Setting the file. One moment.
Skill 79 · Amazon Workspaces Agent Access
Subchapter 79.5
references/session-lifecycle.mdMarkdown3 KBView on GitHub
initialize with a streaming URL (or auto-provisioned via an AgentCore Gateway). The request is authorized by the agentaccess-mcp:InvokeMcp IAM action (see connection-setup.md → IAM permissions).Two separate limits are often confused:
Validity parameter of CreateStreamingURL: 1–604800 seconds (7 days); API default 60 seconds. (AWS sample tooling commonly passes 3600 / 1 hour.) Once connected, the URL’s validity no longer matters. It is a bearer credential — do not log it or pass it via environment variables that may be captured in process listings or crash dumps; redact X-Amzn-AgentAccess-Streaming-Session-Url if MCP headers are logged.MaxUserDurationInSeconds, plus DisconnectTimeoutInSeconds and IdleDisconnectTimeoutInSeconds for teardown after disconnect/idle. These are per-fleet configuration, not a fixed Agent Access cap — confirm the values on your fleet (see CreateFleet (opens in a new tab) for allowed ranges).Control whether the underlying streaming session is expired when the agent disconnects with the X-Amzn-AgentAccess-Expire-Streaming-Session-On-Delete header:
| Value | Behavior |
|---|---|
true | On an explicit HTTP DELETE, the server expires the streaming session as part of cleanup. This terminates the streaming instance and triggers the fleet’s autoscaling policy. |
false (default) | The session keeps running until the fleet’s disconnect timeout is reached. |
mcp-proxy-for-aws issues the DELETE automatically when you end the client lifecycle cleanly (e.g. exit the async with block). So to reclaim capacity promptly after a run, set the header to true and let the client close normally.
Only one agent can be connected to a given session at a time. A named user (UserId) can have only one active session per fleet at a time. To run multiple agents concurrently, give each its own session (and distinct UserId).
Sessions have an idle/disconnect timeout at the fleet level. For long-lived automations, keep the MCP connection active or plan for reconnection (a fresh streaming URL) if the session times out. If a later tool call returns client_disconnected, the session was stopped or the auth expired — reconnect with fresh auth (a new streaming URL for non-domain-joined, or a new SAML assertion for domain-joined) rather than retrying the same connection (see troubleshooting.md).