Run the room

The account stack

instructor.py up applies terraform/account once for the whole class. Each participant's AgentCore stack (home page diagram) is a separate terraform workspace on their own laptop.

Set up the class

1. List companies and participants

   Edit roster.json. Participants are grouped by company under teams. Each company becomes a LiteLLM team bootcamp-<company> whose budget_usd caps what its participants spend together. Each participant gets default_budget_usd unless they set their own budget_usd; optionally add principal_arn to restrict who may assume their role. Participant roles are tagged Team=<company> as well as Participant=<name>.

   roster.jsonCopy

   {
     "default_budget_usd": 1,
     "dns_zone": "workshop.example.com",
     "dns_prefix": "bootcamp",
     "teams": {
       "acme": {
         "budget_usd": 20,
         "participants": {
           "alice": {},
           "bob": {"budget_usd": 2}
         }
       },
       "globex": {
         "budget_usd": 15,
         "participants": {"carol": {}}
       }
     },
     "alert_email": "instructor@example.com",
     "infra_limits": {"enforce": true, "monthly_budget_usd": 100, "per_participant": {"code_interpreter_sessions": 3, "browser_sessions": 3}},
     "cleanup": {"after_hours": 48, "enforce": false, "schedule": "rate(1 day)"}
   }

2. Bring up the account stack (once)

   From the instructor checkout (participants clone only the bootcamp-participant branch, which has no instructor tooling):

   terminalCopy

   uv run instructor.py up

   Deploys the shared platform, creates a bootcamp-participant-<name> role per participant and syncs their server-side virtual keys and budgets. Adding a participant later also needs instructor.py up, because it creates their IAM role.

3. Run the pre-flight (a week ahead, and the morning of day 1)

   terminalCopy

   uv run instructor.py preflight

   Read-only, about a minute. Fails on blockers: gateway /readyz and site not answering, an invalid roster, a roster model Bedrock will not serve (one tiny call per model with the master key), a missing participant role or key, the state bucket, and Transaction Search being off (Task 5 traces need it). Warns about an unconfirmed alert email, the evaluator quota (L-876938BB) against the class size, the budget, the Project cost tag and the clean-up schedule. It also prints the Identity Center policy the participants' permission set needs, which it cannot verify from the workshop account.

4. Sync server-side virtual keys and budgets

   terminalCopy

   uv run instructor.py keys

   Only syncs LiteLLM virtual keys and budgets with roster.json, for example to top up someone who ran out. Keys stay on the server and are never handed out: the gateway maps each IAM role to its key.

5. Hand out names and SSO details

   Give each participant their PARTICIPANT name, the SSO start URL and region (see below), and point them at this site. The CLI derives their role; BOOTCAMP_ROLE_ARN is only an optional override. A few days ahead, ask everyone to follow Before the workshop and send you the result of uv run bootcamp.py doctor.

6. Watch the class during the day

   terminalCopy

   uv run instructor.py class --watch 30
   uv run instructor.py spend

   class prints one row per participant: company, stage (from their deployed AgentCore resources), LiteLLM spend and budget, tracked Code Interpreter / Browser sessions, open guardrail alerts and last activity. spend prints spend per company team, then per participant.

7. Reset a broken participant stack

   terminalCopy

   uv run instructor.py reset <name>           # dry run: lists their resources
   uv run instructor.py reset <name> --force   # deletes them

   Like purge, scoped to one participant. They then run uv run bootcamp.py forget to drop their stale local terraform state and start again with up 0. Spend is not reset; raise their budget in roster.json and run keys instead.

8. Tear down

   Ask participants to run uv run bootcamp.py down, then check for leftovers and remove the account stack:

   terminalCopy

   uv run instructor.py purge           # dry run: lists leftover participant resources
   uv run instructor.py purge --force   # deletes them (only if the list wasn't empty)
   uv run instructor.py down

   instructor.py down refuses while any participant resources still exist and lists them; instructor.py down --force purges first, then destroys. Forgotten stacks are also caught by the scheduled clean-up (see Infra guardrails).

Participant AWS access (SSO)

Participants sign in with AWS IAM Identity Center: share the SSO start URL and region; they run aws configure sso and put the profile in AWS_PROFILE. The CLI then assumes bootcamp-participant-<name>.

Each role's trust defaults to the account root, so the participants' permission set must allow sts:AssumeRole on arn:aws:iam::<account>:role/bootcamp/bootcamp-participant-*. To pin a role to one person, set principal_arn for that participant in roster.json.

Infra guardrails

LLM spend is capped by LiteLLM: per-participant budgets inside per-company team budgets (HTTP 429 budget_exceeded). AWS spend is watched by an infra guard Lambda, CloudWatch alarms and an AWS Budget, all alerting to the SNS topic bootcamp-alerts.

Per-participant limits

The guard reacts within seconds to new Code Interpreter / Browser sessions (a dedicated CloudTrail trail, bootcamp-agentcore-sessions, logs only those two session-start data events; nothing else in the sandbox is logged) and sweeps live resources every 5 minutes. It attributes usage by caller role (bootcamp-participant-<p> / awsworkshop-<p>-*) and resource name. Alerts are de-duplicated per hour.

Override per team (teams.<t>.infra_limits) or per participant (teams.<t>.participants.<p>.infra_limits). Class-wide totals default to per-participant × headcount (override with infra_limits.class). Auto-stop needs infra_limits.enforce: true; runtimes, gateways and memories are alert-only.

Alarms

The 5-minute sweep also reports when the LiteLLM gateway autoscaling is at its max task count.

Cost

AWS Budget bootcamp-genai-bootcamp-tagged on cost tag Project=genai-bootcamp (infra_limits.monthly_budget_usd, default $100), notifying at 80% actual and 100% forecast. AWS-managed tool sessions can't be tagged, so set infra_limits.account_budget_usd > 0 if you also want an account-wide budget.

Scheduled clean-up

The Lambda bootcamp-cleanup runs on cleanup.schedule (daily by default). It finds participant stacks with the same discovery as instructor.py purge (it ships the CLI's own purge.py) and treats a participant as idle when none of their roles (bootcamp-participant-<p>, awsworkshop-<p>-*) was used for cleanup.after_hours (default 48, minimum 6). Idle stacks are emailed to bootcamp-alerts; with cleanup.enforce: true they are purged first, in purge's dependency order, and only then does the Lambda get delete rights. Test it any time with a dry run that never deletes:

aws lambda invoke --function-name bootcamp-cleanup --cli-binary-format raw-in-base64-out \
  --payload '{"dry_run": true}' out.json && cat out.json

Manual steps

1. Set alert_email in roster.json and run uv run instructor.py up.
2. Confirm the SNS subscription email. Until then nobody is emailed.
3. Activate Project as a cost allocation tag in the payer account.
4. Optional billing alarm: enable billing alerts, put enable_billing_alarm = true in terraform/account/terraform.tfvars, then run instructor.py up.