Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.
Prasyarat
AWS Agen Registry telah diluncurkan di bawah agent-registry namespace baru. Dukungan untuk bedrock-agentcore namespace pratinjau publik akan dihentikan pada 17 September 2026. Untuk petunjuk migrasi, lihat Panduan migrasi registri komprehensif.
Sebelum Anda menggunakan AWS Agen Registry, lengkapi prasyarat berikut.
AWS akun dan kredenSIAL
Anda memerlukan AWS akun dengan kredenSIAL yang dikonfigurasi. Untuk mengkonfigurasi kredenSIAL, instal dan gunakan AWS Command Line Interface dengan mengikuti langkah-langkah di Mem ulai dengan AWS CLI.
# Verify installation
aws --version # Should show version 2.
Python dan AWS SDK
Untuk mengakses AWS kredensional Anda dan mengonfigurasinya untuk digunakan dengan SDK, ikuti langkah-langkah di Menggunakan Pusat Identitas IAM untuk mengotentikasi AWS SDK dan Alat. Jika Anda berencana menggunakan AWS Python SDK (Boto3) untuk berinteraksi dengan AWS Agen Registry secara terprogram:
-
Instal Python 3.10+.
-
Instal AWS SDK: pip install boto3
-
Verifikasi kredenSIAL Anda telah dikonfigurasi: aws sts get-caller-identity
Silakan merujuk ke AWS Builder Tools untuk informasi lebih lanjut tentang cara mengatur dan menggunakan AWS SDK.
Izin IAM
Siapkan izin IAM berdasarkan persona yang cocok dengan peran Anda. Daftar lengkap Izin IAM untuk Registri dapat ditemukan di Izin IAM.
Izin administrator
Untuk administrator yang mengelola siklus hidup penuh registri, catatan, dan catatan approve/reject /deprecate:
contoh
- AWS Agent Registry namespace
-
{
"Version": "2012-10-17",
"Statement":
[
{
"Sid": "AllowCreatingAndListingRegistries",
"Effect": "Allow",
"Action":
[
"agent-registry:CreateRegistry",
"agent-registry:ListRegistries"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:*"
]
},
{
"Sid": "AllowGetUpdateDeleteRegistry",
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistry",
"agent-registry:UpdateRegistry",
"agent-registry:DeleteRegistry"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:registry/*"
]
},
{
"Sid": "AllowCreatingAndListingRecords",
"Effect": "Allow",
"Action":
[
"agent-registry:CreateRegistryRecord",
"agent-registry:ListRegistryRecords"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:registry/*"
]
},
{
"Sid": "AllowRecordLevelOperations",
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistryRecord",
"agent-registry:UpdateRegistryRecord",
"agent-registry:DeleteRegistryRecord",
"agent-registry:SubmitRegistryRecordForApproval"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:registry/*/record/*"
]
},
{
"Sid": "AllowApproveRejectDeprecateRecords",
"Effect": "Allow",
"Action":
[
"agent-registry:UpdateRegistryRecordStatus"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:registry/*/record/*"
]
},
{
"Sid": "AdditionalPermissionForRegistryManagedWorkloadIdentity",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:*WorkloadIdentity"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/default/*"
]
},
{
"Sid": "AllowPermissionForCreatingServiceLinkedRole",
"Effect": "Allow",
"Action":
[
"iam:CreateServiceLinkedRole"
],
"Resource":
[
"arn:aws:iam::*:role/aws-service-role/agent-registry.amazonaws.com/AWSServiceRoleForAgentRegistry"
],
"Condition":
{
"StringLike": { "iam:AWSServiceName": "agent-registry.amazonaws.com" }
}
}
]
}
- Amazon Bedrock AgentCore namespace (to be deprecated)
-
{
"Version": "2012-10-17",
"Statement":
[
{
"Sid": "AllowCreatingAndListingRegistries",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:CreateRegistry",
"bedrock-agentcore:ListRegistries"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:*"
]
},
{
"Sid": "AllowGetUpdateDeleteRegistry",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistry",
"bedrock-agentcore:UpdateRegistry",
"bedrock-agentcore:DeleteRegistry"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:registry/*"
]
},
{
"Sid": "AllowCreatingAndListingRecords",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:CreateRegistryRecord",
"bedrock-agentcore:ListRegistryRecords"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:registry/*"
]
},
{
"Sid": "AllowRecordLevelOperations",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistryRecord",
"bedrock-agentcore:UpdateRegistryRecord",
"bedrock-agentcore:DeleteRegistryRecord",
"bedrock-agentcore:SubmitRegistryRecordForApproval"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
]
},
{
"Sid": "AllowApproveRejectDeprecateRecords",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:UpdateRegistryRecordStatus"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
]
},
{
"Sid": "AdditionalPermissionForRegistryManagedWorkloadIdentity",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:*WorkloadIdentity"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/default/*"
]
},
{
"Sid": "AllowPermissionForCreatingServiceLinkedRole",
"Effect": "Allow",
"Action":
[
"iam:CreateServiceLinkedRole"
],
"Resource":
[
"arn:aws:iam::*:role/aws-service-role/agent-registry.amazonaws.com/AWSServiceRoleForAgentRegistry"
],
"Condition":
{
"StringLike": { "iam:AWSServiceName": "agent-registry.amazonaws.com" }
}
}
]
}
Izin Kurator/Penyetujui
Untuk kurator yang meninjau dan approve/reject mencatat tetapi tidak melakukan operasi administratif:
contoh
- AWS Agent Registry namespace
-
{
"Version": "2012-10-17",
"Statement":
[
{
"Effect": "Allow",
"Action":
[
"agent-registry:ListRegistries"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistry"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:ListRegistryRecords"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistryRecord"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:registry/*/record/*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:UpdateRegistryRecordStatus"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:registry/*/record/*"
]
}
]
}
- Amazon Bedrock AgentCore namespace (to be deprecated)
-
{
"Version": "2012-10-17",
"Statement":
[
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:ListRegistries"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistry"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:ListRegistryRecords"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistryRecord"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:UpdateRegistryRecordStatus"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
]
}
]
}
Izin penerbit
Untuk penerbit yang mengirimkan server MCP, agen, atau sumber daya lainnya ke registri:
Tiga pernyataan terkait sinkronisasi (AllowWorkloadIdentityForSynchronization,AllowGetResourceOauth2TokenForOauthBasedSynchronization,AllowPassRoleForIamBasedSynchronization) mengotorisasi identitas beban kerja dan sumber daya penyedia kredensia OAuth yang dikelola oleh Identity. AgentCore Sumber daya tersebut sengaja tetap berada di bawah bedrock-agentcore namespace, sehingga tindakan, ARN, dan prinsipal layanan mereka tidak berubah.
Lingkup AllowGetResourceOauth2TokenForOauthBasedSynchronization pernyataan ke penyedia kredensia OAuth spesifik ARN yang token aksesnya dibutuhkan identitas ini. Hindari wildcard di segmen penyedia ARN — pola seperti token-vault/
atau token-vault/default/oauth2credentialprovider/ berikan akses ke setiap penyedia kredensia OAuth di akun, yang dapat mengaktifkan akses kredensi lintas tim. Ikuti prinsip hak istimewa paling sedikit dengan menamai penyedia tertentu di Resource lapangan, misalnyaarn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/oauth2credentialprovider/<oauthProviderName>.
contoh
- AWS Agent Registry namespace
-
{
"Version": "2012-10-17",
"Statement":
[
{
"Effect": "Allow",
"Action":
[
"agent-registry:ListRegistries"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistry"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:CreateRegistryRecord",
"agent-registry:ListRegistryRecords"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistryRecord",
"agent-registry:UpdateRegistryRecord",
"agent-registry:DeleteRegistryRecord",
"agent-registry:SubmitRegistryRecordForApproval"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:registry/*/record/*"
]
},
{
"Sid": "AllowWorkloadIdentityForSynchronization",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetWorkloadAccessToken"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/*"
]
},
{
"Sid": "AllowGetResourceOauth2TokenForOauthBasedSynchronization",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetResourceOauth2Token"
],
"Resource":
[
"arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/oauth2credentialprovider/<oauthProviderName>"
]
},
{
"Sid": "AllowPassRoleForIamBasedSynchronization",
"Effect": "Allow",
"Action":
[
"iam:PassRole"
],
"Resource":
[
"arn:aws:iam::<account>:role/<your-sync-role-name>"
],
"Condition":
{
"StringEquals":
{
"iam:PassedToService": "bedrock-agentcore.amazonaws.com"
},
"StringLike":
{
"iam:AssociatedResourceARN": "arn:aws:bedrock-agentcore:<region>:<account>:registry/*/record/*"
}
}
}
]
}
- Amazon Bedrock AgentCore namespace (to be deprecated)
-
{
"Version": "2012-10-17",
"Statement":
[
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:ListRegistries"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistry"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:CreateRegistryRecord",
"bedrock-agentcore:ListRegistryRecords"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistryRecord",
"bedrock-agentcore:UpdateRegistryRecord",
"bedrock-agentcore:DeleteRegistryRecord",
"bedrock-agentcore:SubmitRegistryRecordForApproval"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
]
},
{
"Sid": "AllowWorkloadIdentityForSynchronization",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetWorkloadAccessToken"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/*"
]
},
{
"Sid": "AllowGetResourceOauth2TokenForOauthBasedSynchronization",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetResourceOauth2Token"
],
"Resource":
[
"arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/oauth2credentialprovider/<oauthProviderName>"
]
},
{
"Sid": "AllowPassRoleForIamBasedSynchronization",
"Effect": "Allow",
"Action":
[
"iam:PassRole"
],
"Resource":
[
"arn:aws:iam::<account>:role/<your-sync-role-name>"
],
"Condition":
{
"StringEquals":
{
"iam:PassedToService": "bedrock-agentcore.amazonaws.com"
},
"StringLike":
{
"iam:AssociatedResourceARN": "arn:aws:bedrock-agentcore:<region>:<account>:registry/*/record/*"
}
}
}
]
}
Izin konsumen
Untuk konsumen yang mencari dan menggunakan sumber daya yang disetujui:
contoh
- AWS Agent Registry namespace
-
{
"Version": "2012-10-17",
"Statement":
[
{
"Effect": "Allow",
"Action":
[
"agent-registry:ListRegistries"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistry"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:SearchDiscoverableRegistryRecords",
"agent-registry:ListDiscoverableRegistryRecords",
"agent-registry:GetDiscoverableRegistryRecord",
"agent-registry:InvokeRegistryMcp"
],
"Resource":
[
"arn:aws:agent-registry:*:<account>:registry/*"
]
}
]
}
- Amazon Bedrock AgentCore namespace (to be deprecated)
-
{
"Version": "2012-10-17",
"Statement":
[
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:ListRegistries"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistry"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:SearchRegistryRecords",
"bedrock-agentcore:InvokeRegistryMcp"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*:<account>:registry/*"
]
}
]
}
Misalnya kebijakan IAM, lihat Identitas dan manajemen akses untuk Amazon Bed AgentCore rock.
(Opsional) Penyedia identitas untuk otorisasi JWT
Jika Anda berencana menggunakan otorisasi JWT untuk identitas masuk (untuk memungkinkan konsumen mencari registri menggunakan Non-IAM identitas), siapkan Amazon Cognito atau penyedia identitas Anda sendiri sebelum membuat registri:
-
Buat Kumpulan Pengguna Cognito (atau gunakan penyedia identitas Anda yang ada)
-
Daftarkan Klien Aplikasi dan catat ID Klien
-
Buat pengguna uji dengan nama pengguna dan kata sandi
Untuk petunjuk terperinci, lihat Meng onfigurasi otorisasi JWT masuk.
