View a markdown version of this page

Descripción de los eventos de Amazon Bedrock AgentCore Gateway CloudTrail - Amazon Bedrock AgentCore
InvokeGateway evento de datos con error de autenticaciónEl evento de InvokeGateway datos se realizó correctamenteEvento de administración

Descripción de los eventos de Amazon Bedrock AgentCore Gateway CloudTrail

Un rastro es una configuración que permite la entrega de eventos como archivos de registro a un bucket de Amazon S3 que usted especifique. CloudTrail Los archivos de registro contienen una o más entradas de registro. Un evento representa una solicitud única de cualquier fuente e incluye información como la acción solicitada, la fecha y hora de la acción y los parámetros de la solicitud.

nota

El contenido de las solicitudes y respuestas de los eventos de datos está redactado y las afirmaciones sobre el JSON Web Token (JWT) incluyen entidades HTML saneadas por motivos de seguridad.

nota

En el caso de los eventos de administración, solo se pueden redactar los parámetros de solicitud definidos por la API de Gateway. Todos los campos adicionales que incluyas en una solicitud y que no formen parte de la API se registran CloudTrail exactamente como los enviaste y no se redactan. No incluyas contraseñas ni otra información confidencial en los campos que no formen parte de la API.

En las siguientes secciones se muestran ejemplos de CloudTrail eventos:

InvokeGateway evento de datos con error de autenticación

El siguiente ejemplo muestra una entrada de CloudTrail registro que demuestra la InvokeGateway acción con un error de autenticación. El error de autenticación se puede ver en el body campo deresponseElements.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AWSAccount",
    "principalId": "",
    "accountId": "anonymous"
  },
  "eventTime": "2025-07-14T02:14:42Z",
  "eventSource": "bedrock-agentcore.amazonaws.com",
  "eventName": "InvokeGateway",
  "awsRegion": "us-west-2",
  "sourceIPAddress": "34.XXX.XXX.206",
  "userAgent": "python-httpx/0.28.1",
  "requestParameters": {
    "body": {
      "id": 0,
      "method": "initialize",
      "params": {
        "clientInfo": {
          "name": "mcp",
          "version": "0.1.0"
        },
        "protocolVersion": "2025-06-18",
        "capabilities": {}
      },
      "jsonrpc": "2.0"
    }
  },
  "responseElements": {
    "body": {
      "jsonrpc": "2.0",
      "id": 0,
      "error": {
        "code": -32001,
        "message": "Invalid Bearer token"
      }
    },
    "contentType": "application/json",
    "statusCode": 401
  },
  "requestID": "1234abcd-12ab-34cd-56ef-1234567890ab",
  "eventID": "12345678-1234-5678-9abc-123456789012",
  "readOnly": false,
  "resources": [
    {
      "accountId": "XXXXXXXXXX",
      "type": "AWS::BedrockAgentCore::Gateway",
      "ARN": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXX:gateway/test-openapi-gateway-b24f8c26-u9p3rjw8qw"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "XXXXXXXXXX",
  "sharedEventID": "12345678-xxxx-xxxx-xxxx-123456789012",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.2",
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "test-openapi-gateway-xxxxxxx-u9p3rjw8qw.gateway.bedrock-agentcore.us-west-2.amazonaws.com"
  }
}

El evento de InvokeGateway datos se realizó correctamente

En el siguiente ejemplo, se muestra una entrada de CloudTrail registro para una InvokeGateway acción correcta:

{
      "eventVersion": "1.11",
      "userIdentity": {
        "type": "AWSAccount",
        "principalId": "",
        "accountId": "anonymous"
      },
      "eventTime": "2025-07-14T02:14:42Z",
      "eventSource": "bedrock-agentcore.amazonaws.com",
      "eventName": "InvokeGateway",
      "awsRegion": "us-west-2",
      "sourceIPAddress": "35.88.103.184",
      "userAgent": "python-httpx/0.28.1",
      "requestParameters": {
        "body": {
          "id": 1,
          "method": "tools/call",
          "params": {
            "name": "SmithyTarget___ListTables",
            "arguments": "REDACTED"
          },
          "jsonrpc": "2.0"
        }
      },
      "responseElements": {
        "body": {
          "jsonrpc": "2.0",
          "id": 1,
          "result": {
            "isError": false,
            "content": "REDACTED"
          }
        },
        "contentType": "application/json",
        "statusCode": 200
      },
      "additionalEventData": {
        "targetId": "0JTXXX4YMA",
        "jwt": {
          "headers": {
            "kid": "hGrcJwz5MX6hNeuL6jdXE4hjK7sT6oj+yN7kN+arRv4=",
            "alg": "RS256"
          },
          "claims": {
            "sub": "4ammgxxxxxxxxxxxm3b8c",
            "token_use": "access",
            "scope": "python-cognito-resource-server-id/write python-cognito-resource-server-id/read",
            "auth_time": 1752459276,
            "iss": "https://cognito-idp.us-west-2.amazonaws.com/us-west-2_Fxxxxxhtq",
            "exp": 1752462876,
            "iat": 1752459276,
            "version": 2,
            "jti": "1234abcd-12ab-34cd-56ef-1234567890ab"
          },
          "type": "JWS"
        },
        "downstreamRequestIds": [
          "H3RDH6T03DG10996U0M2P1V1IFVV4KQNSO5AEMVJF66Q9ASUAAJG"
        ]
      },
      "requestID": "1234abcd-12ab-34cd-56ef-1234567890ab",
      "eventID": "12345678-1234-5678-9abc-123456789012",
      "readOnly": false,
      "resources": [
        {
          "accountId": "XXXXXXXXXX",
          "type": "AWS::BedrockAgentCore::Gateway",
          "ARN": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXX:gateway/test-gateway-65129e91-mtzoadyihf"
        }
      ],
      "eventType": "AwsApiCall",
      "managementEvent": false,
      "recipientAccountId": "XXXXXXXXXX",
      "sharedEventID": "1234abcd-12ab-34cd-56ef-1234567890ab",
      "eventCategory": "Data",
      "tlsDetails": {
        "tlsVersion": "TLSv1.2",
        "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
        "clientProvidedHostHeader": "test-gateway-65129e91-xxxxxxxx.gateway.bedrock-agentcore.us-west-2.amazonaws.com"
      }
    }

Evento de administración

El siguiente ejemplo muestra una entrada de CloudTrail registro para un evento de administración:

{
  "eventVersion": "1.09",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROXXXXXXXXXXXXNRD7D:xxxxx",
    "arn": "arn:aws:sts::XXXXXXXXXXXX:assumed-role/HydraInvocationRole-xxxxxxxxx/xxxx",
    "accountId": "XXXXXXXXXXXX",
    "accessKeyId": "xxxxxxxxx",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "xxxxxxxx",
        "arn": "arn:aws:iam::XXXXXXXXXXXX:role/HydraInvocationRole-xxx",
        "accountId": "XXXXXXXXXXXX",
        "userName": "HydraInvocationRole-xxxxx"
      },
      "attributes": {
        "creationDate": "2025-07-14T02:42:43Z",
        "mfaAuthenticated": "false"
      }
    },
    "invokedBy": "bedrock-agentcore.amazonaws.com"
  },
  "eventTime": "2025-07-14T02:47:38Z",
  "eventSource": "bedrock-agentcore.amazonaws.com",
  "eventName": "CreateGateway",
  "awsRegion": "us-west-2",
  "sourceIPAddress": "bedrock-agentcore.amazonaws.com",
  "userAgent": "bedrock-agentcore.amazonaws.com",
  "requestParameters": {
    "roleArn": "arn:aws:iam::XXXXXXXXXXXX:role/PythonGenesisTestGatewayRole",
    "name": "***",
    "authorizerConfiguration": {
      "customJWTAuthorizer": {
        "allowedClients": [
          "xxxxxxxxx"
        ],
        "discoveryUrl": "https://cognito-idp.us-west-2.amazonaws.com/us-west-2_xxxxx/.well-known/openid-configuration"
      }
    },
    "description": "***",
    "protocolType": "MCP",
    "authorizerType": "CUSTOM_JWT"
  },
  "responseElements": {
    "authorizerConfiguration": {
      "customJWTAuthorizer": {
        "allowedClients": [
          "xxxxxxxxxxxxxxx"
        ],
        "discoveryUrl": "https://cognito-idp.us-west-2.amazonaws.com/us-west-2_xxxxxx/.well-known/openid-configuration"
      }
    },
    "description": "***",
    "protocolType": "MCP",
    "gatewayArn": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXXXX:gateway/test-openapi-gateway-xxxxxxx-xxxxxx",
    "workloadIdentityDetails": {
      "workloadIdentityArn": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXXXX:workload-identity-directory/default/workload-identity/test-openapi-gateway-xxxxxx-xxxxx"
    },
    "createdAt": "2025-07-14T02:47:38.302834063Z",
    "gatewayUrl": "https://test-openapi-gateway-xxxxxxx-8fb4mo6pqx.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp",
    "roleArn": "arn:aws:iam::XXXXXXXXXXXX:role/PythonGenesisTestGatewayRole",
    "name": "***",
    "authorizerType": "CUSTOM_JWT",
    "gatewayId": "test-openapi-gateway-9c8f7109-8fb4mo6pqx",
    "status": "CREATING",
    "updatedAt": "2025-07-14T02:47:38.302845797Z"
  },
  "requestID": "0fb99b0b-a4d1-xxxx-8aee-c703adaa6bd9",
  "eventID": "b12bf859-xxxx-48d7-952a-d5c6ec00fb68",
  "readOnly": false,
  "resources": [
    {
      "accountId": "XXXXXXXXXXXX",
      "type": "AWS::BedrockAgentCore::Gateway",
      "ARN": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXXXX:gateway/test-openapi-gateway-xxxxxxx-8fb4mo6pqx"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "XXXXXXXXXXXX",
  "eventCategory": "Management"
}