View a markdown version of this page

配置凭证提供商 - Amazon Bedrock AgentCore
创建 OAuth 2.0 凭证提供商创建 API 密钥凭证提供商创建付款凭证提供商

配置凭证提供商

Ident AgentCore ity 中的资源凭证提供者充当智能中介，负责管理代理、身份提供者和资源服务器之间的复杂关系。每个提供商都封装了特定服务或身份系统所需的特定端点配置。该服务为包括Google、 GitHub Slack和Salesforce在内的热门服务提供了内置提供商，并预先配置了授权服务器端点和特定于提供商的参数，以减少开发工作量。 AgentCore Identity 支持通过可配置的 OAuth2 凭据提供程序进行自定义配置，这些提供程序可以根据任何 OAuth2-compatible 资源服务器进行定制。有关 OAuth2 凭证提供商限制的信息，请参阅身份服务AgentCore 配额。

资源凭证提供者与令牌库深度集成，以提供无缝的凭证生命周期管理。当代理请求访问资源时，提供者会处理身份验证流程，将生成的凭据存储在令牌库中，并为代理提供必要的访问令牌。

创建 OAuth 2.0 凭证提供商

Ident AgentCore ity 中的提供商配置定义了使用不同资源和身份验证系统进行凭据管理所需的基本参数。

如果您使用的是 AgentCore CLI，则可以使用以下命令创建 OAuth 2.0 凭据提供者：agentcore add credential

agentcore add credential --type oauth \
  --name github-provider \
  --discovery-url https://your-idp/.well-known/openid-configuration \
  --client-id your-github-client-id \
  --client-secret your-github-client-secret \
  --scopes repo,user

CLI 将凭据配置存储在中agentcore/agentcore.json并将敏感值（客户端 ID 和客户机密钥）保存到agentcore/.env.local。

或者，您可以通过提供对已存储在 Secrets Manager 中的客户密钥的引用来自带 AWS 密钥：

aws bedrock-agentcore-control create-oauth2-credential-provider \
  --name "github-provider" \
  --credential-provider-vendor "GithubOauth2" \
  --oauth2-provider-config-input '{
    "githubOauth2ProviderConfig": {
      "clientId": "your-github-client-id",
      "clientSecretSource": "EXTERNAL",
      "clientSecretConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret",
        "jsonKey": "clientSecret"
      }
    }
  }' \
  --region us-east-1

或者，您可以使用 AgentCore SDK 以编程方式配置 OAuth 2.0 凭据提供程序。以下示例为配置了提供程序。 GitHub

from bedrock_agentcore.services.identity import IdentityClient
identity_client = IdentityClient("us-east-1")
github_provider = identity_client.create_oauth2_credential_provider({
        "name": "github-provider",
        "credentialProviderVendor": "GithubOauth2",
        "oauth2ProviderConfigInput": {
            "githubOauth2ProviderConfig": {
                "clientId": "your-github-client-id",
                "clientSecret": "your-github-client-secret"
            }
        }
    })

要在 OAuth 2.0 凭据提供商上配置代表 (OBO) 令牌交换，请在提供程序配置中添加。onBehalfOfTokenExchangeConfig有关支持的模式、参数和示例，请参阅On-behalf-of 代币交换。

创建 API 密钥凭证提供商

对于使用 API 密钥而不是 OAuth 进行身份验证的服务，Ident AgentCore ity 将安全地为您的代理存储和检索密钥。有关 API 密钥凭证提供商限制的信息，请参阅 Ident AgentCore ity Service Q uotas。

如果您使用的是 AgentCore CLI，则只需一个命令即可存储 API 密钥：

agentcore add credential --name your-service-name --api-key your-api-key

或者，您可以通过提供对已存储在 Secrets Manager 中的 API 密钥的引用来自带 AWS 密钥：

aws bedrock-agentcore-control create-api-key-credential-provider \
  --name "your-service-name" \
  --api-key-secret-source EXTERNAL \
  --api-key-secret-config secretId=arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret,jsonKey=api_key \
  --region us-east-1

或者，您可以使用 AgentCore SDK 以编程方式存储 API 密钥：

from bedrock_agentcore.services.identity import IdentityClient
identity_client= IdentityClient("us-east-1")
apikey_provider= identity_client.create_api_key_credential_provider({
        "name": "your-service-name",
        "apiKey": "your-api-key"
    })

创建付款凭证提供商

对于使用支付处理器凭据的服务，例如Coinbase CDP或Stripe Privy，Ident AgentCore ity将关联的API密钥、应用程序密钥和机 wallet/authorization 密安全地存储在Secrets Manager中，并且仅向您的代理显示其ARN。有关付款凭证提供商限制的信息，请参阅 Ident AgentCore ity Service Q uotas。

支付凭证提供商目前支持两个供应商：CoinbaseCDP和。StripePrivy在下方只提供一个与credentialProviderVendor你选择providerConfigurationInput相匹配的配置块。或者，您可以通过提供对已存储在 Secrets Manager 中的密钥的引用来自带 AWS 密钥。

例
AWS CLI

以下示例为 Coinbase CDP 创建了一个支付凭证提供商：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "coinbase-provider" \
  --credential-provider-vendor CoinbaseCDP \
  --provider-configuration-input '{
    "coinbaseCdpConfiguration": {
      "apiKeyId": "your-coinbase-api-key-id",
      "apiKeySecret": "your-coinbase-api-key-secret",
      "walletSecret": "your-coinbase-wallet-secret"
    }
  }' \
  --region us-east-1

以下示例创建了一个 Coinbase CDP 支付凭证提供商，其密钥存储在 Secrets Manager AWS 中：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "coinbase-provider" \
  --credential-provider-vendor "CoinbaseCDP" \
  --provider-configuration-input '{
    "coinbaseCdpConfiguration": {
      "apiKeyId": "your-coinbase-api-key-id",
      "apiKeySecretSource": "EXTERNAL",
      "apiKeySecretConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-api-secret",
        "jsonKey": "apiKeySecret"
      },
      "walletSecretSource": "EXTERNAL",
      "walletSecretConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-wallet-secret",
        "jsonKey": "walletSecret"
      }
    }
  }' \
  --region us-east-1

以下示例为 Stripe Privy 创建了一个支付凭证提供商：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "stripe-privy-provider" \
  --credential-provider-vendor StripePrivy \
  --provider-configuration-input '{
    "stripePrivyConfiguration": {
      "appId": "your-stripe-privy-app-id",
      "appSecret": "your-stripe-privy-app-secret",
      "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
      "authorizationId": "your-stripe-privy-authorization-id"
    }
  }' \
  --region us-east-1

以下示例创建了一个存储在 Secrets Manager 中的 AWS 密钥的 Stripe Privy 支付凭证提供商：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "stripe-privy-provider" \
  --credential-provider-vendor "StripePrivy" \
  --provider-configuration-input '{
    "stripePrivyConfiguration": {
      "appId": "your-stripe-privy-app-id",
      "appSecretSource": "EXTERNAL",
      "appSecretConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-secret",
        "jsonKey": "appSecret"
      },
      "authorizationPrivateKeySource": "EXTERNAL",
      "authorizationPrivateKeyConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-auth-key-secret",
        "jsonKey": "authorizationPrivateKey"
      },
      "authorizationId": "your-stripe-privy-authorization-id"
    }
  }' \
  --region us-east-1
AWS SDK

以下示例为 Coinbase CDP 配置了一个提供商：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

coinbase_provider = client.create_payment_credential_provider(
    name="coinbase-provider",
    credentialProviderVendor="CoinbaseCDP",
    providerConfigurationInput={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecret": "your-coinbase-api-key-secret",
            "walletSecret": "your-coinbase-wallet-secret"
        }
    }
)

以下示例使用存储在 Secrets Manager AWS 中的机密来配置 Coinbase CDP 提供商：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

coinbase_provider = client.create_payment_credential_provider(
    name="coinbase-provider",
    credentialProviderVendor="CoinbaseCDP",
    providerConfigurationInput={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecretSource": "EXTERNAL",
            "apiKeySecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-api-secret",
                "jsonKey": "apiKeySecret"
            },
            "walletSecretSource": "EXTERNAL",
            "walletSecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-wallet-secret",
                "jsonKey": "walletSecret"
            }
        }
    }
)

以下示例为 Stripe Privy 配置了提供商：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

stripe_privy_provider = client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credentialProviderVendor="StripePrivy",
    providerConfigurationInput={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecret": "your-stripe-privy-app-secret",
            "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)

以下示例使用存储在 Secrets Manager 中的 AWS 密钥配置 Stripe Privy 提供商：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

stripe_privy_provider = client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credentialProviderVendor="StripePrivy",
    providerConfigurationInput={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecretSource": "EXTERNAL",
            "appSecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-secret",
                "jsonKey": "appSecret"
            },
            "authorizationPrivateKeySource": "EXTERNAL",
            "authorizationPrivateKeyConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-auth-key-secret",
                "jsonKey": "authorizationPrivateKey"
            },
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)
AgentCore SDK

以下示例为 Coinbase CDP 配置了一个提供商：

from bedrock_agentcore.services.identity import IdentityClient

identity_client = IdentityClient("us-east-1")

coinbase_provider = identity_client.create_payment_credential_provider(
    name="coinbase-provider",
    credential_provider_vendor="CoinbaseCDP",
    provider_configuration_input={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecret": "your-coinbase-api-key-secret",
            "walletSecret": "your-coinbase-wallet-secret"
        }
    }
)

以下示例使用存储在 Secrets Manager AWS 中的机密来配置 Coinbase CDP 提供商：

from bedrock_agentcore.services.identity import IdentityClient

identity_client = IdentityClient("us-east-1")

coinbase_provider = identity_client.create_payment_credential_provider(
    name="coinbase-provider",
    credential_provider_vendor="CoinbaseCDP",
    provider_configuration_input={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecretSource": "EXTERNAL",
            "apiKeySecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-api-secret",
                "jsonKey": "apiKeySecret"
            },
            "walletSecretSource": "EXTERNAL",
            "walletSecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-wallet-secret",
                "jsonKey": "walletSecret"
            }
        }
    }
)

以下示例为 Stripe Privy 配置了提供商：

from bedrock_agentcore.services.identity import IdentityClient

identity_client = IdentityClient("us-east-1")

stripe_privy_provider = identity_client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credential_provider_vendor="StripePrivy",
    provider_configuration_input={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecret": "your-stripe-privy-app-secret",
            "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)

以下示例使用存储在 Secrets Manager 中的 AWS 密钥配置 Stripe Privy 提供商：

from bedrock_agentcore.services.identity import IdentityClient

identity_client = IdentityClient("us-east-1")

stripe_privy_provider = identity_client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credential_provider_vendor="StripePrivy",
    provider_configuration_input={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecretSource": "EXTERNAL",
            "appSecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-secret",
                "jsonKey": "appSecret"
            },
            "authorizationPrivateKeySource": "EXTERNAL",
            "authorizationPrivateKeyConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-auth-key-secret",
                "jsonKey": "authorizationPrivateKey"
            },
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)