View a markdown version of this page

Set up a gateway with a Memory connector target - Amazon Bedrock AgentCore

Set up a gateway with a Memory connector target

To front a Memory resource with a gateway, you create a gateway with an inbound authorizer, then add a target that uses the agentcore-memory connector.

Note

You can set up the Memory connector through the AWS SDK and AWS Command Line Interface (AWS CLI).

Prerequisites

  • An AgentCore Memory resource. For more information, see Create an AgentCore Memory.

  • Permissions to create and configure an AgentCore Gateway. For more information, see Prerequisites for using the Amazon Bedrock AgentCore gateway service.

  • Depending on the outbound credential mode (see Outbound credential mode): for GATEWAY_IAM_ROLE, a gateway execution role that the gateway assumes to call Memory, with its identity policy scoped to only the Memory actions the gateway needs; for CALLER_IAM_CREDENTIALS, the caller’s own IAM identity must be permitted to perform the Memory actions, because the gateway forwards that identity to Memory.

Steps

The following steps use the AWS CLI. For the input and output shapes of each API operation, follow the links to the Amazon Bedrock AgentCore Control API Reference. Replace the example names, memoryId, and role ARN with your own values.

  1. Create a gateway with CreateGateway and choose its inbound authorizer type (authorizerType). The authorizer determines how callers authenticate to the gateway and which identity information is available to access-control policies. For more information, see Inbound and outbound authentication modes.

    The following example creates a gateway that authenticates end users with OAuth (CUSTOM_JWT) — the primary fine-grained access control path. Provide your OpenID Connect provider’s discovery URL and allowed client ids.

    aws bedrock-agentcore-control create-gateway \
  --name my-memory-gateway \
  --role-arn arn:aws:iam::123456789012:role/my-gateway-execution-role \
  --authorizer-type CUSTOM_JWT \
  --authorizer-configuration '{
    "customJWTAuthorizer": {
      "discoveryUrl": "https://your-idp.example.com/.well-known/openid-configuration",
      "allowedClients": ["your-client-id"]
    }
  }'

    The response includes the gatewayId, gatewayArn, and the invocation gatewayUrl. Creation is asynchronous; use GetGateway to wait until the gateway’s status is READY.

    Note

    This example uses OAuth inbound, which always uses the GATEWAY_IAM_ROLE outbound credential mode. The --role-arn value is the gateway execution role that the gateway uses to call Memory. For other inbound types and outbound modes, see Inbound and outbound authentication modes.

  2. Add a target to the gateway with CreateGatewayTarget, using the agentcore-memory connector as the target configuration. For --gateway-identifier, use the gatewayId returned by CreateGateway in the previous step. Supply the connector id and the memoryId of the Memory resource to front. The target’s credentialProviderConfigurations set the outbound credential mode; with OAuth inbound this is GATEWAY_IAM_ROLE.

    aws bedrock-agentcore-control create-gateway-target \
  --gateway-identifier <gateway-id> \
  --name my-memory \
  --target-configuration '{
    "http": {
      "connector": {
        "source": { "connectorId": "agentcore-memory" },
        "parameters": { "memoryId": "your-memory-id" }
      }
    }
  }' \
  --credential-provider-configurations '[
    { "credentialProviderType": "GATEWAY_IAM_ROLE" }
  ]'

    Target creation is asynchronous; use GetGatewayTarget to wait until the target’s status is READY. The target name (my-memory here) becomes the prefix of every Cedar action id for this target.

  3. Attach a policy engine and add fine-grained access control policies. This step is what enforces per-caller isolation. For the full procedure and Memory-specific policy examples, see Fine-grained access control for Memory.

Note

The name you give the target becomes part of every Cedar action id for that target — a target named <target-name> produces action ids that begin with <target-name>___. Choose a target name you are comfortable referencing in access-control policies.