View a markdown version of this page

先決條件 - Amazon Bedrock AgentCore
AWS 帳戶和登入資料Python 和 AWS SDKIAM 許可（選用） JWT 授權的身分提供者

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

先決條件

遷移現已開啟

AWS 代理程式登錄檔已在新的agent-registry命名空間下啟動。公有預覽bedrock-agentcore命名空間的支援將於 2026 年 9 月 17 日停止。如需遷移說明，請參閱綜合登錄遷移指南。

在使用 AWS 客服人員登錄檔之前，請先完成下列先決條件。

AWS 帳戶和登入資料

您需要已設定登入資料的 AWS 帳戶。若要設定登入資料，請依照 CLI AWS 入門中的步驟安裝和使用 AWS 命令列界面。

# Verify installation
aws --version  # Should show version 2.

Python 和 AWS SDK

若要存取您的 AWS 登入資料並將其設定為與 SDKs 搭配使用，請依照使用 IAM Identity Center 中的步驟來驗證 AWS SDK 和工具。如果您計劃使用 AWS Python SDK (Boto3) 以程式設計方式與 AWS 客服人員登錄檔互動：

  1. 安裝 Python 3.10+。

  2. 安裝 AWS SDK： pip install boto3

  3. 確認您的登入資料已設定： aws sts get-caller-identity

如需如何設定和使用 AWS SDK 的詳細資訊，請參閱AWS 建置器工具。

IAM 許可

根據符合您角色的角色來設定 IAM 許可。您可以在 IAM 許可中找到登錄檔的 IAM 許可完整清單。

管理員許可

對於管理登錄檔、記錄和approve/reject/deprecate記錄的完整生命週期的管理員：

範例
AWS Agent Registry namespace
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Sid": "AllowCreatingAndListingRegistries",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:CreateRegistry",
                "agent-registry:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:*"
            ]
        },
        {
            "Sid": "AllowGetUpdateDeleteRegistry",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistry",
                "agent-registry:UpdateRegistry",
                "agent-registry:DeleteRegistry"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Sid": "AllowCreatingAndListingRecords",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:CreateRegistryRecord",
                "agent-registry:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Sid": "AllowRecordLevelOperations",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistryRecord",
                "agent-registry:UpdateRegistryRecord",
                "agent-registry:DeleteRegistryRecord",
                "agent-registry:SubmitRegistryRecordForApproval"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AllowApproveRejectDeprecateRecords",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:UpdateRegistryRecordStatus"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AdditionalPermissionForRegistryManagedWorkloadIdentity",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:*WorkloadIdentity"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/default/*"
            ]
        },
        {
            "Sid": "AllowPermissionForCreatingServiceLinkedRole",
            "Effect": "Allow",
            "Action":
            [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource":
            [
                "arn:aws:iam::*:role/aws-service-role/agent-registry.amazonaws.com/AWSServiceRoleForAgentRegistry"
            ],
            "Condition":
            {
                "StringLike": { "iam:AWSServiceName": "agent-registry.amazonaws.com" }
            }
        }
    ]
}
Amazon Bedrock AgentCore namespace (to be deprecated)
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Sid": "AllowCreatingAndListingRegistries",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:CreateRegistry",
                "bedrock-agentcore:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:*"
            ]
        },
        {
            "Sid": "AllowGetUpdateDeleteRegistry",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistry",
                "bedrock-agentcore:UpdateRegistry",
                "bedrock-agentcore:DeleteRegistry"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Sid": "AllowCreatingAndListingRecords",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:CreateRegistryRecord",
                "bedrock-agentcore:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Sid": "AllowRecordLevelOperations",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistryRecord",
                "bedrock-agentcore:UpdateRegistryRecord",
                "bedrock-agentcore:DeleteRegistryRecord",
                "bedrock-agentcore:SubmitRegistryRecordForApproval"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AllowApproveRejectDeprecateRecords",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:UpdateRegistryRecordStatus"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AdditionalPermissionForRegistryManagedWorkloadIdentity",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:*WorkloadIdentity"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/default/*"
            ]
        },
        {
            "Sid": "AllowPermissionForCreatingServiceLinkedRole",
            "Effect": "Allow",
            "Action":
            [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource":
            [
                "arn:aws:iam::*:role/aws-service-role/agent-registry.amazonaws.com/AWSServiceRoleForAgentRegistry"
            ],
            "Condition":
            {
                "StringLike": { "iam:AWSServiceName": "agent-registry.amazonaws.com" }
            }
        }
    ]
}

游標/核准者許可

對於檢閱和核准/拒絕記錄但未執行管理操作的策展者：

範例
AWS Agent Registry namespace
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistryRecord"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:UpdateRegistryRecordStatus"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        }
    ]
}
Amazon Bedrock AgentCore namespace (to be deprecated)
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistryRecord"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:UpdateRegistryRecordStatus"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        }
    ]
}

發佈者許可

對於將 MCP 伺服器、代理程式或其他資源提交至登錄檔的發佈者：

注意

三個與同步相關的陳述式 (AllowWorkloadIdentityForSynchronization、AllowGetResourceOauth2TokenForOauthBasedSynchronization、AllowPassRoleForIamBasedSynchronization) 會授權 AgentCore Identity 管理的工作負載身分和 OAuth 憑證提供者資源。這些資源刻意保留在bedrock-agentcore命名空間下，因此其動作、ARNs和服務主體不會變更。

注意

將AllowGetResourceOauth2TokenForOauthBasedSynchronization陳述式範圍限定為此身分所需的存取字符的特定 OAuth 憑證提供者 ARN。避免在 ARN 的提供者區段中使用萬用字元 — 模式，例如 token-vault/ 或token-vault/default/oauth2credentialprovider/授予帳戶內每個 OAuth 登入資料提供者的存取權，這可以啟用跨團隊登入資料存取。遵循最低權限原則，在 Resource 欄位中命名特定提供者，例如 arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/oauth2credentialprovider/<oauthProviderName>。

範例
AWS Agent Registry namespace
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:CreateRegistryRecord",
                "agent-registry:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistryRecord",
                "agent-registry:UpdateRegistryRecord",
                "agent-registry:DeleteRegistryRecord",
                "agent-registry:SubmitRegistryRecordForApproval"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AllowWorkloadIdentityForSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetWorkloadAccessToken"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/*"
            ]
        },
        {
            "Sid": "AllowGetResourceOauth2TokenForOauthBasedSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetResourceOauth2Token"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/oauth2credentialprovider/<oauthProviderName>"
            ]
        },
        {
            "Sid": "AllowPassRoleForIamBasedSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "iam:PassRole"
            ],
            "Resource":
            [
                "arn:aws:iam::<account>:role/<your-sync-role-name>"
            ],
            "Condition":
            {
                "StringEquals":
                {
                    "iam:PassedToService": "bedrock-agentcore.amazonaws.com"
                },
                "StringLike":
                {
                    "iam:AssociatedResourceARN": "arn:aws:bedrock-agentcore:<region>:<account>:registry/*/record/*"
                }
            }
        }
    ]
}
Amazon Bedrock AgentCore namespace (to be deprecated)
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:CreateRegistryRecord",
                "bedrock-agentcore:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistryRecord",
                "bedrock-agentcore:UpdateRegistryRecord",
                "bedrock-agentcore:DeleteRegistryRecord",
                "bedrock-agentcore:SubmitRegistryRecordForApproval"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AllowWorkloadIdentityForSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetWorkloadAccessToken"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/*"
            ]
        },
        {
            "Sid": "AllowGetResourceOauth2TokenForOauthBasedSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetResourceOauth2Token"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/oauth2credentialprovider/<oauthProviderName>"
            ]
        },
        {
            "Sid": "AllowPassRoleForIamBasedSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "iam:PassRole"
            ],
            "Resource":
            [
                "arn:aws:iam::<account>:role/<your-sync-role-name>"
            ],
            "Condition":
            {
                "StringEquals":
                {
                    "iam:PassedToService": "bedrock-agentcore.amazonaws.com"
                },
                "StringLike":
                {
                    "iam:AssociatedResourceARN": "arn:aws:bedrock-agentcore:<region>:<account>:registry/*/record/*"
                }
            }
        }
    ]
}

取用者許可

對於搜尋和使用已核准資源的消費者：

範例
AWS Agent Registry namespace
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:SearchDiscoverableRegistryRecords",
                "agent-registry:ListDiscoverableRegistryRecords",
                "agent-registry:GetDiscoverableRegistryRecord",
                "agent-registry:InvokeRegistryMcp"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        }
    ]
}
Amazon Bedrock AgentCore namespace (to be deprecated)
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:SearchRegistryRecords",
                "bedrock-agentcore:InvokeRegistryMcp"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        }
    ]
}

如需 IAM 政策範例，請參閱 Amazon Bedrock AgentCore 的 Identity and Access Management。

（選用） JWT 授權的身分提供者

如果您計劃對傳入身分使用 JWT 授權 （讓消費者使用非 IAM 身分搜尋登錄檔），請在建立登錄檔之前設定 Amazon Cognito 或您自己的身分提供者：

  1. 建立 Cognito 使用者集區 （或使用您現有的身分提供者）

  2. 註冊應用程式用戶端並記下用戶端 ID

  3. 使用使用者名稱和密碼建立測試使用者

如需詳細說明，請參閱設定傳入 JWT 授權方。