View a markdown version of this page

先决条件 - 亚马逊基岩 AgentCore
AWS 账户和证书Python 和 AWS SDKIAM 权限（可选）JWT 授权的身份提供商

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

先决条件

迁移现已开放

AWS 代理注册表已在新agent-registry命名空间下启动。对公共预览bedrock-agentcore命名空间的支持将于 2026 年 9 月 17 日停止。有关迁移说明，请参阅综合注册表迁移指南。

在使用 AWS 代理注册表之前，请完成以下先决条件。

AWS 账户和证书

您需要一个配置了凭据的 AWS 账户。要配置凭证，请按照 AWS CLI 入门中的步骤安装和使用 AWS 命令行界面。

# Verify installation
aws --version  # Should show version 2.

Python 和 AWS SDK

要访问您的 AWS 证书并将其配置为与 SD AWS K 一起使用，请按照使用 IAM 身份中心对软件开发工具包和工具进行身份验证中的步骤进行操作。如果你计划使用 AWS Python SDK (Boto3) 以编程方式与 AWS 代理注册表交互：

  1. 安装 Python 3.10+ 。

  2. 安装 S AWS DK：pip install boto3

  3. 验证您的证书是否已配置：aws sts get-caller-identity

有关如何设置和使用 AWS SDK 的更多信息，请参阅AWS 生成器工具。

IAM 权限

根据与您的角色匹配的角色设置 IAM 权限。注册机构的 IAM 权限的完整列表可以在 IAM 权限中找到。

管理员权限

对于管理注册表、记录和 approve/reject /deprecate 记录的完整生命周期的管理员：

例
AWS Agent Registry namespace
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Sid": "AllowCreatingAndListingRegistries",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:CreateRegistry",
                "agent-registry:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:*"
            ]
        },
        {
            "Sid": "AllowGetUpdateDeleteRegistry",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistry",
                "agent-registry:UpdateRegistry",
                "agent-registry:DeleteRegistry"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Sid": "AllowCreatingAndListingRecords",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:CreateRegistryRecord",
                "agent-registry:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Sid": "AllowRecordLevelOperations",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistryRecord",
                "agent-registry:UpdateRegistryRecord",
                "agent-registry:DeleteRegistryRecord",
                "agent-registry:SubmitRegistryRecordForApproval"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AllowApproveRejectDeprecateRecords",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:UpdateRegistryRecordStatus"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AdditionalPermissionForRegistryManagedWorkloadIdentity",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:*WorkloadIdentity"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/default/*"
            ]
        },
        {
            "Sid": "AllowPermissionForCreatingServiceLinkedRole",
            "Effect": "Allow",
            "Action":
            [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource":
            [
                "arn:aws:iam::*:role/aws-service-role/agent-registry.amazonaws.com/AWSServiceRoleForAgentRegistry"
            ],
            "Condition":
            {
                "StringLike": { "iam:AWSServiceName": "agent-registry.amazonaws.com" }
            }
        }
    ]
}
Amazon Bedrock AgentCore namespace (to be deprecated)
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Sid": "AllowCreatingAndListingRegistries",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:CreateRegistry",
                "bedrock-agentcore:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:*"
            ]
        },
        {
            "Sid": "AllowGetUpdateDeleteRegistry",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistry",
                "bedrock-agentcore:UpdateRegistry",
                "bedrock-agentcore:DeleteRegistry"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Sid": "AllowCreatingAndListingRecords",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:CreateRegistryRecord",
                "bedrock-agentcore:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Sid": "AllowRecordLevelOperations",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistryRecord",
                "bedrock-agentcore:UpdateRegistryRecord",
                "bedrock-agentcore:DeleteRegistryRecord",
                "bedrock-agentcore:SubmitRegistryRecordForApproval"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AllowApproveRejectDeprecateRecords",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:UpdateRegistryRecordStatus"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AdditionalPermissionForRegistryManagedWorkloadIdentity",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:*WorkloadIdentity"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/default/*"
            ]
        },
        {
            "Sid": "AllowPermissionForCreatingServiceLinkedRole",
            "Effect": "Allow",
            "Action":
            [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource":
            [
                "arn:aws:iam::*:role/aws-service-role/agent-registry.amazonaws.com/AWSServiceRoleForAgentRegistry"
            ],
            "Condition":
            {
                "StringLike": { "iam:AWSServiceName": "agent-registry.amazonaws.com" }
            }
        }
    ]
}

策展人/批准者权限

对于审查和 approve/reject 记录但不执行管理操作的策展人：

例
AWS Agent Registry namespace
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistryRecord"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:UpdateRegistryRecordStatus"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        }
    ]
}
Amazon Bedrock AgentCore namespace (to be deprecated)
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistryRecord"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:UpdateRegistryRecordStatus"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        }
    ]
}

发布者权限

对于向注册表提交 MCP 服务器、代理或其他资源的发布商：

注意

三个与同步相关的语句（AllowWorkloadIdentityForSynchronization、AllowGetResourceOauth2TokenForOauthBasedSynchronization、AllowPassRoleForIamBasedSynchronization）授权工作负载身份和由 Identity 管理的 OAuth 凭证提供者资源。 AgentCore 这些资源故意保留在bedrock-agentcore命名空间下，因此它们的操作、ARN 和服务主体不会改变。

注意

将AllowGetResourceOauth2TokenForOauthBasedSynchronization声明范围限定为特定 OAuth 凭证提供商 ARN，该身份需要其访问令牌。避免在 ARN 的提供商部分使用通配符——例如token-vault/ 或向账户中的每个 OAuth 凭证提供商token-vault/default/oauth2credentialprovider/授予访问权限，这样可以启用跨团队的凭据访问。例如，遵循最小权限原则，在Resource字段中命名特定的提供商arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/oauth2credentialprovider/<oauthProviderName>。

例
AWS Agent Registry namespace
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:CreateRegistryRecord",
                "agent-registry:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistryRecord",
                "agent-registry:UpdateRegistryRecord",
                "agent-registry:DeleteRegistryRecord",
                "agent-registry:SubmitRegistryRecordForApproval"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AllowWorkloadIdentityForSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetWorkloadAccessToken"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/*"
            ]
        },
        {
            "Sid": "AllowGetResourceOauth2TokenForOauthBasedSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetResourceOauth2Token"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/oauth2credentialprovider/<oauthProviderName>"
            ]
        },
        {
            "Sid": "AllowPassRoleForIamBasedSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "iam:PassRole"
            ],
            "Resource":
            [
                "arn:aws:iam::<account>:role/<your-sync-role-name>"
            ],
            "Condition":
            {
                "StringEquals":
                {
                    "iam:PassedToService": "bedrock-agentcore.amazonaws.com"
                },
                "StringLike":
                {
                    "iam:AssociatedResourceARN": "arn:aws:bedrock-agentcore:<region>:<account>:registry/*/record/*"
                }
            }
        }
    ]
}
Amazon Bedrock AgentCore namespace (to be deprecated)
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:CreateRegistryRecord",
                "bedrock-agentcore:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistryRecord",
                "bedrock-agentcore:UpdateRegistryRecord",
                "bedrock-agentcore:DeleteRegistryRecord",
                "bedrock-agentcore:SubmitRegistryRecordForApproval"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AllowWorkloadIdentityForSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetWorkloadAccessToken"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/*"
            ]
        },
        {
            "Sid": "AllowGetResourceOauth2TokenForOauthBasedSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetResourceOauth2Token"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/oauth2credentialprovider/<oauthProviderName>"
            ]
        },
        {
            "Sid": "AllowPassRoleForIamBasedSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "iam:PassRole"
            ],
            "Resource":
            [
                "arn:aws:iam::<account>:role/<your-sync-role-name>"
            ],
            "Condition":
            {
                "StringEquals":
                {
                    "iam:PassedToService": "bedrock-agentcore.amazonaws.com"
                },
                "StringLike":
                {
                    "iam:AssociatedResourceARN": "arn:aws:bedrock-agentcore:<region>:<account>:registry/*/record/*"
                }
            }
        }
    ]
}

使用者权限

对于搜索和使用经批准的资源的消费者：

例
AWS Agent Registry namespace
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:SearchDiscoverableRegistryRecords",
                "agent-registry:ListDiscoverableRegistryRecords",
                "agent-registry:GetDiscoverableRegistryRecord",
                "agent-registry:InvokeRegistryMcp"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        }
    ]
}
Amazon Bedrock AgentCore namespace (to be deprecated)
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:SearchRegistryRecords",
                "bedrock-agentcore:InvokeRegistryMcp"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        }
    ]
}

例如 IAM 政策，请参阅亚马逊 Bedrock AgentCore 的身份和访问管理。

（可选）JWT 授权的身份提供商

如果您计划使用 JWT 授权获取入站身份（使消费者能够使用 Non-IAM 身份搜索注册表），请在创建注册表之前设置 Amazon Cognito 或您自己的身份提供商：

  1. 创建 Cognito 用户池（或使用您现有的身份提供商）

  2. 注册应用程序客户端并记下客户端 ID

  3. 使用用户名和密码创建测试用户

有关详细说明，请参阅配置入站 JWT 授权器。