[AWS Bedrock Agentcore] Add support for code_interpreter_application_logs and runtime_logs events

packages/aws_bedrock_agentcore/_dev/build/docs/README.md

@@ -19,6 +19,11 @@ The Amazon Bedrock AgentCore integration collects runtime metrics and observabil
 
 Data streams:
  - `metrics`: Collects Amazon Bedrock AgentCore runtime metrics including invocations, sessions, latency, performance indicators, error rates, throttling metrics, token counts, target execution metrics, and authorization metrics from the following AgentCore components: Agent runtime, Gateway, Memory, Identity, Browser Tool and Code Interpreter.
+ - `runtime_application_logs`: Collects agent runtime application logs (vended `APPLICATION_LOGS`) describing `InvokeAgentRuntime` operations.
+ - `memory_application_logs`: Collects AgentCore Memory application logs (vended `APPLICATION_LOGS`).
+ - `gateway_application_logs`: Collects AgentCore Gateway application logs (vended `APPLICATION_LOGS`).
+ - `code_interpreter_application_logs`: Collects Code Interpreter application logs (vended `APPLICATION_LOGS`) with one record per `InvokeCodeInterpreter` invocation, including the executed code or shell command and its stdout, stderr, and exit code.
+ - `runtime_logs`: Collects agent runtime container logs (stdout/stderr) from the auto-created `/aws/bedrock-agentcore/runtimes/*` CloudWatch log groups, including the service-written audit line for `InvokeAgentRuntimeCommand` shell command executions.
 
 ## What do I need to use this integration?
 
@@ -115,4 +120,18 @@ Amazon Bedrock AgentCore Gateway application logs provide detailed insights into
 For more details about enabling logs for the AgentCore Gateway, see the [Amazon Bedrock AgentCore Observability Guide](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-view.html).
 
 {{event "gateway_application_logs"}}
-{{fields "gateway_application_logs"}}
+{{fields "gateway_application_logs"}}
+
+### Code Interpreter Application Logs
+
+Vended Code Interpreter `APPLICATION_LOGS` (`InvokeCodeInterpreter`). Enable log delivery on custom interpreters in the AgentCore console. See [Configure observability](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-configure.html).
+
+{{event "code_interpreter_application_logs"}}
+{{fields "code_interpreter_application_logs"}}
+
+### Runtime Container Logs
+
+Auto-created runtime container log groups under `/aws/bedrock-agentcore/runtimes/*`. See the [Observability guide](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-view.html).
+
+{{event "runtime_logs"}}
+{{fields "runtime_logs"}}

packages/aws_bedrock_agentcore/changelog.yml

@@ -1,4 +1,12 @@
 # newer versions go on top
+- version: "1.4.0"
+  changes:
+    - description: Add `code_interpreter_application_logs` data stream collecting Code Interpreter vended `APPLICATION_LOGS` (tool invocations with code/command, stdout/stderr and exit code) from CloudWatch Logs or S3.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/22209
+    - description: Add `runtime_logs` data stream collecting agent runtime container logs (stdout/stderr and `InvokeAgentRuntimeCommand` audit lines) from the auto-created `/aws/bedrock-agentcore/runtimes/*` CloudWatch log groups.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/22209
 - version: "1.3.0"
   changes:
     - description: Update Elastic Managed integration documentation to the current wording and docs links.

packages/aws_bedrock_agentcore/data_stream/code_interpreter_application_logs/_dev/deploy/tf/env.yml

@@ -0,0 +1,9 @@
+version: '2.3'
+services:
+  terraform:
+    environment:
+      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
+      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
+      - AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}
+      - AWS_PROFILE=${AWS_PROFILE}
+      - AWS_REGION=${AWS_REGION:-us-east-1}

packages/aws_bedrock_agentcore/data_stream/code_interpreter_application_logs/_dev/deploy/tf/main.tf

@@ -0,0 +1,118 @@
+variable "TEST_RUN_ID" {
+  default = "detached"
+}
+
+terraform {
+  required_providers {
+    aws  = { source = "hashicorp/aws" }
+    null = { source = "hashicorp/null" }
+    time = { source = "hashicorp/time" }
+  }
+}
+
+locals {
+  # Use a neutral prefix for system tests; production delivery uses `/aws/vendedlogs/...`.
+  code_interpreter_log_group  = "/elastic-package/aws_bedrock_agentcore/code-interpreter-${var.TEST_RUN_ID}"
+  code_interpreter_log_stream = "BedrockAgentCoreCodeInterpreter_ApplicationLogs"
+
+  code_interpreter_lines = [
+    for line in split("\n", file("${path.module}/files/code-interpreter-sample.log")) : replace(
+      line,
+      "111122223333",
+      data.aws_caller_identity.current.account_id
+    )
+    if trimspace(line) != ""
+  ]
+}
+
+provider "aws" {
+  default_tags {
+    tags = {
+      environment  = var.ENVIRONMENT
+      repo         = var.REPO
+      branch       = var.BRANCH
+      build        = var.BUILD_ID
+      created_date = var.CREATED_DATE
+
+      division = "engineering"
+      org      = "obs"
+      team     = "obs-signals-integrations-team"
+      project  = "integrations-aws_bedrock_agentcore-package"
+    }
+  }
+}
+
+data "aws_caller_identity" "current" {}
+
+resource "aws_cloudwatch_log_group" "code_interpreter" {
+  name              = local.code_interpreter_log_group
+  retention_in_days = 1
+}
+
+resource "aws_cloudwatch_log_stream" "code_interpreter" {
+  name           = local.code_interpreter_log_stream
+  log_group_name = aws_cloudwatch_log_group.code_interpreter.name
+
+  depends_on = [aws_cloudwatch_log_group.code_interpreter]
+}
+
+resource "time_static" "push_time" {
+  triggers = {
+    run_id    = var.TEST_RUN_ID
+    logs_hash = filemd5("${path.module}/files/code-interpreter-sample.log")
+  }
+}
+
+resource "null_resource" "push_code_interpreter_logs" {
+  depends_on = [aws_cloudwatch_log_stream.code_interpreter]
+
+  triggers = {
+    run_id    = var.TEST_RUN_ID
+    logs_hash = filemd5("${path.module}/files/code-interpreter-sample.log")
+  }
+
+  provisioner "local-exec" {
+    command     = <<-EOT
+    set -e
+
+    unset AWS_PROFILE
+
+    if ! command -v aws >/dev/null 2>&1; then
+      apt-get update -qq
+      apt-get install -y -qq curl unzip > /dev/null 2>&1
+
+      curl -sS "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "/tmp/awscliv2.zip"
+      unzip -q -o /tmp/awscliv2.zip -d /tmp
+      /tmp/aws/install 2>/dev/null || /tmp/aws/install --update
+    fi
+
+    aws logs put-log-events \
+        --region "$AWS_REGION" \
+        --log-group-name "$LOG_GROUP_NAME" \
+        --log-stream-name "$LOG_STREAM_NAME" \
+        --log-events "$LOG_EVENTS"
+    EOT
+    interpreter = ["/bin/sh", "-c"]
+
+    environment = {
+      LOG_GROUP_NAME  = aws_cloudwatch_log_group.code_interpreter.name
+      LOG_STREAM_NAME = aws_cloudwatch_log_stream.code_interpreter.name
+      LOG_EVENTS = jsonencode([
+        for index, line in local.code_interpreter_lines : {
+          timestamp = (time_static.push_time.unix + index) * 1000
+          message   = line
+        }
+      ])
+    }
+  }
+}
+
+data "aws_region" "current" {}
+
+output "code_interpreter_log_group_arn" {
+  value = aws_cloudwatch_log_group.code_interpreter.arn
+}
+
+output "region_name" {
+  value = data.aws_region.current.region
+}

packages/aws_bedrock_agentcore/data_stream/code_interpreter_application_logs/_dev/deploy/tf/variables.tf

@@ -0,0 +1,22 @@
+variable "BRANCH" {
+  description = "Branch name or pull request for tagging purposes"
+  default     = "unknown-branch"
+}
+
+variable "BUILD_ID" {
+  description = "Build ID in the CI for tagging purposes"
+  default     = "unknown-build"
+}
+
+variable "CREATED_DATE" {
+  description = "Creation date in epoch time for tagging purposes"
+  default     = "unknown-date"
+}
+
+variable "ENVIRONMENT" {
+  default = "unknown-environment"
+}
+
+variable "REPO" {
+  default = "unknown-repo-name"
+}