Quotas for Amazon Bedrock AgentCore
Your AWS account has default quotas, formerly referred to as limits, for each AWS service. Unless otherwise noted, each quota is Region-specific. You can request increases for some quotas, and other quotas cannot be increased.
To request a quota increase, contact AWS support.
Topics
AgentCore harness Service Quotas
AgentCore harness is a logical resource. Each harness you create is backed by a managed AgentCore Runtime that AgentCore provisions and operates on your behalf. Therefore, harness invocations are bound by the same service quotas that apply to AgentCore Runtime. These quotas include resource allocation, invocation, throttling, lifecycle, and session storage limits. For all applicable quotas, see AgentCore Runtime Service Quotas.
For configurable per-invocation controls (such as iteration, timeout, and token caps), see Control cost with limits.
AgentCore Runtime Service Quotas
When working with AgentCore Runtime, you need to be aware of the service limits that apply to your account. These limits help ensure service stability and availability for all users.
Resource allocation limits
The following table describes the resource allocation limits for AgentCore Runtime. You can request increases for some quotas using the Service Quotas console.
| Limit | Default Value | Adjustable | Notes |
|---|---|---|---|
|
Active session workloads per account |
5,000 in US East (N. Virginia) and US West (Oregon), and 2,500 in other AWS Regions. |
Yes |
Can be increased via Service Quotas |
|
Total agents per account |
1,000 |
Yes |
Can be increased via Service Quotas |
|
Versions per agent |
1,000 |
Yes |
Can be increased via Service Quotas |
|
Endpoints (aliases) per agent |
10 |
Yes |
Can be increased via Service Quotas |
|
Maximum size for a Docker image in an AgentCore Runtime |
2 GB |
No |
|
|
Maximum size for a direct code deployment package (compressed) |
250 MB |
No |
ZIP file size limit for direct code deployment |
|
Maximum size for a direct code deployment package (uncompressed) |
750 MB |
No |
Unzipped package size limit for direct code deployment |
|
Maximum hardware allocation per session |
2vCPU/8GB |
No |
The maximum memory/CPU usage and allocation per Runtime session |
|
Capacity providers per account |
1,000 |
No |
Applies to the Instances compute type in your account. Counts all capacity providers that you have not deleted, including those being created or deleted. |
|
Agents per capacity provider session |
20 |
No |
Applies to the Instances compute type. The maximum number of agents that you can run on a single capacity provider session. |
For more information about service quotas and how to request increases, see Requesting a quota increase in the Service Quotas User Guide.
Note
Because the Instances compute type provisions Amazon EC2 resources in your own account, your account’s quotas for those resources apply in addition to the AgentCore quotas in the preceding table. AgentCore calls the following services on your behalf to provision and manage instances, which consumes your account’s quotas. For high-throughput workloads, you might need to request increases for the following:
-
Amazon EC2 – the running instance count for the instance families you select, and the request rates for the instance operations that AgentCore calls, such as
RunInstances,CreateFleet,DescribeInstances,TerminateInstances, andCreateTags. For more information, see Amazon EC2 service quotas. -
Amazon EBS – the volume quotas for the volume types you use, and the request rates for the volume operations that AgentCore calls, such as
CreateVolume,AttachVolume,DetachVolume,DeleteVolume, andDescribeVolumes. For more information, see Quotas for Amazon EBS. -
Amazon VPC – the number of network interfaces, and the request rates for the network interface operations that AgentCore calls, such as
AttachNetworkInterfaceandDescribeNetworkInterfaces. For more information, see Amazon VPC quotas. -
Amazon EC2 Auto Scaling – a single shared quota that applies to all Amazon EC2 Auto Scaling API calls, rather than to an individual operation. This quota isn’t available in the Service Quotas console. To request an increase, open an AWS Support case. For more information, see Request throttling for the Amazon EC2 Auto Scaling API.
To request an increase for a quota that is available in the Service Quotas console, see Requesting a quota increase in the Service Quotas User Guide.
Invocation limits
The following table describes the invocation limits for AgentCore Runtime. You can request increases for some quotas using the Service Quotas console.
| Limit | Value | Adjustable | Notes |
|---|---|---|---|
|
Request timeout |
15 minutes |
No |
Maximum time for synchronous requests |
|
Maximum payload size |
100 MB |
No |
Maximum size for request/response payloads |
|
Streaming chunk size |
10 MB |
No |
Maximum size for individual chunks |
|
Streaming maximum duration |
60 mins |
No |
Maximum time for streaming connections (Response streaming, WebSocket connections) |
|
Asynchronous job maximum duration |
8 hours |
No |
Maximum execution time for asynchronous jobs |
|
WebSocket frame size |
64 KB |
No |
Maximum size for individual WebSocket frames |
For more information about service quotas and how to request increases, see Requesting a quota increase in the Service Quotas User Guide.
Throttling limits
The following table describes the rate limits for AgentCore Runtime after which you will be throttled. You can request increases for some quotas using the Service Quotas console.
| Limit | Value | Adjustable | Notes |
|---|---|---|---|
|
Data plane API request rate |
1,000 TPS |
Yes |
Transactions per second per account. This quota is shared across all data plane APIs and is not enforced for each API individually. It applies to the following APIs: |
|
New Runtime session creation rate |
25 TPS |
Yes |
Transactions per second per account. This quota is shared across all endpoints and is not enforced for each endpoint individually. It applies to new session creation for both container-image and direct code deployment agents. |
|
WebSocket frame rate per connection |
250 frames per second |
No |
|
|
Control plane mutation API rate |
50 TPS |
No |
Transactions per second per account. This quota is shared across all control plane mutation APIs and is not enforced for each API individually. It applies to |
|
Control plane Get API rate |
150 TPS |
No |
Transactions per second per account. This quota is shared across all control plane Get APIs and is not enforced for each API individually. It applies to |
|
Control plane List API rate |
25 TPS |
No |
Transactions per second per account. This quota is shared across all control plane List APIs and is not enforced for each API individually. It applies to |
For more information about service quotas and how to request increases, see Requesting a quota increase in the Service Quotas User Guide.
Lifetime session lifecycle parameters
The following table describes the lifetime session lifecycle parameters for AgentCore Runtime:
| Phase | Timeout | Adjustable | Notes |
|---|---|---|---|
|
Idle session timeout |
15 minutes of inactivity |
Yes, through the |
When this limit is reached, the execution environment is terminated and a new one is created for the session |
|
Maximum session duration |
8 hrs |
Yes, through the |
Session storage limits
The following table describes the limits for session storage:
| Limit | Value | Adjustable | Description |
|---|---|---|---|
|
Maximum storage size |
1 GB |
No |
Maximum total storage size per session |
|
Maximum filesystem metadata |
~50 MB |
No |
Approximately 100,000–200,000 files |
|
Maximum directory depth |
200 levels |
No |
Maximum nested directory depth |
|
Maximum filename length |
255 bytes |
No |
Maximum length of a single filename |
|
Maximum symlink target length |
4,095 bytes |
No |
Maximum length of a symlink target path |
AgentCore Memory Service Quotas
The following table describes the lifetime session lifecycle parameters for AgentCore Memory:
| Limit | Value | Adjustable | Notes |
|---|---|---|---|
|
Maximum number of AgentCore Memory resources per AWS Region in an AWS account |
150 |
Yes |
|
|
Maximum number of memory strategies per AgentCore Memory resource |
6 |
No |
|
|
Maximum memory strategies per account |
900 |
Yes |
|
|
Maximum CreateMemory requests |
3 |
Yes |
The maximum number of |
|
Maximum GetMemory requests |
50 |
Yes |
The maximum number of |
|
Maximum DeleteMemory requests |
3 |
Yes |
The maximum number of |
|
Maximum ListMemories requests |
5 |
Yes |
The maximum number of |
|
Maximum UpdateMemory requests |
3 |
Yes |
The maximum number of |
|
Minimum EventExpirationDuration days in a CreateEvent operation |
7 |
No |
|
|
Maximum EventExpirationDuration days in a CreateEvent operation |
365 |
No |
|
|
Maximum prompt size (AppendToPrompt) for custom memory strategy (Extraction/Consolidation) |
30 KB |
No |
|
|
Maximum number of messages per CreateEvent operation |
100 |
No |
|
|
Maximum message size in a CreateEvent operation |
100 KB |
No |
|
|
Maximum event size in a CreateEvent operation |
10 MB |
No |
|
|
Maximum number of payload items in an IngestData operation |
100 |
No |
|
|
Maximum payload item size in an IngestData operation |
100 KB |
No |
|
|
Maximum total payload size per IngestData request |
100 KB |
No |
The combined size of all payload items. |
|
Maximum CreateEvent requests |
200 |
Yes |
The maximum number of |
|
Maximum CreateEvent requests per actor, per session, including conversational payloads |
5 |
No |
The maximum number of |
|
Maximum CreateEvent requests per actor, per session, not including conversational payloads |
10 |
No |
The maximum number of |
|
Maximum IngestData requests |
10 |
No |
The maximum number of |
|
Maximum IngestData requests per actor, per session, including conversational payloads |
5 |
No |
The maximum number of |
|
Maximum IngestData requests per actor, per session, not including conversational payloads |
10 |
No |
The maximum number of |
|
Maximum DeleteEvent requests |
20 |
Yes |
The maximum number of |
|
Maximum DeleteEvent requests per actor, per session |
5 |
Yes |
The maximum number of |
|
Maximum ListEvents requests |
200 |
Yes |
The maximum number of |
|
Maximum ListEvents requests per actor, per session |
20 |
No |
The maximum number of |
|
Maximum RetrieveMemoryRecords requests |
30 |
Yes |
The maximum number of |
|
Maximum ListMemoryRecords requests |
30 |
Yes |
The maximum number of |
|
Maximum requests for all other AgentCore Memory APIs |
20 |
Yes |
The maximum transactions per second (TPS) that can be processed in this AWS account in the current AWS Region for all other AgentCore Memory APIs. |
|
Maximum number of tokens per minute for long-term memory extraction |
150,000 |
Yes |
The maximum number of tokens per minute that can be processed for long-term memory extraction for built-in strategies in this AWS account in the current AWS Region. You can monitor token use through the Amazon CloudWatch metric named |
|
Maximum number of tokens per minute for episodic long-term memory extraction per session |
50,000 |
No |
The per-session, tokens per minute limit that can be processed for episodic long-term memory extraction in this AWS account in the current AWS Region. |
AgentCore Identity Service Quotas
When working with AgentCore Identity, you need to be aware of the service limits that apply to your account. These limits help ensure service stability and availability for all users.
Resource limits
The following table describes the resource limits for AgentCore Identity. You can request increases for some quotas using the Service Quotas console.
| Limit | Default Value | Adjustable | Notes |
|---|---|---|---|
|
Workload identities |
11,000 |
Yes |
The maximum number of workload identities that you can create in this account in the current Region. |
|
Resource OAuth2 credential providers |
50 |
Yes |
The maximum number of OAuth2 credential providers for egress resources that you can create in this account in the current Region. |
|
Resource API key credential providers |
50 |
Yes |
The maximum number of API key credential providers for egress resources that you can create in this account in the current Region. |
|
Resource Payment credential providers |
50 |
Yes |
The maximum number of payment credential providers for egress resources that you can create in this account in the current Region. |
Throttling limits
The following table describes the rate limits for AgentCore Identity APIs after which you will be throttled. You can request increases for some quotas using the Service Quotas console.
| Limit | Value | Adjustable | Notes |
|---|---|---|---|
|
CreateWorkloadIdentity API rate |
20 TPS |
Yes |
Transactions per second per account |
|
GetWorkloadIdentity API rate |
20 TPS |
Yes |
Transactions per second per account |
|
UpdateWorkloadIdentity API rate |
20 TPS |
Yes |
Transactions per second per account |
|
DeleteWorkloadIdentity API rate |
20 TPS |
Yes |
Transactions per second per account |
|
ListWorkloadIdentities API rate |
20 TPS |
Yes |
Transactions per second per account |
|
GetWorkloadAccessToken API rate |
200 TPS |
Yes |
Transactions per second per account |
|
GetWorkloadAccessTokenForJWT API rate |
200 TPS |
Yes |
Transactions per second per account |
|
GetWorkloadAccessTokenForUserId API rate |
200 TPS |
Yes |
Transactions per second per account |
|
CreateOauth2CredentialProvider API rate |
20 TPS |
Yes |
Transactions per second per account |
|
GetOauth2CredentialProvider API rate |
20 TPS |
Yes |
Transactions per second per account |
|
UpdateOauth2CredentialProvider API rate |
20 TPS |
Yes |
Transactions per second per account |
|
DeleteOauth2CredentialProvider API rate |
20 TPS |
Yes |
Transactions per second per account |
|
ListOauth2CredentialProviders API rate |
20 TPS |
Yes |
Transactions per second per account |
|
CreateApiKeyCredentialProvider API rate |
20 TPS |
Yes |
Transactions per second per account |
|
GetApiKeyCredentialProvider API rate |
20 TPS |
Yes |
Transactions per second per account |
|
UpdateApiKeyCredentialProvider API rate |
20 TPS |
Yes |
Transactions per second per account |
|
DeleteApiKeyCredentialProvider API rate |
20 TPS |
Yes |
Transactions per second per account |
|
ListApiKeyCredentialProviders API rate |
20 TPS |
Yes |
Transactions per second per account |
|
CreatePaymentCredentialProvider API rate |
20 TPS |
Yes |
Transactions per second per account |
|
GetPaymentCredentialProvider API rate |
20 TPS |
Yes |
Transactions per second per account |
|
UpdatePaymentCredentialProvider API rate |
20 TPS |
Yes |
Transactions per second per account |
|
DeletePaymentCredentialProvider API rate |
20 TPS |
Yes |
Transactions per second per account |
|
ListPaymentCredentialProviders API rate |
20 TPS |
Yes |
Transactions per second per account |
|
GetResourceOauth2Token API rate |
200 TPS |
Yes |
Transactions per second per account |
|
GetResourceApiKey API rate |
200 TPS |
Yes |
Transactions per second per account |
|
GetResourcePaymentToken API rate |
200 TPS |
Yes |
Transactions per second per account |
|
CompleteResourceTokenAuth API rate |
100 TPS |
Yes |
Transactions per second per account |
For more information about service quotas and how to request increases, see Requesting a quota increase in the Service Quotas User Guide.
AgentCore Gateway Service Quotas
This section provides information about Amazon Bedrock AgentCore Gateway endpoints and service limits.
Endpoints
Amazon Bedrock AgentCore Gateway provides AWS Region-specific endpoints for management operations and runtime access.
The Amazon Bedrock AgentCore Gateway control plane endpoints use the following format, where you can replace <region> with any of the AWS Regions listed in Supported AWS Regions.
bedrock-agentcore-control.<region>.amazonaws.com
The AgentCore Gateway URLs for runtime access have the following format:
https://{gateway-Id}.gateway.bedrock-agentcore.{Region}.amazonaws.com
Where:
-
{gateway-Id} is the unique identifier for your gateway
-
{Region} is the AWS Region where your gateway is deployed
Gateway ARNs have the following format:
arn:${Partition}:bedrock-agentcore:${Region}:${Account}:gateway/${gateway-Id}
The AgentCore service principal is: bedrock-agentcore.amazonaws.com
Service quotas
Amazon Bedrock AgentCore Gateway has the following service quotas. You can request increases for some quotas using the Service Quotas console.
| Quota | Default value | Adjustable |
|---|---|---|
|
Number of gateways per account |
1000 |
Yes |
|
Number of targets per gateway |
100 |
Yes |
|
Number of tools per target |
1000 |
Yes |
|
Timeout for a gateway invocation |
15 minutes |
Yes |
|
Maximum inline schema size |
1 MB |
Yes |
|
Maximum S3 payload schema size |
10 MB |
Yes |
|
Tool name character limit |
256 characters |
Yes |
|
CreateGateway API rate |
5 transactions per second |
Yes |
|
UpdateGateway API rate |
5 transactions per second |
Yes |
|
GetGateway API rate |
10 transactions per second |
Yes |
|
ListGateways API rate |
10 transactions per second |
Yes |
|
DeleteGateway API rate |
5 transactions per second |
Yes |
|
CreateGatewayTarget API rate |
5 transactions per second |
Yes |
|
UpdateGatewayTarget API rate |
5 transactions per second |
Yes |
|
GetGatewayTarget API rate |
10 transactions per second |
Yes |
|
ListGatewayTargets API rate |
10 transactions per second |
Yes |
|
DeleteGatewayTarget API rate |
5 transactions per second |
Yes |
|
Concurrent target operations (total of Create/Update/DeleteTarget) on same gateway |
5 |
Yes |
|
tool-call/tool-list rate at gateway level |
200 transactions per second |
Yes |
|
tool-call/tool-list rate at account level |
200 transactions per second |
Yes |
|
tool-call/tool-list concurrent connections at gateway level |
5000 concurrent connections |
Yes |
|
tool-call/tool-list concurrent connections at account level |
5000 concurrent connections |
Yes |
|
Search-based tool-call rate |
25 transactions per minute |
Yes |
|
Maximum tool-call/tool-list/tool-search payload size |
6 MB |
Yes |
|
Rate of Web Search Tool requests |
10 transactions per second |
Yes |
For more information about service quotas and how to request increases, see Requesting a quota increase in the Service Quotas User Guide.