Quick answer
Secure an n8n AgentCore integration with two permission boundaries: a narrow caller credential for the operations n8n performs and a separate harness execution role for runtime access. Store non-Bedrock keys in AgentCore Identity, scope every model, memory, tool, Skill, log, secret, and network permission, and set hard limits on iterations, time, and tokens.
For cost control, combine execution limits with CloudWatch telemetry, resource tags, AWS billing data, and an explicit cleanup runbook. Deleting a workflow node is not proof that its AWS resources are gone.
Separate caller and runtime permissions
The n8n credential may need to create, update, or invoke a harness depending on the workflow design. A platform-owned Harness ARN pattern can reduce n8n to invoke-only access.
The execution role is assumed by the harness. Scope it to only the required:
- Bedrock model or inference-profile resources;
- AgentCore Memory instance;
- Browser, Code Interpreter, or Gateway resources;
- S3 prefixes or private Git credentials used by Skills;
- API-key or OAuth credential providers;
- custom container or managed-image ECR pulls;
- CloudWatch logs, traces, and metrics;
- VPC and dependent-service access.
Prefer temporary AWS credentials for n8n. Never commit access keys, third-party API keys, or private repository tokens into workflow JSON or prompts.
Set execution limits before production
AWS documents these Harness controls:
| Control | What it bounds | AWS documented default |
|---|---|---|
maxIterations | Reasoning/action cycles per invocation | 75 |
timeoutSeconds | Invocation wall-clock time | 3600 seconds |
maxTokens | Invocation token budget | No default value documented |
idleRuntimeSessionTimeout | Warm idle microVM time | 900 seconds |
maxLifetime | Maximum microVM session lifetime | 28,800 seconds |
Defaults are not recommendations. Start below the observed safe ceiling, then raise a limit only with evidence. A timeout alone does not prevent a fast loop from consuming many tokens or tool calls; use multiple caps and downstream limits.
Observe the whole cost path
Harness invocations can generate model, runtime, memory, tool, network, storage, logging, and dependent-service charges. AWS says each invocation automatically emits AgentCore traces, logs, and metrics to CloudWatch, with setup requirements for viewing traces.
Track:
- invocations, success, retries, and timeouts;
- reasoning iterations and tool calls per task;
- input/output tokens by model route;
- memory events and retrieval;
- Browser, Code Interpreter, Gateway, MCP, and external API usage;
- VPC interface endpoints, NAT, data transfer, EFS, S3, and logs;
- cost per successful workflow outcome, not only per model call.
Apply team and environment tags to the harness. AWS documents propagation to managed Runtime, endpoint, and managed Memory resources; separately created resources need their own tags.
Version and promote safely
Treat a model, prompt, tool, Skill, memory, or network change as a release. Use immutable Harness versions and named endpoints where appropriate, test with production-shaped fixtures, then update the n8n workflow reference or endpoint deliberately.
Keep rollback evidence: previous version, configuration, package version, IAM policy, evaluation result, and owner. Avoid allowing a normal workflow execution to silently update production infrastructure.
Cleanup runbook
- Stop new n8n triggers and confirm in-flight work is complete.
- Record the Harness ARN, version, endpoints, Region, account, tags, and owner.
- Export only the logs or evidence required by policy.
- Delete the test harness through the approved AWS process.
- Inventory separately created Memory, Gateway, Browser, Code Interpreter, EFS, S3, VPC endpoints, security groups, secrets, and log groups.
- Check dependencies before deleting each resource.
- Verify deletion in AWS and watch the next billing cycle for residual charges.
- Remove stale n8n credentials and workflow references.
PrivateLink interface endpoints can continue billing after the test harness is gone. Do not delete shared network resources merely because one harness used them; prove ownership and dependencies first.
Frequently asked questions
Which credentials does an n8n AgentCore workflow need?
n8n needs a caller credential for the management or invoke operations it performs. The harness needs a separate execution role for models, memory, tools, Skills, secrets, networking, and telemetry.
Which Harness limits control runaway execution?
AWS documents limits for maximum iterations, invocation timeout, tokens, idle runtime session timeout, and maximum microVM session lifetime. Choose workload-specific caps instead of relying only on defaults.
What should be deleted after a test?
Delete the test harness when no longer needed and inventory separately created memory, Gateway, VPC endpoints, EFS, S3, log retention, secrets, and other dependent resources before removing them.
Does deleting an n8n node delete AWS resources?
Do not assume it does. Verify resource state in AWS and use an explicit cleanup runbook with tags, owners, dependency checks, and evidence of deletion.
Continue by decision
- AgentCore Harness setup for n8n
- Tools, Skills, MCP, and VPC
- Model switching guide
- n8n AgentCore harness planner
Official sources
- AWS AgentCore Harness observability and cost controls
- AWS AgentCore Harness security
- Amazon Bedrock AgentCore pricing
Source check: August 8, 2026. Verify current IAM actions, defaults, quotas, telemetry setup, resource dependencies, and regional prices before production use.