Implement Memory Lifecycle Policies for Amazon Bedrock AgentCore to Reduce Security Risks

Use AWS Step Functions to automate memory scoring and pruning for Bedrock AgentCore.
1️⃣ Define a Lambda that scores each memory (e.g., age, relevance) → returns a retention flag.
```bash
aws lambda create-function \
--function-name ScoreAgentMemory \
--runtime python3.11 \
--handler score.handler \
--role arn:aws:iam::123456789012:role/LambdaExecRole \
--zip-file fileb://score.zip
```
2️⃣ Build a Step Functions state machine that:
- Calls the scoring Lambda.
- Filters memories marked for deletion.
- Calls AgentCore API to delete them.
```json
{
"StartAt": "Score",
"States": {
"Score": {"Type": "Task","Resource": "arn:aws:lambda:...:function:ScoreAgentMemory","Next": "Delete"},
"Delete": {"Type": "Task","Resource": "arn:aws:states:::aws-sdk:bedrockagent:deleteMemory","End": true}
}
}
```
3️⃣ Deploy the state machine and schedule it nightly:
```bash
aws stepfunctions create-state-machine --name AgentMemoryLifecycle --definition file://state.json --role-arn arn:aws:iam::123456789012:role/StepFunctionsRole
aws events put-rule --schedule-expression "cron(0 2 ? *)" --name NightlyMemoryPrune
aws events put-targets --rule NightlyMemoryPrune --targets Id=1,Arn=arn:aws:states:...:stateMachine:AgentMemoryLifecycle
```
4️⃣ Verify by checking AgentCore memory metrics before and after run.
🔔 Gotcha: The IAM role must include bedrock:DeleteMemory and states:StartExecution; missing permissions will cause silent failures.