Build a Bedrock AgentCore AI Agent to Analyze AWS WAF Logs
· 12:52 · Watch on YouTube ↗
Summary
A hands-on tutorial builds and deploys a Bedrock AgentCore agent to analyze AWS WAF logs in CloudWatch Logs, summarize suspicious requests, and provide security insights. It also demonstrates correcting the agent role’s log-read permissions.
Key points
- The tutorial connects AWS WAF logs in CloudWatch Logs to an agent that summarizes request counts, allow/block actions, IP addresses, countries, and URIs.
- The agent uses tools to analyze WAF logs and provide security insights, including suggestions involving managed WAF rules.
- The presenter uses Amazon Q Developer to write code and configures the agent with Claude Sonnet 4.5.
- The tutorial demonstrates local testing, deployment to Bedrock AgentCore, and invoking the agent with a natural-language query.
- In the demo, the agent flags requests for cmd3.php and cmd2.php as possible web-shell or command-execution attempts; these are example log findings, not independently verified incidents.
- Deployment initially encounters an access issue. The presenter resolves it by attaching CloudWatch Logs read-only permissions to the agent’s IAM role.
Article Details
- Topics
- [00:11] Architecture for streaming AWS WAF logs to an AI agent for analysis
- [01:31] Code setup and tools for analyzing WAF logs and generating security insights
- [04:09] Agent model, instructions, analysis workflow, and output format
- [06:29] Configuring and deploying the agent with the AgentCore command-line interface
- [07:21] Local testing and example analysis of suspicious requests
- [10:33] Resolving deployment access errors by granting the agent role CloudWatch Logs read-only access