AgentRegistryControl / Client / create_registry

create_registry

AgentRegistryControl.Client.create_registry(**kwargs)

Creates a new registry, a catalog that organizes registry records and defines their discovery authorization and record approval behavior. Creation is asynchronous: the registry begins in the CREATING status and becomes usable once it reaches READY.

See also: AWS API Documentation

Request Syntax

response = client.create_registry(
    name='string',
    description='string',
    encryptionConfiguration={
        'kmsKeyArn': 'string'
    },
    discoveryConfiguration={
        'authorizerConfiguration': {
            'customJWTAuthorizer': {
                'discoveryUrl': 'string',
                'allowedAudience': [
                    'string',
                ],
                'allowedClients': [
                    'string',
                ],
                'allowedScopes': [
                    'string',
                ],
                'customClaims': [
                    {
                        'inboundTokenClaimName': 'string',
                        'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
                        'authorizingClaimMatchValue': {
                            'claimMatchValue': {
                                'matchValueString': 'string',
                                'matchValueStringList': [
                                    'string',
                                ]
                            },
                            'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
                        }
                    },
                ],
                'privateEndpoint': {
                    'selfManagedLatticeResource': {
                        'resourceConfigurationIdentifier': 'string'
                    },
                    'managedVpcResource': {
                        'vpcIdentifier': 'string',
                        'subnetIds': [
                            'string',
                        ],
                        'endpointIpAddressType': 'IPV4'|'IPV6',
                        'securityGroupIds': [
                            'string',
                        ],
                        'tags': {
                            'string': 'string'
                        },
                        'routingDomain': 'string'
                    }
                },
                'privateEndpointOverrides': [
                    {
                        'domain': 'string',
                        'privateEndpoint': {
                            'selfManagedLatticeResource': {
                                'resourceConfigurationIdentifier': 'string'
                            },
                            'managedVpcResource': {
                                'vpcIdentifier': 'string',
                                'subnetIds': [
                                    'string',
                                ],
                                'endpointIpAddressType': 'IPV4'|'IPV6',
                                'securityGroupIds': [
                                    'string',
                                ],
                                'tags': {
                                    'string': 'string'
                                },
                                'routingDomain': 'string'
                            }
                        }
                    },
                ]
            }
        },
        'authorizerType': 'CUSTOM_JWT'|'AWS_IAM'
    },
    clientToken='string',
    tags={
        'string': 'string'
    },
    approvalConfiguration={
        'autoApprovalRules': [
            'APPROVE_ALL',
        ]
    },
    autoDetectionConfiguration={
        'scope': 'ORGANIZATION',
        'enabled': True|False
    }
)
Parameters:

  • name (string) –

    [REQUIRED]

    The name of the registry

  • description (string) – The description of the registry

  • encryptionConfiguration (dict) –

    The optional server-side encryption configuration for the registry. When you provide this field, the specified customer-managed Amazon Web Services KMS key encrypts the registry’s content. Omit this field to use an Amazon Web Services-owned encryption key. You cannot change the encryption configuration after registry creation.

    • kmsKeyArn (string) – [REQUIRED]

      The Amazon Resource Name (ARN) of the customer-managed Amazon Web Services KMS key used to encrypt the registry’s content. The key must be a symmetric encryption key in the same Amazon Web Services account and Region as the registry.

  • discoveryConfiguration (dict) –

    Discovery configuration for the registry

    • authorizerConfiguration (dict) –

      The authorizer configuration for the registry. Required when authorizerType is CUSTOM_JWT.

      Note

      This is a Tagged Union structure. Only one of the following top level keys can be set: customJWTAuthorizer.

      • customJWTAuthorizer (dict) –

        Configuration for a custom JWT authorizer.

        • discoveryUrl (string) – [REQUIRED]

          The OpenID Connect discovery URL used to retrieve the identity provider’s metadata and signing keys.

        • allowedAudience (list) –

          The audience values accepted during JWT validation. A token is rejected if none of its audience claims match.

          • (string) –

            An audience value that an inbound JWT must contain to be authorized.

        • allowedClients (list) –

          The client identifiers accepted during JWT validation. A token is rejected if it was not issued to one of these clients.

          • (string) –

            A client identifier that an inbound JWT must be issued to in order to be authorized.

        • allowedScopes (list) –

          The scopes accepted during JWT validation. A token is rejected if it does not carry one of these scopes.

          • (string) –

            A scope value that an inbound JWT must carry to be authorized.

        • customClaims (list) –

          Additional custom claim validations applied to the inbound JWT.

          • (dict) –

            A validation rule applied to a single claim of an inbound JWT.

            • inboundTokenClaimName (string) – [REQUIRED]

              The name of the claim in the inbound token to validate.

            • inboundTokenClaimValueType (string) – [REQUIRED]

              The value type of the claim in the inbound token, either a string or an array of strings.

            • authorizingClaimMatchValue (dict) – [REQUIRED]

              The value and match operator used to authorize the claim.

              • claimMatchValue (dict) – [REQUIRED]

                The expected value or values that the claim is compared against.

                Note

                This is a Tagged Union structure. Only one of the following top level keys can be set: matchValueString, matchValueStringList.

                • matchValueString (string) –

                  A single string value to match the claim against.

                • matchValueStringList (list) –

                  A list of string values to match the claim against.

                  • (string) –

                    A single value used to match a claim during JWT validation.

              • claimMatchOperator (string) – [REQUIRED]

                The operator used to compare the claim value against the expected value.

        • privateEndpoint (dict) –

          The private endpoint used to reach the identity provider’s discovery URL over a private network path.

          Note

          This is a Tagged Union structure. Only one of the following top level keys can be set: selfManagedLatticeResource, managedVpcResource.

          • selfManagedLatticeResource (dict) –

            A private endpoint backed by a self-managed VPC Lattice resource configuration.

            Note

            This is a Tagged Union structure. Only one of the following top level keys can be set: resourceConfigurationIdentifier.

            • resourceConfigurationIdentifier (string) –

              The identifier of the VPC Lattice resource configuration, specified as a resource configuration ID or ARN.

          • managedVpcResource (dict) –

            A private endpoint backed by a service-managed VPC resource.

            • vpcIdentifier (string) – [REQUIRED]

              The identifier of the VPC in which the private endpoint is provisioned.

            • subnetIds (list) – [REQUIRED]

              The identifiers of the subnets in which the private endpoint network interfaces are placed.

              • (string) –

                Subnet identifier

            • endpointIpAddressType (string) – [REQUIRED]

              The IP address type used by the private endpoint, either IPV4 or IPV6.

            • securityGroupIds (list) –

              The identifiers of the security groups associated with the private endpoint network interfaces.

              • (string) –

                The identifier of a security group.

            • tags (dict) –

              The tags applied to the service-managed VPC resource.

              • (string) –

                Key of a tag.

                • (string) –

                  Value of a tag.

            • routingDomain (string) –

              The routing domain used to resolve traffic through the private endpoint.

        • privateEndpointOverrides (list) –

          Per-domain private endpoint overrides that route specific identity provider domains through distinct private endpoints.

          • (dict) –

            A mapping of a domain to the private endpoint used to reach it.

            • domain (string) – [REQUIRED]

              The domain name to which this private endpoint override applies.

            • privateEndpoint (dict) – [REQUIRED]

              The private endpoint used to reach the specified domain.

              Note

              This is a Tagged Union structure. Only one of the following top level keys can be set: selfManagedLatticeResource, managedVpcResource.

              • selfManagedLatticeResource (dict) –

                A private endpoint backed by a self-managed VPC Lattice resource configuration.

                Note

                This is a Tagged Union structure. Only one of the following top level keys can be set: resourceConfigurationIdentifier.

                • resourceConfigurationIdentifier (string) –

                  The identifier of the VPC Lattice resource configuration, specified as a resource configuration ID or ARN.

              • managedVpcResource (dict) –

                A private endpoint backed by a service-managed VPC resource.

                • vpcIdentifier (string) – [REQUIRED]

                  The identifier of the VPC in which the private endpoint is provisioned.

                • subnetIds (list) – [REQUIRED]

                  The identifiers of the subnets in which the private endpoint network interfaces are placed.

                  • (string) –

                    Subnet identifier

                • endpointIpAddressType (string) – [REQUIRED]

                  The IP address type used by the private endpoint, either IPV4 or IPV6.

                • securityGroupIds (list) –

                  The identifiers of the security groups associated with the private endpoint network interfaces.

                  • (string) –

                    The identifier of a security group.

                • tags (dict) –

                  The tags applied to the service-managed VPC resource.

                  • (string) –

                    Key of a tag.

                    • (string) –

                      Value of a tag.

                • routingDomain (string) –

                  The routing domain used to resolve traffic through the private endpoint.

    • authorizerType (string) –

      The type of authorizer that controls how consumers access the registry’s search and MCP invoke operations.

  • clientToken (string) –

    A unique, case-sensitive identifier to ensure that the operation completes no more than one time. If this token matches a previous request, the service ignores the request, but does not return an error.

    This field is autopopulated if not provided.

  • tags (dict) –

    Tags to associate with the registry

    • (string) –

      Key of a tag.

      • (string) –

        Value of a tag.

  • approvalConfiguration (dict) –

    Approval configuration for registry records

    • autoApprovalRules (list) –

      The rules that determine which registry records are automatically approved on submission. When omitted or empty, submitted records require manual review.

      • (string) –

  • autoDetectionConfiguration (dict) –

    The optional auto-detection configuration for the registry. When provided, the registry is automatically populated with resources discovered according to the configuration. Omit this field for registries whose records are managed exclusively through the Agent Registry Control API.

    • scope (string) – [REQUIRED]

      The source from which resources are detected. For example, ORGANIZATION sources resources from all member accounts of an Amazon Web Services organization.

    • enabled (boolean) – [REQUIRED]

      Specifies whether auto-detection is requested for the registry. Setting this to true is necessary but not sufficient for auto-detection to become active; the preconditions of the configured scope must also be met.

Return type:

dict

Returns:

Response Syntax

{
    'registryArn': 'string'
}

Response Structure

  • (dict) –

    Response structure for creating a registry

    • registryArn (string) –

      The ARN of the created registry

Exceptions