agents-harden

Run a structured checklist covering IAM scoping, inbound auth (AWS_IAM or CUSTOM_JWT), secrets management, input validation, session lifecycle configuration, cold start optimization, and quota review. The skill reads your agentcore.json and reports findings specific to your project.

Call StopRuntimeSession after each invocation, reuse session IDs across related requests, and lower idleRuntimeSessionTimeout for short-lived workloads before requesting an increase. Idle environments count against maxVms until reclaimed, so most cases are session lifecycle issues, not true concurrency.

Decode a sample token from your identity provider. If it has a client_id claim but no aud claim, configure allowedClients; if it has an aud claim, configure allowedAudience. Picking the wrong one causes 403 errors even with valid tokens.

No. Runtime environment variables are plaintext config values, not vault-backed secrets. Register credentials with agentcore add credential and fetch them in code via the @requires_api_key or @requires_access_token decorators, which pull from Secrets Manager at call time.

Reuse session IDs so requests route to warm environments, keep deployment packages under 200 MB, and defer heavy imports and client initialization until first request rather than module import time. Session reuse is the highest-leverage optimization.

Use agents-connect for Cedar tool-restriction policies and outbound credential wiring, agents-optimize for quality measurement, agents-build for A2A agent-to-agent auth, and agents-debug for cold start observation and diagnosis rather than optimization.