick start

1. Configure Akeyless

Follow docs/AKEYLESS_SETUP.md — create an AWS IAM Auth Method, RBAC, and store secrets under /bedrock-agentcore/<agent>/<env>/.

2. Set bootstrap env vars on AgentCore

Configure only auth + path prefix — not application secrets:

3. Fetch a secret in your agent

from akeyless_agentcore import get_secret

api_key = get_secret("OPENAI_API_KEY")

Works in both sync scripts and async def AgentCore handlers — it calls the Akeyless SDK directly (blocking HTTP, cached between invocations).

4. Deploy

agentcore deploy

See examples/strands-agent/ for a complete agent.

Two ways to retrieve secrets

Both use the same Akeyless SDK under the hood (auth + get_secret_value). The tool adds a JSON response layer for agent frameworks.

from akeyless_agentcore import get_secret
from akeyless_agentcore.tools.strands import create_strands_tools

api_key = get_secret("OPENAI_API_KEY")              # you call this
agent = Agent(model=model, tools=create_strands_tools())  # agent calls get_akeyless_secret

Recommended production pattern: both — see examples/hybrid-agent/.

Full details: docs/DEPLOYMENT.md

API reference

get_secret(name) — fetch a secret from your code

from akeyless_agentcore import get_secret

api_key = get_secret("OPENAI_API_KEY")

AkeylessRuntimeClient — full client

from akeyless_agentcore import AkeylessRuntimeClient

client = AkeylessRuntimeClient(
    gateway_url="https://api.akeyless.io",
    secret_prefix="/bedrock-agentcore/my-agent/production",
    access_id="p-xxxxx",
    access_type="aws_iam",
)

client.get_secret("OPENAI_API_KEY")
client.get_secret_json("APP_CONFIG")
client.get_dynamic_secret("aws-creds")
client.get_rotated_secret("api-key")
client.list_secrets()

Agent tools — get_akeyless_secret / list_akeyless_secrets

from akeyless_agentcore.tools.strands import create_strands_tools
# or: pip install 'akeyless-agentcore-runtime[mcp]' for MCP server

Authentication

Architecture

sequenceDiagram
    participant Agent as AgentCore Runtime
    participant Lib as akeyless-agentcore-runtime
    participant AWS as AWS STS/IAM
    participant AKL as Akeyless Gateway

    Agent->>Lib: get_secret("OPENAI_API_KEY")
    Lib->>AWS: Generate cloud ID (SigV4 GetCallerIdentity)
    AWS-->>Lib: Signed identity proof
    Lib->>AKL: POST /auth (access_id, aws_iam, cloud_id)
    AKL-->>Lib: Session token
    Lib->>AKL: GET /get-secret-value
    AKL-->>Lib: Secret value
    Lib-->>Agent: OPENAI_API_KEY

Local development

export AKEYLESS_ACCESS_ID=p-xxxxx
export AKEYLESS_ACCESS_TYPE=access_key
export AKEYLESS_ACCESS_KEY=your-readonly-key
export AKEYLESS_SECRET_PREFIX=/bedrock-agentcore/my-agent/dev

python3 -c "from akeyless_agentcore import get_secret; print(get_secret('OPENAI_API_KEY')[:8] + '...')"

Related community projects

• netlify-akeyless-runtime — Netlify Functions
• fly-akeyless-runtime — Fly.io Machines
• vercel-akeyless-runtime — Vercel serverless
• heroku-akeyless-runtime — Heroku dynos

License

Apache-2.0