We must have the following ready before we jump into the hands-on examples of this chapter:

• A code editor installed on your local machine (such as Visual Studio Code or Sublime Text): You'll need this when working with the code and configuration files used throughout the hands-on exercises and examples in this book.
• A new AWS account: Creating and using a new AWS account is highly recommended for the hands-on exercises and solutions in this book. This will ensure that your work-related production (or staging) environment resources remain separate and secure. Feel free to create this AWS account by going to https://aws.amazon.com/free/. On this page, locate and click on the Create an AWS Account button to proceed with the creation of the account. Make sure to read the available AWS documentation along with the relevant FAQ pages to have a better awareness of what is free (and what is not free) when using various services in AWS.

Confirm that your currently selected AWS Region is set to the region you want to use for the examples in this chapter. You can change the region at any time by using the region selector in the upper-right corner of the AWS Management Console and choosing the appropriate region (for example, N. Virginia | us‑east‑1) from the dropdown list. While you have many regions to choose from, us-east-1 is a good starting choice for most examples and exercises.

Over the past few years, generative AI has advanced significantly. Today, you can generate highly realistic images and text in seconds, extract information from documents, automate content moderation, generate code, and even reason through complex problems across different domains. For the modern machine learning engineer (ML engineer), a solid understanding of generative AI is no longer optional. In this section, we'll introduce the key concepts and terminology used throughout this book.

Let's start with foundation models. Foundation models are large-scale machine learning models trained on massive and diverse datasets, often sourced from multiple domains and internet-scale data. They serve as a versatile starting point for building AI applications without the need to train models from scratch, which can require millions of dollars in compute and data resources. Many foundation models can follow natural language instructions to perform a wide range of tasks, including text generation, summarization, and image creation. Examples of foundation models include GPT, Claude, Stable Diffusion, and earlier models such as BERT.

A key reason foundation models are transformative is that they enable zero-shot and few-shot learning, where models can perform tasks with little or no task-specific training. This represents a major shift from traditional machine learning workflows, which typically require large labeled datasets and training for each new task. As a result, foundation models significantly reduce the effort required to build new AI capabilities and accelerate the development of applications across domains.

Large language models (LLMs) are a subset of foundation models trained on large-scale text data and adapted for language-related tasks such as text generation, question answering, translation, and summarization. Continuing the game engine analogy from the start of this chapter, LLMs can be thought of as specialized components within the engine that handle textual content, such as dialog, narratives, and character interactions, by interpreting input and generating meaningful outputs that drive the story forward.

Prompt is an input given to a foundation model, notably LLMs, intended to generate a specific response or output from the model. An example of a prompt would be:

Summarize the first chapter of the book "Building and Automating Penetration Testing Labs in the Cloud".

Note that these prompts may vary from simple questions to complex instructions that guide the model to produce or generate the desired response. Modern LLMs often distinguish between different levels of prompts. In addition to the user prompt, there is typically a system prompt that defines the model's behavior, tone, and constraints before any user input is processed. This layered structure helps guide the model's responses more reliably and is commonly used in production applications to enforce safety, consistency, and task-specific behavior.

Using an image generator model, prompts can also be used to generate an image similar to what we have in Figure 1.1:

Figure 1.1 — An AI-generated image of a cat reading a book

By using the prompt "cat reading a book", an image generator model can automatically generate a somewhat realistic image of a cat reading a book. If you are a dog lover, you may try using the prompt "dog reading a book" instead!

When a model reads a user's input prompt, it breaks the text down into smaller units called tokens. For example, the tokenized version of the prompt "Describe a world where gravity does not exist." may be composed of around 9 tokens, depending on the tokenizer used by the model. These tokens may include words and punctuation such as "Describe", "a", "world", "where", "gravity", "does", "not", "exist", and ".".

It's time we take a closer look at prompt engineering. Prompt engineering is the practice of carefully designing and refining prompts to guide a model toward generating accurate, relevant, and contextually appropriate responses. For example, when using Claude, a foundation model, prompts are often structured in a conversational format that clearly distinguishes between the user and the model, such as:

Human: Summarize the first chapter of the book "Building and Automating Penetration Testing Labs in the Cloud"
Assistant: 

Such a prompt can help guide the model more effectively toward the intended output. Keep in mind that prompt engineering goes beyond formatting alone. It also involves selecting the right level of detail, providing appropriate context, and adapting the prompt based on the capabilities and limitations of the model being used.

When generating responses, models expose parameters that influence how outputs are produced. For example, settings such as temperature, top-p, and maximum token length control the randomness, diversity, and length of the generated response. These parameters allow developers to fine-tune model behavior depending on whether the use case requires deterministic outputs, creative generation, or concise answers.

Beyond generating text and images, foundation models serve as the core building blocks for more advanced AI applications. By combining prompting techniques, external data sources, and orchestration logic, developers can build systems such as RAG pipelines and AI agents. These systems extend the capabilities of standalone models by enabling them to interact with external knowledge and tools, making them more useful in real-world applications.

Now that we've covered the core concepts, it's time to take a closer look at machine learning engineering. Machine learning engineering involves applying both machine learning and software engineering principles to design, build, and manage production-level ML systems and pipelines. In teams building ML-powered applications, ML engineers are generally responsible for developing and operating the infrastructure used to train, deploy, and monitor models. With the rapid evolution of AI, their role increasingly includes supporting the fine-tuning, orchestration, and integration of LLMs and other models for generative AI applications, while still ensuring ML systems remain robust, scalable, and reliable. In practice, this often involves using services such as SageMaker AI to train, deploy, and manage models at scale.

For generative AI projects to succeed, an ML engineer needs to think not only about the performance of the deployed model, but also about the stability, scalability, security, cost-effectiveness, and maintainability of the ML infrastructure, along with monitoring, reliability, and compliance. There is definitely a lot more to consider, and you'll explore these topics in greater depth throughout the book, including how they are implemented using different AWS services for building and operating ML systems at scale. To keep things focused in this introductory chapter, we will use Amazon Bedrock, a managed service that abstracts much of the complexity involved in building generative AI applications. As we progress through the chapters, we'll also work with SageMaker AI to explore more advanced use cases and gain hands-on experience with deploying and managing models.

Amazon Bedrock is a fully managed service that allows you to access, customize, and integrate a wide range of AI models. It simplifies the process of building AI-powered applications and agents by providing seamless access to foundation models and their capabilities, while abstracting much of the underlying infrastructure management. With Bedrock, you can focus on building and delivering your application without worrying about provisioning, scaling, or maintaining the infrastructure. Instead of spending weeks or months developing AI-powered solutions from scratch, you can potentially build production-ready applications in just days or even hours. This significantly accelerates your development cycle and helps you deliver value much faster.

In this section, we will walk through the steps to access and interact with foundation models in Bedrock through the Amazon Bedrock console. More specifically, we'll locate and select Nova 2 Lite from the Model catalog, open it in the Chat/Text playground, and submit a few prompts to see how it responds.

Let's go over a few essential services, terms, and concepts that are relevant to this section:

• Model catalog — A collection of pre-built AI models that users can choose from for various applications, some of which may offer customization options like fine-tuning for specific use cases. Here, you can explore available foundation models and quickly test them in the playground.
• Amazon Bedrock Marketplace — A capability in Amazon Bedrock where users can access and subscribe to AI models from different providers, which allows them to easily deploy and integrate these models into their applications using Bedrock's unified APIs.
• Modality — The type of data input or output processed by an AI model, such as text, images, audio, or video. Different models support different modalities, so you'll need to choose one that aligns with your use case. Some models are multimodal, meaning they can handle multiple types of data (for example, combining text and images) within a single interaction, though their supported inputs and outputs may vary.

Having a clear understanding of these concepts, services, and capabilities will make it easier for you to evaluate model capabilities and choose the right model for your specific application requirements.

Let's proceed with exploring foundation models in Amazon Bedrock:

1. Navigate to the Amazon Bedrock console using the search bar, as shown in Figure 1.2:

   

   Figure 1.2 — Navigating to the Bedrock console

   After typing bedrock in the search bar, select the Amazon Bedrock service from the list of search results.

2. Next, navigate to the region of choice (us-east-1) using the region dropdown in the menu bar. In this chapter, we will create and manage our resources in the US East (N. Virginia) | us-east-1 region. Make sure to change this to where you want the resources to be created.
3. If the navigation pane (left sidebar) is collapsed, expand it by clicking the hamburger icon (☰) in the top-left corner.
4. In the navigation pane (left sidebar), click Model catalog under Discover.

   

   Figure 1.3 — Model catalog

   This opens a page displaying the available Amazon Bedrock Serverless and Marketplace models.

5. In the Filters panel, locate Providers and select Amazon to filter the models to only those provided by Amazon. Choose Nova 2 Lite from the list of available models.
6. Click Open in Playground. You will be redirected to the Chat/Text Playground page, where you can interact with the model.

   

   Figure 1.4 — Chat / Text playground

   Here, you can test different prompts and see how a model responds to various types of input. You should find a text area where you can enter your prompts, along with a Run button to send them to the model.

7. In the Chat/Text Playground's text area, enter the following prompt:

   Why are there so many different AI models?
   Explain in simple terms, with a few clear examples.

8. Click Run to submit the prompt and generate the model's response.

   

   Figure 1.5 — Model's response

   Since we asked the model to provide a clear, simple explanation with examples, it responds by explaining that different AI models are designed to tackle different types of problems. For instance, some models excel at processing text, while others are better suited for images or tabular data. Each model is optimized to handle specific types of data, such as natural language, visual information, or sound, making them more effective for their respective tasks.

9. In the text area of the Chat/Text Playground, specify the following prompt:

   Expand on the previous answer by providing specific examples and use cases for each model mentioned.

10. Click Run to submit the prompt and generate the model's response.

    

    Figure 1.6 — Model's response

    The model expands on the previous answer by highlighting real-world use cases for each type of AI model. For example, facial recognition models are used for unlocking your phone with Face ID, while natural language processing models power chatbots for customer service. Translation models are essential for language translation tools, and spam detection models help filter out unwanted emails. Additionally, machine learning models are widely used in credit scoring systems to assess loan eligibility based on financial data.

After exploring Amazon Bedrock and using the playground, you can see how this managed service accelerates generative AI development by offering seamless access to powerful models and simplifying experimentation. In addition to providing access to a wide range of foundation models, Amazon Bedrock offers capabilities that support model customization, agent development, and the use of guardrails to ensure safe and responsible AI usage.

Keep in mind that Amazon Bedrock is just one of the many AWS services that allow us to work on AI requirements. The ability of engineers to design, build, and manage AI-powered systems improves as these professionals become more familiar with the services and solutions available in the AWS platform. They may start with AI services that abstract the machine learning engineering work to quickly build AI-powered applications on AWS. Over time, these engineers will make use of the different services, tools, and solutions available on AWS as they become more comfortable dealing with intermediate machine learning engineering requirements. We will cover these in the succeeding chapters of this book!

One way to run the examples in this chapter is to set up your local machine, though it requires careful configuration to ensure all notebooks and scripts run correctly. This can work if you have the time and the right hardware, but it often means juggling software versions, installing dependencies, and managing storage. Imagine skipping all that setup and diving straight into exploring and experimenting with various machine learning models. AWS gives you a variety of options for creating cloud-based workspaces specifically designed for AI and ML engineering. One of the easiest and most convenient options is Amazon SageMaker Studio, a fully managed environment that provides everything you need to run code, launch notebooks, and experiment with ML models right away.

In this section, you'll set up and configure your Amazon SageMaker Studio environment which you will use to work on the examples and exercises in the following sections. You will create a SageMaker domain, launch SageMaker Studio, and configure a space with the compute and storage resources necessary to run the notebooks and scripts used throughout this chapter. By the end of this section, you will have a fully functional environment that you can start and stop as needed, while also gaining a better understanding of the key capabilities and concepts introduced along the way.

Before you begin setting up the environment, let's define and discuss a few key services, terms, and concepts relevant to what you'll work with in this section:

• Amazon SageMaker AI — A fully managed service that provides a comprehensive set of capabilities to build, train, deploy, and monitor machine learning models at scale. It offers a variety of tools, including interactive notebooks, pre-built algorithms, and managed environments for training, data processing, and inference. With SageMaker AI, you can prepare and process data, experiment with different models, deploy them, and monitor their performance, all without needing to provision or maintain the underlying compute and storage infrastructure required for ML workflows. By using various capabilities of SageMaker AI, you're able to focus more on model development, data processing, evaluation, and deployment, which significantly shortens the time required to get models into production.

  At this point, you might be wondering what some of the capabilities of SageMaker AI are. You can choose which capabilities to use based on your specific use case and workflow. For example, you can use SageMaker Processing for large-scale data preprocessing and transformation, SageMaker Training jobs for training machine learning models, and SageMaker HyperPod to provision resilient clusters for running ML workloads. In addition, you can use features such as SageMaker Pipelines for workflow orchestration, SageMaker Experiments for tracking and managing experiments, and SageMaker Model Monitor for monitoring model performance in production. These are just a few examples, as SageMaker AI offers many more features and capabilities that you can use depending on your needs. You can also use these SageMaker features alongside other AWS services to build end-to-end ML solutions.

• Amazon Virtual Private Cloud — A service that allows you to create and configure a private, isolated network in the AWS cloud where you can launch and manage resources. You have full control over networking configurations, including IP address ranges, subnets, and route tables, giving you the flexibility to run your applications and resources in a secure, scalable, and fully private environment. Inside a VPC, you can have public subnets, which allow resources to communicate with the internet, and private subnets, which keep resources isolated from external access. This lets you design secure, multi-tier architectures with public-facing components separated from internal resources.
• SageMaker AI Domain — A logical grouping of resources for organizing user accounts, applications, and their associated components and configurations. A domain consists of an associated storage volume, a list of authorized users, as well as various security, application, policy, and network configurations.
• SageMaker Studio — A web-based development environment in SageMaker AI that let's you prepare data, build models, and manage training and deployment workflows.

  

  Figure 1.7 — SageMaker Studio

  In this interface, you can configure and run spaces, which are managed workspaces that enable end-to-end ML model development, team collaboration, and deployment workflows. The sidebar on the left lets you quickly access different tools, project assets, data files, and the SageMaker AI resources and features you need. It includes Applications, Partner AI Apps, Home, Models, Assets, Compute, Experiments, Jobs, Pipelines, Deployments, and More. While you can query resources via the API or SDKs, the SageMaker Studio interface makes it easy to browse and access them directly.

• SageMaker Studio space — A managed environment designed to handle the storage and resource needs of SageMaker Studio applications. Each space includes a storage volume, an application type, and a runtime image. Essentially, a space acts as a managed container or instance where the application operates with its storage, configuration, and other associated resources. Spaces can be started and stopped as needed, similar to starting and stopping EC2 instances. For example, you can configure a space with 50 GB of storage, an ml.t3.xlarge instance type, and a SageMaker Distribution 3.7.0 image for the runtime environment. This space can be turned on whenever you need to launch new Jupyter notebooks and execute code inside the notebook cells.
• JupyterLab — A web-based interactive development environment for working with notebooks, code, and data. It allows you to open and manage multiple notebooks, terminals, and files in separate tabs.

  

  Figure 1.8 — JupyterLab

  JupyterLab provides built-in features for file browsing, code editing, and terminal access, which enable you to manage your project resources from a single interface. It also supports interactive data exploration, visualization, and debugging directly within the notebook environment.

• JupyterLab App Launcher — A built-in launch page that allows you to quickly create new notebooks, open terminals, and access various development tools.

  

  Figure 1.9 — JupyterLab App Launcher

  Let's say you want to launch a notebook with a selected kernel or open a terminal session. The JupyterLab App Launcher provides quick access to both options. In addition to this, you can create new text or Markdown files, track and manage notebook jobs, and manage automatic Conda package installations for your environment directly from the launcher.

• JupyterLab notebook — An interactive document file (typically with a .ipynb extension) that contains executable code cells, Markdown-formatted text, and outputs such as tables and visualizations.

  

  Figure 1.10 — JupyterLab notebook

  Inside these notebooks, you can write and execute Python code, run model training jobs, and deploy machine learning models. You can also import and analyze datasets, visualize results, and test different algorithms interactively. For example, let's say you create a new cell in the notebook and write a few lines of Python code to load and preview a dataset:

  import pandas as pd
  
  # Load a dataset
  df = pd.read_csv("transactions.csv")
  
  # Display the first 5 rows
  df.head()

  When you run the cell, the notebook sends the code to the kernel for execution and displays the output directly below the cell.

• Kernel — A language-specific process that executes notebook code, manages the runtime environment including variables and memory, and interacts with the JupyterLab interface to handle code execution requests. For example, if you use the Python 3 (ipykernel) kernel in your notebook, you should be able to execute Python code in cells and see results interactively within the notebook.

Now that you have a better understanding of these key terms and concepts, let's proceed with setting up the SageMaker notebook instance:

1. Navigate to the Amazon SageMaker AI console by typing sagemaker ai in the search bar and choosing Amazon SageMaker AI from the list of results.

   

   Figure 1.11 — Navigating to the Amazon SageMaker AI console

   If you see both Amazon SageMaker and Amazon SageMaker AI in the search results, make sure to select Amazon SageMaker AI. This will redirect you to the Amazon SageMaker AI console, where you can create and manage various machine learning resources such as notebooks, training jobs, and processing jobs.

   

   Figure 1.12 — Amazon SageMaker AI console

   In the Amazon SageMaker AI console, the navigation pane (left sidebar) includes categories such as Environment configuration, Applications and IDEs, Model training and customization, Deployment & inference, Model governance, AWS Marketplace resources, Data preparation, Ground Truth, and Augmented AI. You should find various features and capabilities of SageMaker AI grouped together under these categories.

2. In the navigation pane, click Domains under Environment configuration. This should open a page that shows all created domains (if any).
3. Click Create domain.
4. Select Set up for single user (Quick setup), then click Set up to proceed.

   

   Figure 1.13 — Setting up a SageMaker Domain

   When you choose the Set up for single user (Quick setup) option, SageMaker automatically provisions several components required to use SageMaker Studio. This includes creating a new IAM role with the necessary permissions, a persistent Amazon EFS storage volume for storing notebooks and files, and a SageMaker domain that manages user access and resources. SageMaker also prepares the required SageMaker Studio applications and IDEs, along with other supporting resources needed to run notebooks, training jobs, and related ML workflows.

   If you receive the message "There is no VPC with available subnets in this region. Create a VPC with subnets in this region before trying again.", it means that you will first need to create a VPC before you can proceed with the SageMaker Domain setup. To do this, open a new browser tab and access the AWS Management Console. Navigate to the VPC console by typing vpc in the search bar and selecting VPC from the list of results. In the VPC dashboard or Your VPCs page, click Create VPC. Under VPC settings, choose VPC and more. Set Number of public subnets to 2, set Number of private subnets to 0, and under NAT gateways ($) choose None. Finally, click Create VPC to create the virtual network required for the SageMaker domain setup. Once the VPC has been created, return to the Set up SageMaker domain page and resume the creation of your domain.

5. Setting up your SageMaker domain may take approximately 5 to 10 minutes to complete. Once the domain setup is complete, click Open Studio.

   When prompted to take a quick tour, click Watch video or Take a quick tour. Watch the video or complete the tour to familiarize yourself with SageMaker's key features as well as the user interface. To help you get started, you may watch this short 2-minute video titled Introduction to SageMaker AI | Amazon Web Services: https://www.youtube.com/watch?v=1bt11sLo5Pw.

   Clicking Open Studio should open the SageMaker Studio interface, where you can access the applications, tools, and resources needed to build, evaluate, and deploy ML models (Figure 1.14):

   

   Figure 1.14 — SageMaker Studio

   You can think of SageMaker Studio as the control center for your data science, machine learning, and ML engineering work. Here, you can configure and run spaces, which are workspaces where you can launch applications, run notebooks, and work with various ML resources.

6. Select JupyterLab from the left sidebar (under Applications). You can find this in the upper-left corner of the SageMaker Studio interface.
7. Click the Create JupyterLab space button located in the upper-right corner of the page. On the Create JupyterLab space page (or window), enter mle‑on‑aws‑space as the space name, and then click Create space.

   Leave the Sharing configuration set to Private. With this configuration, only you can access and use the space.

8. Configure the space by selecting the ml.t3.xlarge instance type and setting the storage size to 50 GB.

   

   Figure 1.15 — Configuring the space

   By specifying ml.t3.xlarge for the instance type and 50 GB of storage, you should have enough compute and storage resources to run the examples in this chapter. Compared to the default ml.t3.medium instance (2 vCPU, 4 GiB), the ml.t3.xlarge instance (4 vCPU, 16 GiB) provides more vCPUs and memory, which helps you run notebooks and data processing tasks more smoothly, especially when working with larger datasets or more resource-intensive operations. Similarly, you increased the storage volume configuration from the default 5 GB to 50 GB. This additional storage ensures that you have enough space for datasets, notebooks, and intermediate files generated while running the examples.

9. Click Run space to start the JupyterLab space. It may take approximately 5 to 10 minutes for the space to start. Once the space is running, you can proceed with launching the JupyterLab application.

   Make sure to stop the space once you have finished working on the examples in this chapter or whenever you are not actively using it. Stopping the space shuts down the compute resources and helps you manage costs.

10. Once the space is running, click Open JupyterLab to launch the JupyterLab interface (Figure 1.16).

    

    Figure 1.16 — JupyterLab Interface

    Here, you can start working with notebooks, manage files, and access the development tools available in the environment. The Launcher should already be open, allowing you to quickly create a new notebook, open a terminal, or manage other resources.

With your SageMaker Studio space set up and running, you now have a managed workspace ready for AI and ML engineering. You can launch notebooks, experiment with models, and explore datasets interactively without worrying about infrastructure management. In the upcoming section, you'll see how to configure IAM permissions for your space that define what you can do within this environment.

In this section, you will set up the IAM permissions needed for your SageMaker Studio space. This will allow your environment to access and interact with different AWS services. First, you will go to the Amazon SageMaker AI console to locate the space execution role. Then, you'll copy the role name and go to the IAM console to attach the required permissions. By attaching these permissions, you enable your SageMaker Studio space to interact with resources from Amazon SageMaker AI, Amazon S3, and Amazon Bedrock. Once the permissions are applied, your SageMaker Studio space will be fully configured to interact with the relevant resources for this chapter.

Before we configure the IAM permissions of our Studio space, let's define and discuss a few key services, terms, and concepts:

• AWS Identity and Access Management (IAM) — A service that enables you to manage access to AWS services and resources securely. With IAM, you can create users, assign roles, and specify permissions for those users to control who can access which resources and what actions they can perform. IAM provides fine-grained control over AWS resources, helping you to secure and manage access to your cloud infrastructure effectively.
• IAM role — An identity within your AWS account that has specific permissions attached to it. These roles can be assumed by AWS services, users, or other trusted entities, enabling them to perform actions on your behalf. IAM roles allow you to grant permissions for specific tasks without directly linking those permissions to a particular user or service, which is especially useful for cloud resources that need temporary access to various AWS services and resources. In addition to IAM roles, there are other entities like IAM users (specific individuals or systems with permanent credentials) and IAM groups (collections of users with shared permissions), both of which are used to manage access in a more granular or collective manner.
• Permission — Defines what actions can be performed on resources within your AWS environment. Permissions determine whether a particular action, such as reading from or writing to an S3 bucket, is allowed. These permissions are attached to IAM roles, users, or groups and help ensure that only authorized entities can access and interact with your resources. Permissions can be as broad or as granular as necessary, allowing you to fine-tune security and enforce the principle of least privilege.
• Policy — Defines permissions and is associated with IAM roles, users, or groups. Policies describe the specific actions allowed or denied on AWS resources and can specify conditions under which those actions are permitted. Policies are essential for managing security in AWS, as they control what users or services can do with the resources in your account. Policies are written in JSON format and can be either managed policies (AWS-predefined) or inline policies (custom, attached directly to a user, group, or role).

When working with IAM, it is essential to understand who or what has access to your AWS resources, what actions they can perform, and under what conditions. This level of control is crucial for maintaining the security of your AWS environment. Properly configuring IAM roles, permissions, and policies ensures that only authorized users and services can access and modify your resources, preventing unauthorized actions. Whether it's granting temporary access to a service like SageMaker Studio or controlling who can read or write to an S3 bucket, this fine-grained access control is fundamental for managing and securing your cloud infrastructure.

With these in mind, let's proceed with configuring the IAM permissions for our SageMaker Studio space:

1. Switch to the browser tab where the AWS Management Console is open. If you are not already in the Amazon SageMaker AI console, type sagemaker ai in the search bar and select Amazon SageMaker AI from the list of results.
2. In the navigation pane (left sidebar), click Domains under Environment configuration. This should open a page that shows all created domains (if any). You should find the domain you created in the previous section listed on this page.
3. From the list of domains, select the domain you created in this chapter and click View to open the domain details page.

   The domain name should start with QuickSetupDomain because you selected Quick Setup when creating the SageMaker domain.

4. Scroll down to Authentication and permissions and locate the Space execution role. Copy the Space execution role name (for example, AmazonSageMaker‑ExecutionRole‑...) and keep it in a code editor on your local machine for use in upcoming steps.

   

   Figure 1.17 — Locating the space execution role

   The space execution role is an IAM role that SageMaker AI uses to grant your space permissions to access various AWS resources and other services. The permissions granted by the role depend on how it is configured, which can allow full access or limit actions to specific resources and services.

   An IAM role is identified by an Amazon Resource Name (ARN), which is composed of several parts, including the partition (arn:aws), the service (iam), the account ID, and the resource path that contains the role information. For example, the ARN arn:aws:iam::01234567890:role/service‑role/AmazonSageMaker‑ExecutionRole‑20260101T000000 includes the resource type (role), an optional path (service‑role/), and the actual role name (AmazonSageMaker‑ExecutionRole‑20260101T000000). When following the upcoming steps, make sure that you copy only the role name (AmazonSageMaker‑ExecutionRole‑20260101T000000) and not the full ARN.

5. Open a new browser tab and navigate to the AWS Management Console. In the AWS Management Console, type IAM in the search bar, and then select IAM from the list of results.

   

   Figure 1.18 — Navigating to the IAM console

   In the IAM console, you can manage users, roles, and permissions to securely control access to AWS resources.

6. In the IAM console, select Roles (under Access Management) from the navigation pane (left sidebar).
7. Use the search box to locate the space execution role you copied earlier to your code editor and select it from the list.

   When searching in the IAM console, you do not need to enter the full ARN. Instead, search using the role name portion, which typically begins with AmazonSageMaker‑ExecutionRole‑‑.

8. Click the role name (under the Role name column) to open its details page.
9. Under Permissions | Permission policies, click Add permissions, and choose Attach policies from the dropdown menu. Under Other permissions policies, locate and attach the following policies: AmazonBedrockFullAccess, AmazonS3FullAccess, BedrockAgentCoreFullAccess, and IAMFullAccess policies. Click Add permissions to apply the changes.

   

   Figure 1.19 — Policies have been successfully attached to the role

   You should see the message Policies have been successfully attached to role. confirming that the selected permission policies have been attached to the space execution role.

With the IAM permissions successfully attached to your SageMaker Studio space execution role, your environment now has the required access to interact with AWS services like Amazon S3, Amazon Bedrock, and Amazon SageMaker AI. Configuring these permissions ensures that your notebooks, tools, and agents can securely read, write, and manage resources without running into access errors. Going forward, you can focus on building and deploying models confidently, knowing that your workspace has the proper privileges to perform essential ML workflows.

In this section, you'll build a basic AI agent using Strands Agents and Amazon Bedrock. You'll configure the agent to use a supported Bedrock model and invoke it to answer queries so you can see how the agent performs reasoning and calculations in real time.

To help you understand what an agent is, you can think of it like a smart assistant that sees what's going on, decides on the best action, carries it out, and adjusts based on feedback. For example, you could ask the smart assistant, "What's the current time?", "How many days until my next birthday?", or "Send a birthday greeting to my friend via email", and it would use its tools and integrations to answer, calculate, and take action. More formally, an AI agent is a system or application that can observe its environment, make decisions, and act autonomously to achieve specific goals. Many modern agents can also interact with models, tools, and APIs to gather information, perform tasks, and provide responses. If you're wondering what makes these agents especially powerful, it is their ability to leverage external tools and connect to APIs, databases, or services to extend their capabilities beyond their built-in reasoning.

One of the several solutions available to help you build and run AI agents is Strands Agents. It let's you build, manage, and deploy AI-powered agents that integrate models, prompts, and various tools with just a few lines of code. You can think of Strands Agents like a game engine for AI. Just as a game engine provides prebuilt components, physics, and controls so developers can focus on creating gameplay, Strands Agents gives you the ready-made building blocks so you can focus on designing your agent's behavior. With everything already connected and configurable, you can quickly assemble, test, and deploy agents without starting from scratch.

In LLM-powered agents, a LLM acts as the reasoning engine, helping the agent understand inputs, plan actions, and generate intelligent responses. By combining this reasoning ability with autonomous actions, these agents can think on the fly, adapt to changing situations, and handle complex tasks without constant guidance. To help you better understand what they can do, here are some examples of AI agents:

• Scheduling Assistant Agent – Monitors calendars, plans meetings, sends invites, and follows up on updates. You can use this agent to automatically find open time slots for your team or reschedule meetings when conflicts arise, so you never have to manually coordinate schedules. It can even remind participants about upcoming appointments, helping you stay organized effortlessly.
• Customer Support Agent – Answers customer queries, retrieves knowledge base articles, and escalates tickets when necessary. You can rely on this agent to handle common questions from your users, freeing up your support team to focus on more complex issues. It can also provide personalized responses, so your customers get accurate help quickly.
• Data Analysis Agent – Collects data from multiple sources, runs analysis, and generates reports or summaries. You can ask this agent to pull data from spreadsheets, databases, or APIs and get insights without writing any code yourself. It can highlight trends, spot anomalies, and even create charts so you can make informed decisions faster.
• Automation Agent – Executes multi-step workflows, invoking APIs or tools to perform repetitive tasks automatically. You can set up this agent to handle routine tasks like sending emails, updating CRM records, or syncing files across systems, saving you hours of manual work. It can chain multiple actions together, so complex processes run smoothly with minimal effort from you.
• Monitoring and Alerting Agent – Observes system metrics or logs and notifies stakeholders or takes corrective actions based on conditions. You can use this agent to keep an eye on servers, applications, or business metrics, so you're alerted immediately if something goes wrong. It can even trigger automated fixes or escalate issues, helping you stay on top of problems before they impact users.

While you might be tempted to jump straight into building complex agents, in this section, we'll start with a simple one that uses just two tools: a calculator tool (calculator()) and a current time tool (current_time()). With this agent, you can ask questions like, "I was born on June 1, 1998, and I am 10 years older than my brother. How old is my brother?" Without tools like the calculator() and current_time(), even a powerful LLM would most likely make a mistake, since it does not have access to the current date and time and cannot perform exact calculations reliably. Once you've seen this agent in action, you'll be ready to create more advanced agents that integrate multiple tools and handle complex tasks.

With these in mind, let's proceed with building our first AI agent:

1. Switch back to the browser tab where the JupyterLab interface is open. In the Launcher, create a new Jupyter notebook by choosing Python 3 (ipykernel) (under Notebook). This will open a new notebook similar to what is shown in Figure 1.20.

   

   Figure 1.20 — A new Jupyter Notebook

   Here, you can start writing and running your code in an interactive notebook environment. You can think of this notebook like a sketchpad for a designer, where you can draft, test, and refine your ideas before finalizing them, making it convenient to experiment and see results immediately.

2. Rename the notebook to basic_agent.ipynb before proceeding (Figure 1.21).

   

   Figure 1.21 — Renaming the notebook

   To do this, right-click on the notebook tab and select Rename Notebook... from the context menu. Then, enter basic_agent.ipynb as the new name and click Rename.

   We will be entering and executing code for each step in a separate cell within this notebook. After entering the code for each step, you can execute the cell by pressing Shift + Enter, which will not only run the current cell but also automatically create a new one below it. For more information on using Jupyter notebooks, visit https://jupyter-notebook.readthedocs.io/en/latest/notebook.html.

3. Check the versions of Python and pip installed in your environment. To check the Python version, run the following command:

   !python --version

   Next, verify the installed version of pip with this command:

   %pip --version

   Running these commands should display the current versions of Python and pip in your notebook to ensure you are using the appropriate versions for the examples in this chapter.

   

   Figure 1.22 — Checking the Python and pip versions

   As shown in Figure 1.22, the examples in this chapter were tested using Python version 3.12.9 and pip 25.3. It's recommended to use versions close to these to avoid compatibility issues.

   Here, the exclamation point (!) at the beginning of the command tells the Jupyter notebook to run the command as a shell command instead of Python code. This allows you to execute terminal commands (like checking Python or pip versions) directly from the notebook.

4. In a new code cell of the Jupyter Notebook, run the following to install the required packages:

   %pip install strands-agents==1.22.0
   %pip install strands-agents-builder==0.1.10
   %pip install strands-agents-tools==0.2.19

   These commands will install specific versions of the strands‑agents, strands‑agents‑builder, and strands‑agents‑tools packages, which are required for the examples used in this chapter.

5. Right-click on the output area and select Enable Scrolling for Outputs from the context menu.

   

   Figure 1.23 — Enabling scrolling for outputs

   This will make it more manageable to view long outputs, as it prevents the output from expanding and occupying too much space in the notebook interface.

6. Restart the kernel by selecting Kernel | Restart Kernel... from the menu.

   

   Figure 1.24 — Restarting the kernel

   This will ensure the newly installed packages are properly loaded and available for use. If prompted to restart the kernel, click Restart. Then, wait for 2–3 minutes for the kernel to fully restart.

7. Run the following block of code so that any warnings related to protected namespace conflicts are filtered out:

   import warnings
   
   m = "Field .* has conflict with protected namespace"
   warnings.filterwarnings(
       "ignore",
       message=m
   )

8. Run the following code to create an Agent instance and use it to process the prompt:

   from strands import Agent
   agent = Agent()
   
   prompt = """What are AI agents? Provide a concise definition (1–2 sentences) that explains what they are and what they do."""
   
   agent(prompt)

   This will invoke the agent, which responds with a concise definition of AI agents:

   AI agents are autonomous software systems...
   AgentResult(stop_reason='end_turn', ...)

   Here, we are deliberately testing the agent's basic functionality without invoking external tools, to ensure that the installation and setup are working as intended. In case you encounter the following error:

   ValidationException: An error occurred (ValidationException) when calling the ConverseStream operation: The provided model identifier is invalid.
   └ Bedrock region: ...
   └ Model id: ...

   This usually means that the model used is not available or the model ID is incorrect. To resolve this, explicitly specify a valid model ID supported in your region, as shown below:

   model_id = "us.anthropic.claude-sonnet-4-6"
   
   from strands import Agent
   
   agent = Agent(model=model_id)
   prompt = """What are AI agents? Provide a concise definition (1–2 sentences) that explains what they are and what they do."""
   
   agent(prompt)

   After running the updated code, the agent should successfully generate a response similar to the following:

   ## AI Agents
   
   **AI agents are autonomous software systems that perceive their environment, make decisions, and take actions to achieve specific goals — often with minimal human intervention.** ...
   AgentResult(stop_reason='end_turn', ...)

   This confirms that your agent is correctly configured and able to interact with a valid model in Amazon Bedrock. If you encounter a ValidationException related to an invalid model identifier in subsequent examples, make sure to explicitly specify a valid model_id when initializing the Agent() instance. Model availability can vary by region, so always use a model that is supported in your current AWS region to avoid errors.

   If you are unsure which model_id to use, navigate to the Amazon Bedrock console and open Model catalog (under Discover). Search for and select a model (for example, Claude Sonnet 4.6 by Anthropic), then copy the Model ID value (for example, anthropic.claude‑sonnet‑4‑6) from the model details page. Using the navigation pane (left sidebar), you can also navigate to Inference profiles (under Infer) to view available inference profiles along with their Inference profile ID values. You can use the Inference profile ID value as the model_id when initializing an Agent instance. If you haven't worked with inference profiles before, they act as an abstraction layer that unifies model ARNs from different regions under one identifier. For more information, feel free to check the following AWS blog post: https://aws.amazon.com/blogs/machine-learning/getting-started-with-cross-region-inference-in-amazon-bedrock/.

9. Now, let's enhance the agent's capabilities with useful tools. Import the necessary tools by importing calculator and current_time from the strands_tools module:

   from strands_tools import calculator, current_time

10. Before using the calculator tool within the agent, let's first test it independently by evaluating a simple mathematical expression:

    calculator.calculator("1 + 2")

    This yields the following output:

    

    Figure 1.25 — Using the calculator tool directly to evaluate a mathematical expression

    Here, you are directly calling the calculator tool with a simple expression to verify that it works before integrating it into the agent. Keep in mind that you are only testing the tool independently and are not using the agent yet.

11. Similarly, get the current time by invoking the current_time function:

    current_time.current_time()

    This gives you an output similar to the following:

    '2026-01-01T00:00:00.000000+00:00'

12. Now, let's configure the agent to use the tools we just imported. Create an Agent instance and pass the calculator and current_time tools to the agent's tools parameter:

    agent = Agent(
        tools=[calculator, current_time]
    )

    If you encounter the following warning:

    ================== WARNING ==================
    
        This region ... does not support
        our default inference endpoint: ....
        Update the agent to pass in a 'model_id' like so:
        ```
        Agent(..., model='valid_model_id', ...)
        ````
        Documentation: ...
    
    ==================================================

    This means that the default model is not supported in your current region. To resolve this, explicitly specify a valid model_id as shown below:

    model_id = "us.anthropic.claude-sonnet-4-6"
    from strands import Agent
    
    agent = Agent(
        model=model_id,
        tools=[calculator, current_time]
    )

    This ensures that the agent uses a model that is supported in your region and can successfully execute with the configured tools.

13. With the agent configured, we can now pass a query to test and invoke the agent:

    prompt = """I was born on June 1, 1998, and I am 10 years older than my brother. How old is my brother?"""
    
    agent(prompt)

    This will trigger the agent to calculate the age based on the provided information, utilizing the tools for computations and time-based queries.

    

    Figure 1.26 — Output after running agent(prompt)

    Here, the agent processes the prompt and uses the current_time() and calculator() tools to determine the correct age based on the details provided.

    When the agent finishes processing the prompt, you should see a similar output explaining the calculated ages:

    ...
    Based on the current date (January 21, 2026), you are currently 27 years old (turning 28 on June 1, 2026). Since you are 10 years older than your brother, your brother is currently **18 years old** (he will turn 18 before June 1, 2026, or has already turned 18 if his birthday has passed this year). To be more precise: if your brother's birthday has already occurred in 2026, he is 18. If his birthday hasn't occurred yet this year, he is still 17 and will turn 18 later in 2026.

    Your output may look slightly different from the output shown in this example. This is expected because the agent relies on the current date and time returned by the current_time() tool, and the model may also vary slightly in how it reasons through the prompt and presents the final answer.

14. Now, assign a specific model ID to the variable mid:

    mid = "us.anthropic.claude-sonnet-4-6"

15. Initialize the model and agent by importing BedrockModel and Agent, then creating an instance of the model and initializing the agent with the model:

    from strands.models.bedrock import BedrockModel
    from strands import Agent
    
    model = BedrockModel(model_id=mid)
    agent = Agent(model)

    You may use help(Agent) to view the documentation and get more information about the Agent class.

16. Provide the prompt to the agent by defining the prompt as a string and passing it to the agent for processing:

    prompt = """What are AI agents? Provide a concise definition (1–2 sentences) that explains what they are and what they do."""
    
    agent(prompt)

    This generates a response similar to:

    AI agents are software programs designed to perceive their environment, make decisions ...
    AgentResult(stop_reason='end_turn', ...)

    If you encounter a ResourceNotFoundException, it usually means the model you are trying to use has been marked as Legacy or is no longer active. To fix this, update your agent to use a currently supported model on Amazon Bedrock.

17. Initialize the agent with tools by creating an Agent instance and passing the model along with the list of tools to be used (calculator and current_time):

    agent = Agent(
        model=model,
        tools=[calculator, current_time]
    )

18. Define the prompt by preparing a string that presents a question for the agent to answer:

    prompt = """I was born on June 1, 1998, and I am 10 years older than my brother. How old is my brother?"""

19. Invoke the agent with the defined prompt to generate a response:

    agent(prompt)

    This yields an output similar to the following:

    

    Figure 1.27 — Output after running agent(prompt)

    You should see how the agent processes the prompt and leverages the current_time() and calculator() tools to compute the answer based on the provided information. Since we're using Amazon Bedrock, the agent can simply interact with the model through the API without you having to worry about infrastructure management.

Congratulations! Your agent is now up and running, and can work with a Bedrock model to process input prompts, perform calculations, and reference the current time. You've explored how to configure tools, select a supported model, and execute queries that return meaningful responses. Keep in mind that outputs may vary based on your region or the current date, but this setup provides a strong starting point for getting started with AI agents before moving on to more complex implementations.

In this chapter, we explored the fundamentals of generative AI on AWS and learned how to leverage various services and solutions to build AI agents. We got our feet wet by working with foundation models provided through Amazon Bedrock, while also covering key concepts and terminology along the way. After setting up a SageMaker Studio space, we built our first AI agent using Strands Agents, which interacts with a Bedrock model and is configured with several tools to enhance its reasoning and problem-solving capabilities.

In the next chapter, you'll build on what you learned here by using Strands Agents to create AI agents that interact with a SageMaker AI real-time inference endpoint and deploying them using Bedrock AgentCore. This will give you hands-on experience taking agents from development to a fully managed, production-ready runtime environment. You'll also develop a RAG-powered agent that can incorporate external data into its responses, allowing you to build more dynamic, context-aware applications.

To deepen your understanding of the concepts discussed in this chapter, explore the following resources:

• Amazon Bedrock FAQs (https://aws.amazon.com/bedrock/faqs/)
• Amazon Bedrock Pricing (https://aws.amazon.com/bedrock/pricing/)
• Amazon Bedrock — Prompt engineering guidelines (https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-engineering-guidelines.html)
• AWS Machine Learning Blog — Welcome to a New Era of Building in the Cloud with Generative AI on AWS (https://aws.amazon.com/blogs/machine-learning/welcome-to-a-new-era-of-building-in-the-cloud-with-generative-ai-on-aws/)
• AWS Machine Learning Blog — Best practices to build generative AI applications on AWS (https://aws.amazon.com/blogs/machine-learning/best-practices-to-build-generative-ai-applications-on-aws/)

Get this book's PDF copy, code bundle, and more

Scan the QR code (or go to packtpub.com/unlock). Search for this book by name, confirm the edition, and then follow the steps on the page.

Note: Have your invoice handy. Purchases made directly from the Packt website don't require an invoice.