feat(bedrock-agentcore): add fromImageUri method to AgentRuntimeArtifact

[kimsbrian]

Issue # (if applicable)

N/A

Reason for this change

Users currently need ECR repository constructs (fromEcrRepository) or local Docker assets (fromAsset) to reference container images in AgentCore runtimes. This creates friction when:

• Container URIs come from CloudFormation parameters or stack outputs
• Referencing images in external registries (Docker Hub, private registries)
• Working with cross-stack or cross-account image references

Description of changes

Added fromImageUri() static method to AgentRuntimeArtifact class:

• Created ImageUriArtifact class extending AgentRuntimeArtifact
• Accepts container URI as a string (supports CloudFormation tokens/expressions)
• No automatic IAM permissions granted (user manages permissions separately)
• Follows existing patterns from EcrImage and AssetImage classes

This provides a fourth deployment option alongside fromEcrRepository(), fromAsset(), and fromS3().

Description of how you validated changes

Unit tests added:

• Basic URI reference test
• CloudFormation token support test
• Verification that no permissions are required

Manual testing:
bash
cd packages/@aws-cdk/aws-bedrock-agentcore-alpha
yarn build
yarn test

All tests pass.

Production usage:
This change has been built locally and used successfully in my application to reference container images via CloudFormation parameters.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

[kimsbrian]

Exemption Request

This doesn't need an integration test. It's adding another way to pass a container URI to the same CloudFormation property that fromEcrRepository() and fromAsset() already use.

The method is a simple pass-through. It takes a string and sets containerUri. No new CloudFormation resources, no cross-service configuration, just an alternative to the existing methods.

Unit tests cover the behavior (URI reference, CloudFormation tokens, no auto-permissions).

[kimsbrian]

@alvazjor Thanks for the feedback. Reading the container uri pattern requirement shows it only accepts ECR which means that external repos unfortunately can't be used. Maybe it's worthwhile to eventually enable this from the Bedrock agentcore side. At least for my use case, I'm still happy to have this change in. Updated the documentation and comments to reflect ECR only containers are supported.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[alvazjor]

@kimsbrian there is a linting issue in the PR, that is why the build keeps failing
https://github.com/aws/aws-cdk/actions/runs/19901668989/job/57048002305?pr=36263#step:9:3580

Pull request has been modified.

[mergify]

Merge Queue Status

✅ The pull request has been merged

This pull request spent 6 seconds in the queue, with no time running CI.
The checks were run in-place.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • feat(bedrock-agentcore): add fromImageUri method to AgentRuntimeArtifact #36263
• #changes-requested-reviews-by = 0 [🛡 GitHub branch protection]
  • feat(bedrock-agentcore): add fromImageUri method to AgentRuntimeArtifact #36263
• any of [🛡 GitHub branch protection]:
  • check-success = validate-pr
  • check-neutral = validate-pr
  • check-skipped = validate-pr
• any of [🛡 GitHub branch protection]:
  • check-success = build
  • check-neutral = build
  • check-skipped = build

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.