AWS Bedrock AgentCore Terraform Generator

Turns a short conversation about your agent into a working, modular Terraform repository for Amazon Bedrock AgentCore, not a static template dump, a generation skill that scopes the output to what you actually described.

Why this exists

Most Bedrock IaC templates floating around right now target Bedrock Agents Classic, the service AWS closed to new customers on July 30, 2026. If your AWS account has no prior Bedrock Agents usage, those templates fail before you get anywhere. This skill targets AgentCore, the current path, built against real, confirmed AgentCore Terraform resources, not the deprecated ones.

The other thing most templates get wrong: Resource: "*" on the IAM policy, "for now." This skill doesn't do that. Every IAM statement it generates is scoped to a specific resource ARN, except the two AWS actions that structurally don't support resource-level scoping at all, and those two are named explicitly in the generated code, not hidden in a blanket wildcard.

What it actually does

You describe your agent in a sentence or two. The skill asks a short set of follow-up questions, only the ones that matter for your case, then generates:

• A least-privilege IAM execution role, scoped to exactly the foundation models, S3 buckets, Lambda functions, and vector store your agent needs
• A Knowledge Base + OpenSearch Serverless vector store, if your agent needs retrieval over documents, skipped entirely if it doesn't
• An AgentCore Gateway registering your tools (Lambda actions, Knowledge Base retrieval) behind one authenticated interface
• An AgentCore Runtime deployment, with your choice of the more battle-tested CLI-wrapped path or the newer native Terraform resource
• OpenAPI schemas for your tools, written with model-facing descriptions (the actual driver of whether your agent picks the right tool), not just technical correctness
• A working example composition and a README documenting exactly what was generated and why

Sample interaction

You: "I want an agent that answers questions about order status for my e-commerce store, and looks up tracking info from our shipping API."

Skill asks: Does this need document retrieval (a Knowledge Base for policies/FAQs) or just the two Lambda tools? Which AWS region? Have you requested Bedrock model access there yet? Any of these tools write data, or are they all read-only?

You answer, and it generates: an iam-secure module scoped to your two Lambda ARNs, an agentcore-gateway module registering both as tools with OpenAPI schemas matching your described inputs/outputs, an agentcore-runtime module wired to deploy your agent's container, and a README explaining the Classic-vs-AgentCore distinction, what wasn't validated before delivery, and exactly what to check before your first terraform apply.

Capabilities

• Interactive requirements gathering, doesn't generate a generic pack when a scoped one is what you actually need
• Real, confirmed AgentCore Terraform resources (aws_bedrockagentcore_gateway, aws_bedrockagentcore_agent_runtime, and related), not Classic Agent resources
• Least-privilege IAM by default, every wildcard resource explained, not hidden
• Dependency-graph correctness checked on every generation, this exact class of bug (a circular module dependency) was found and fixed during this skill's own development, and the fix pattern is documented for reuse
• Syntax/formatting validation of generated Terraform before delivery, when a code execution tool is available
• Honest, carried-forward documentation of what's mature (IAM, Knowledge Bases, vector stores) versus genuinely new (AgentCore-native Terraform resources) in AWS's own provider, so you know what to double-check yourself

Use cases

• Standing up a first AgentCore agent without hand-writing IAM policy from scratch
• Replacing an existing Bedrock Agents Classic Terraform setup that needs migrating to AgentCore
• A starting point for a client project, generate once, then customize further by hand
• Learning AgentCore's actual resource model by reading generated, working code with explanatory comments, rather than reverse-engineering it from AWS's docs alone

FAQ

Does this work for Bedrock Agents Classic instead? No, and it will tell you so directly if your request describes Classic's "action groups" model. Classic is closed to new customers; this skill won't generate infrastructure for a service you likely can't provision into.

Do I need to already know Terraform? Basic familiarity helps (running terraform init/plan/apply), but you don't need to know AgentCore's specific resource schema going in, that's what the generated code and comments are for.

Is the output guaranteed to terraform apply cleanly? The generated architecture is checked for HCL syntax and module-dependency correctness before delivery. AgentCore's native Terraform resources are genuinely new; the generated README will tell you exactly which parts to verify against your own pinned provider version before a production apply, rather than overclaiming certainty this skill doesn't have.

What AWS costs should I expect? This skill generates infrastructure definitions, it doesn't estimate your bill. OpenSearch Serverless, Bedrock model invocations, and Lambda all have their own AWS pricing; review the generated resources against AWS's own pricing pages before applying in an account you're billed on.

Can I use this for a client project commercially? Yes, review the included LICENSE.md for the specific terms.