先决条件
即将进行的命名空间迁移
AWS Agent Registry 目前在 bedrock-agentcore 命名空间下处于公开预览状态。从 2026 年 8 月 6 日起，该服务将移至代理注册表命名空间。如果您使用 AWS 代理注册表，则必须更新您的终端节点、IAM 策略、SDK 客户端、CLI 脚本和注册表数据。有关从公共预览版迁移的更多信息，请参阅注册表迁移综合指南。
在使用 AWS Agent Registry 之前，请完成以下先决条件。
AWS 账户和凭证
您需要一个配置了凭据的 AWS 账户。要配置凭据，请按照 AWS CLI 入门中的步骤安装和使用 AWS 命令行界面。
# Verify installation aws --version # Should show version 2.
Python 和 AWS SDK
要访问您的 AWS 证书并将其配置为与软件开发工具包一起使用，请按照使用 IAM Identity Center 对 AWS SDK 和工具进行身份验证中的步骤进行操作。如果你打算使用 AWS Python SDK (Boto3) 以编程方式与 AWS 代理注册表进行交互：
-
安装 Python 3.10+。
-
安装 AWS 软件开发工具包：
pip install boto3 -
验证您的凭证是否已配置：
aws sts get-caller-identity
有关如何设置和使用 AWS SDK 的更多信息，请参阅AWS 生成器工具
IAM 权限
根据与您的角色相匹配的角色设置 IAM 权限。IAM 注册表权限的完整列表可在 IAM 权限中找到。
管理员权限
对于管理注册表、记录和 approve/reject /deprecate 记录的整个生命周期的管理员：
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCreatingAndListingRegistries", "Effect": "Allow", "Action": [ "bedrock-agentcore:CreateRegistry", "bedrock-agentcore:ListRegistries" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:*" ] }, { "Sid": "AllowGetUpdateDeleteRegistry", "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistry", "bedrock-agentcore:UpdateRegistry", "bedrock-agentcore:DeleteRegistry" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Sid": "AllowCreatingAndListingRecords", "Effect": "Allow", "Action": [ "bedrock-agentcore:CreateRegistryRecord", "bedrock-agentcore:ListRegistryRecords" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Sid": "AllowRecordLevelOperations", "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistryRecord", "bedrock-agentcore:UpdateRegistryRecord", "bedrock-agentcore:DeleteRegistryRecord", "bedrock-agentcore:SubmitRegistryRecordForApproval" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*" ] }, { "Sid": "AllowApproveRejectDeprecateRecords", "Effect": "Allow", "Action": [ "bedrock-agentcore:UpdateRegistryRecordStatus" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*" ] }, { "Sid": "AdditionalPermissionForRegistryManagedWorkloadIdentity", "Effect": "Allow", "Action": [ "bedrock-agentcore:*WorkloadIdentity" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/default/*" ] } ] }
策展人/批准者权限
对于审阅和 approve/reject 记录但不执行管理操作的策展人：
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "bedrock-agentcore:ListRegistries" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistry" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:ListRegistryRecords" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistryRecord" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:UpdateRegistryRecordStatus" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*" ] } ] }
发布者权限
对于向注册表提交 MCP 服务器、代理或其他资源的发布商：
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "bedrock-agentcore:ListRegistries" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistry" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:CreateRegistryRecord", "bedrock-agentcore:ListRegistryRecords" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistryRecord", "bedrock-agentcore:UpdateRegistryRecord", "bedrock-agentcore:DeleteRegistryRecord", "bedrock-agentcore:SubmitRegistryRecordForApproval" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*" ] }, { "Sid": "AllowWorkloadIdentityForSynchronization", "Effect": "Allow", "Action": [ "bedrock-agentcore:GetWorkloadAccessToken" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/*" ] }, { "Sid": "AllowGetResourceOauth2TokenForOauthBasedSynchronization", "Effect": "Allow", "Action": [ "bedrock-agentcore:GetResourceOauth2Token" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:token-vault/*" ] }, { "Sid": "AllowPassRoleForIamBasedSynchronization", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::<account>:role/<your-sync-role-name>" ], "Condition": { "StringEquals": { "iam:PassedToService": "bedrock-agentcore.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:bedrock-agentcore:<region>:<account>:registry/*/record/*" } } } ] }
使用者权限
对于搜索和使用经批准的资源的消费者：
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "bedrock-agentcore:ListRegistries" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistry" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:SearchRegistryRecords", "bedrock-agentcore:InvokeRegistryMcp" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] } ] }
有关 IAM 策略的示例，请参阅 A mazon Bedrock AgentCore 的身份和访问管理。
（可选）用于 JWT 授权的身份提供商
如果您计划对入站身份使用 JWT 授权（使消费者能够使用 Non-IAM 身份搜索注册表），请在创建注册表之前设置 Amazon Cognito 或您自己的身份提供商：
-
创建 Cognito 用户池（或使用您现有的身份提供商）
-
注册应用程序客户端并记下客户端 ID
-
使用@@ 用户名和密码创建测试用户
有关详细说明，请参阅配置入站 JWT 授权方。
