This is the first practical article in the “GenAI and AI agents on AWS” series, and we start with the account setup.
Quick definition so we're on the same page: an agent is an LLM in a while loop. It picks an action, calls a tool, looks at what came back, picks the next one. It stops when it thinks it's done, or when you stop it, which is where the budget alarm comes in.
The model never runs anything itself. It reads text and writes text, your code does the rest.
We're building agents on AWS. Amazon Bedrock gives us the models, Strands Agents is what we write the agent in, Amazon Bedrock AgentCore runs the result in the cloud. Every trip around that loop is a paid request, so the account comes first. Four things before any code: an IAM user, a budget alarm, the local tools, and a login from the terminal without access keys.
IAM user, not root
Root owns everything, billing and closing the account included. Keep it for those rare jobs. Day to day you want an IAM user, and some services refuse root anyway: you can't create a Bedrock Knowledge Base with it.
Create the user: IAM → Users → Create user. I called mine ai-series, call yours whatever. Tick console access and set your own password. One checkbox to untick: "User must create a new password at next sign-in". It's your user, you just typed the password, forcing a change straight away is pointless.
Permissions: attach policies directly, and you need two. AdministratorAccess (fine for learning, in a real company you'd give far less) and SignInLocalDevelopmentAccess, the one that lets the CLI log in through the browser. That second one is why we won't need access keys later.
After you click create you get a page with a console sign-in link for your account. Copy it. It has your account ID in it, so keep it out of screenshots. Sign out of root and open that link. The console says Europe (Stockholm) for me. Ignore it, IAM users are global. We'll switch to us-east-1 when we build.
Budget alarm
AI services charge per request, so a loop gone wrong can cost real money. Type "budgets" in the console search, it takes you to Billing and Cost Management. Budgets → Create budget, keep "Use a template", pick Monthly cost budget. Keep the name. The amount defaults to $100, I changed it to $35. Pick whatever you're comfortable spending in a month, then add your email.
The template sends an alert when actual spend reaches 85% of the budget, again at 100%, and when the forecast says you're going to cross the line. Click Create budget and that's it.
Local tools
Everything here runs inside the project folder.
uv first. It's a fast Python package manager and the AgentCore tool needs it. On a Mac, brew install uv.
Then a virtual environment, so the project's packages stay separate from the rest of your machine, and the requirements:
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
If you see (.venv) at the start of the line, it's on. The requirements bring in boto3, the AWS library for Python, and Strands. The download takes about 20 seconds.
Next the AgentCore CLI. It comes from npm, and I install it into a local tools folder inside the project. This one takes a couple of minutes. Add that folder to PATH and check the version: 0.31 for me. The first run prints a note about usage telemetry. The tool sends anonymous stats to AWS, meaning which commands you run and whether they work. Not your code, not your data. It's on by default and I turn it off.
Last, the AWS CLI. Mine is 2.34 (aws --version), anything from 2.32 works with aws login.
Sign in from the terminal
The old way is access keys: a secret saved in a file on your laptop. It never expires and it leaks surprisingly often. The new way is aws login. The terminal opens the browser, you sign in to the console, and the CLI gets temporary credentials that refresh on their own for up to 12 hours. Nothing secret to copy or lose.
aws login --profile ai-series
The browser opens by itself and AWS asks which console session to share with the command line. Pick the active ai-series one. Back in the terminal, make that profile the default and set the region:
export AWS_PROFILE=ai-series
aws configure set region us-east-1
aws configure get region
The last command should print us-east-1. Done. Not a single key on this laptop.
I’ve practically demonstrated how to do this in my video
Source code for all hands-on episodes: GitHub repository
I’ll be sharing plenty of hands-on videos about AWS, AI and deployment on my YouTube channel, @CodeAiFlow every week. This article follows the first episode of the series, if you'd rather watch the setup step by step. I'm also an AWS Community Builder: my profile on AWS Builder Center.
Top comments (0)