View a markdown version of this page

配置凭证提供商 - 亚马逊基岩 AgentCore
创建 OAuth 2.0 凭证提供商创建 API 密钥凭证提供商创建支付凭证提供商

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

配置凭证提供商

Ident AgentCore ity 中的资源凭证提供者充当智能中介，管理代理、身份提供商和资源服务器之间的复杂关系。每个提供商封装了特定服务或身份系统所需的特定端点配置。该服务为包括谷歌、 GitHub Slack和Salesforce在内的热门服务提供商提供内置提供商，并预先配置了授权服务器端点和提供商特定参数，以减少开发工作量。 AgentCore Identity 支持通过可配置的 OAuth2 凭据提供商进行自定义配置，这些提供商可以量身定制，适用于任何 OAuth2-compatible 资源服务器。有关 OAuth2 凭证提供商限制的信息，请参阅AgentCore 身份服务配额。

资源凭证提供商与代币库深度集成，提供无缝的凭证生命周期管理。当代理请求访问资源时，提供商会处理身份验证流程，将生成的凭据存储在令牌库中，并为代理提供必要的访问令牌。

创建 OAuth 2.0 凭证提供商

AgentCore Identity 中的提供者配置定义了使用不同资源和身份验证系统进行凭据管理所需的基本参数。

如果您使用的是 AgentCore CLI，则可以使用以下命令创建 OAuth 2.0 凭证提供商：agentcore add credential

agentcore add credential --type oauth \
  --name github-provider \
  --discovery-url https://your-idp/.well-known/openid-configuration \
  --client-id your-github-client-id \
  --client-secret your-github-client-secret \
  --scopes repo,user

CLI 将凭据配置存储在中agentcore/agentcore.json并将敏感值（客户端 ID 和客户端密钥）保存到agentcore/.env.local。

或者，您可以通过提供对已存储在 Secret AWS s Manager 中的客户端密钥的引用来携带自己的密钥：

aws bedrock-agentcore-control create-oauth2-credential-provider \
  --name "github-provider" \
  --credential-provider-vendor "GithubOauth2" \
  --oauth2-provider-config-input '{
    "githubOauth2ProviderConfig": {
      "clientId": "your-github-client-id",
      "clientSecretSource": "EXTERNAL",
      "clientSecretConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret",
        "jsonKey": "clientSecret"
      }
    }
  }' \
  --region us-east-1

或者，您可以使用 AgentCore SDK 以编程方式配置 OAuth 2.0 凭证提供商。以下示例为配置了提供商。 GitHub

from bedrock_agentcore.services.identity import IdentityClient
identity_client = IdentityClient("us-east-1")
github_provider = identity_client.create_oauth2_credential_provider({
        "name": "github-provider",
        "credentialProviderVendor": "GithubOauth2",
        "oauth2ProviderConfigInput": {
            "githubOauth2ProviderConfig": {
                "clientId": "your-github-client-id",
                "clientSecret": "your-github-client-secret"
            }
        }
    })

要在 OAuth 2.0 凭据提供商上配置代理 (OBO) 令牌交换，请在提供商配置中添加一个。onBehalfOfTokenExchangeConfig有关支持的模式、参数和示例，请参阅On-behalf-of 代币交换。

要使用由 KMS 密钥而不是客户端密 AWS 钥支持的已签名 JWT 客户端断言向下游令牌终端节点进行身份验证，请配置PRIVATE_KEY_JWT为客户端身份验证方法。有关设置说明、签名算法选项和 KMS 密钥要求，请参阅私钥 JWT 。

创建 API 密钥凭证提供商

对于使用 API 密钥而不是 OAuth 进行身份验证的服务，Id AgentCore entity 将安全地存储和检索代理的密钥。有关 API 密钥凭证提供商限制的信息，请参阅AgentCore 身份服务配额。

如果您使用的是 AgentCore CLI，则可以使用单个命令存储 API 密钥：

agentcore add credential --name your-service-name --api-key your-api-key

或者，您可以通过提供对已存储在密钥管理器中的 API 密钥的引用来携带自己的 AWS 密钥：

aws bedrock-agentcore-control create-api-key-credential-provider \
  --name "your-service-name" \
  --api-key-secret-source EXTERNAL \
  --api-key-secret-config secretId=arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret,jsonKey=api_key \
  --region us-east-1

或者，您可以使用 AgentCore SDK 以编程方式存储 API 密钥：

from bedrock_agentcore.services.identity import IdentityClient
identity_client= IdentityClient("us-east-1")
apikey_provider= identity_client.create_api_key_credential_provider({
        "name": "your-service-name",
        "apiKey": "your-api-key"
    })

创建支付凭证提供商

对于使用支付处理器凭据（例如 Coinbase CDP 或 Stripe Privy）的服务，Id AgentCore entity 会将关联的 API 密钥、应用程序密钥和机密安全地存储在 wallet/authorization 密钥管理器中，并且仅向您的代理显示其 ARN。有关支付凭证提供商限制的信息，请参阅AgentCore 身份服务配额。

支付凭证提供商目前支持两个供应商：CoinbaseCDP和。StripePrivy在下方只提供一个与credentialProviderVendor您选择providerConfigurationInput相匹配的配置块。或者，您可以通过提供对已存储在密钥管理器中的密钥的引用来携带自己的 AWS 密钥。

例
AWS CLI

以下示例为 Coinbase CDP 创建了支付凭证提供商：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "coinbase-provider" \
  --credential-provider-vendor CoinbaseCDP \
  --provider-configuration-input '{
    "coinbaseCdpConfiguration": {
      "apiKeyId": "your-coinbase-api-key-id",
      "apiKeySecret": "your-coinbase-api-key-secret",
      "walletSecret": "your-coinbase-wallet-secret"
    }
  }' \
  --region us-east-1

以下示例创建了一个 Coinbase CDP 支付凭证提供商，其密钥存储在 AWS 密钥管理器中：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "coinbase-provider" \
  --credential-provider-vendor "CoinbaseCDP" \
  --provider-configuration-input '{
    "coinbaseCdpConfiguration": {
      "apiKeyId": "your-coinbase-api-key-id",
      "apiKeySecretSource": "EXTERNAL",
      "apiKeySecretConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-api-secret",
        "jsonKey": "apiKeySecret"
      },
      "walletSecretSource": "EXTERNAL",
      "walletSecretConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-wallet-secret",
        "jsonKey": "walletSecret"
      }
    }
  }' \
  --region us-east-1

以下示例为 Stripe Privy 创建了支付凭证提供商：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "stripe-privy-provider" \
  --credential-provider-vendor StripePrivy \
  --provider-configuration-input '{
    "stripePrivyConfiguration": {
      "appId": "your-stripe-privy-app-id",
      "appSecret": "your-stripe-privy-app-secret",
      "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
      "authorizationId": "your-stripe-privy-authorization-id"
    }
  }' \
  --region us-east-1

以下示例创建了一个 Stripe Privy 支付凭证提供商，其密钥存储在 AWS 密钥管理器中：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "stripe-privy-provider" \
  --credential-provider-vendor "StripePrivy" \
  --provider-configuration-input '{
    "stripePrivyConfiguration": {
      "appId": "your-stripe-privy-app-id",
      "appSecretSource": "EXTERNAL",
      "appSecretConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-secret",
        "jsonKey": "appSecret"
      },
      "authorizationPrivateKeySource": "EXTERNAL",
      "authorizationPrivateKeyConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-auth-key-secret",
        "jsonKey": "authorizationPrivateKey"
      },
      "authorizationId": "your-stripe-privy-authorization-id"
    }
  }' \
  --region us-east-1
AWS SDK

以下示例为 Coinbase CDP 配置了提供商：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

coinbase_provider = client.create_payment_credential_provider(
    name="coinbase-provider",
    credentialProviderVendor="CoinbaseCDP",
    providerConfigurationInput={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecret": "your-coinbase-api-key-secret",
            "walletSecret": "your-coinbase-wallet-secret"
        }
    }
)

以下示例使用存储在密钥管理器中的 AWS 密钥配置 Coinbase CDP 提供商：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

coinbase_provider = client.create_payment_credential_provider(
    name="coinbase-provider",
    credentialProviderVendor="CoinbaseCDP",
    providerConfigurationInput={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecretSource": "EXTERNAL",
            "apiKeySecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-api-secret",
                "jsonKey": "apiKeySecret"
            },
            "walletSecretSource": "EXTERNAL",
            "walletSecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-wallet-secret",
                "jsonKey": "walletSecret"
            }
        }
    }
)

以下示例为 Stripe Privy 配置了提供商：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

stripe_privy_provider = client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credentialProviderVendor="StripePrivy",
    providerConfigurationInput={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecret": "your-stripe-privy-app-secret",
            "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)

以下示例使用存储在密钥管理器中的 AWS 密钥配置 Stripe Privy 提供商：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

stripe_privy_provider = client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credentialProviderVendor="StripePrivy",
    providerConfigurationInput={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecretSource": "EXTERNAL",
            "appSecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-secret",
                "jsonKey": "appSecret"
            },
            "authorizationPrivateKeySource": "EXTERNAL",
            "authorizationPrivateKeyConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-auth-key-secret",
                "jsonKey": "authorizationPrivateKey"
            },
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)
AgentCore SDK

以下示例为 Coinbase CDP 配置了提供商：

from bedrock_agentcore.services.identity import IdentityClient

identity_client = IdentityClient("us-east-1")

coinbase_provider = identity_client.create_payment_credential_provider(
    name="coinbase-provider",
    credential_provider_vendor="CoinbaseCDP",
    provider_configuration_input={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecret": "your-coinbase-api-key-secret",
            "walletSecret": "your-coinbase-wallet-secret"
        }
    }
)

以下示例使用存储在密钥管理器中的 AWS 密钥配置 Coinbase CDP 提供商：

from bedrock_agentcore.services.identity import IdentityClient

identity_client = IdentityClient("us-east-1")

coinbase_provider = identity_client.create_payment_credential_provider(
    name="coinbase-provider",
    credential_provider_vendor="CoinbaseCDP",
    provider_configuration_input={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecretSource": "EXTERNAL",
            "apiKeySecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-api-secret",
                "jsonKey": "apiKeySecret"
            },
            "walletSecretSource": "EXTERNAL",
            "walletSecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-wallet-secret",
                "jsonKey": "walletSecret"
            }
        }
    }
)

以下示例为 Stripe Privy 配置了提供商：

from bedrock_agentcore.services.identity import IdentityClient

identity_client = IdentityClient("us-east-1")

stripe_privy_provider = identity_client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credential_provider_vendor="StripePrivy",
    provider_configuration_input={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecret": "your-stripe-privy-app-secret",
            "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)

以下示例使用存储在密钥管理器中的 AWS 密钥配置 Stripe Privy 提供商：

from bedrock_agentcore.services.identity import IdentityClient

identity_client = IdentityClient("us-east-1")

stripe_privy_provider = identity_client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credential_provider_vendor="StripePrivy",
    provider_configuration_input={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecretSource": "EXTERNAL",
            "appSecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-secret",
                "jsonKey": "appSecret"
            },
            "authorizationPrivateKeySource": "EXTERNAL",
            "authorizationPrivateKeyConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-auth-key-secret",
                "jsonKey": "authorizationPrivateKey"
            },
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)