先決條件
即將進行的命名空間遷移
AWS 客服人員登錄檔目前在 bedrock-agentcore 命名空間下為公開預覽。從 2026 年 8 月 6 日開始，服務會移至代理程式登錄命名空間。如果您使用 AWS 代理程式登錄檔，則必須更新端點、IAM 政策、SDK 用戶端、CLI 指令碼和登錄檔資料。如需從公有預覽遷移的詳細資訊，請參閱 綜合登錄遷移指南。
在使用 AWS 客服人員登錄檔之前，請先完成下列先決條件。
AWS 帳戶和登入資料
您需要已設定登入資料的 AWS 帳戶。若要設定登入資料，請依照 CLI AWS 入門中的步驟安裝和使用 AWS 命令列界面。
# Verify installation aws --version # Should show version 2.
Python 和 AWS SDK
若要存取您的 AWS 登入資料並將其設定為搭配 SDKs 使用，請遵循使用 IAM Identity Center 來驗證 AWS SDK 和工具 中的步驟。如果您計劃使用 AWS Python SDK (Boto3) 以程式設計方式與 AWS 客服人員登錄檔互動：
-
安裝 Python 3.10+。
-
安裝 AWS SDK：
pip install boto3 -
確認您的登入資料已設定：
aws sts get-caller-identity
如需如何設定和使用 AWS SDK 的詳細資訊，請參閱AWS 建置器工具
IAM 許可
根據符合您角色的角色來設定 IAM 許可。您可以在 IAM 許可中找到登錄檔的 IAM 許可完整清單。
管理員許可
對於管理登錄檔、記錄和approve/reject/deprecate記錄的完整生命週期的管理員：
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCreatingAndListingRegistries", "Effect": "Allow", "Action": [ "bedrock-agentcore:CreateRegistry", "bedrock-agentcore:ListRegistries" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:*" ] }, { "Sid": "AllowGetUpdateDeleteRegistry", "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistry", "bedrock-agentcore:UpdateRegistry", "bedrock-agentcore:DeleteRegistry" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Sid": "AllowCreatingAndListingRecords", "Effect": "Allow", "Action": [ "bedrock-agentcore:CreateRegistryRecord", "bedrock-agentcore:ListRegistryRecords" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Sid": "AllowRecordLevelOperations", "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistryRecord", "bedrock-agentcore:UpdateRegistryRecord", "bedrock-agentcore:DeleteRegistryRecord", "bedrock-agentcore:SubmitRegistryRecordForApproval" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*" ] }, { "Sid": "AllowApproveRejectDeprecateRecords", "Effect": "Allow", "Action": [ "bedrock-agentcore:UpdateRegistryRecordStatus" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*" ] }, { "Sid": "AdditionalPermissionForRegistryManagedWorkloadIdentity", "Effect": "Allow", "Action": [ "bedrock-agentcore:*WorkloadIdentity" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/default/*" ] } ] }
游標/核准者許可
對於檢閱和核准/拒絕記錄但未執行管理操作的策展者：
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "bedrock-agentcore:ListRegistries" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistry" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:ListRegistryRecords" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistryRecord" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:UpdateRegistryRecordStatus" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*" ] } ] }
發佈者許可
對於將 MCP 伺服器、代理程式或其他資源提交至登錄檔的發佈者：
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "bedrock-agentcore:ListRegistries" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistry" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:CreateRegistryRecord", "bedrock-agentcore:ListRegistryRecords" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistryRecord", "bedrock-agentcore:UpdateRegistryRecord", "bedrock-agentcore:DeleteRegistryRecord", "bedrock-agentcore:SubmitRegistryRecordForApproval" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*" ] }, { "Sid": "AllowWorkloadIdentityForSynchronization", "Effect": "Allow", "Action": [ "bedrock-agentcore:GetWorkloadAccessToken" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/*" ] }, { "Sid": "AllowGetResourceOauth2TokenForOauthBasedSynchronization", "Effect": "Allow", "Action": [ "bedrock-agentcore:GetResourceOauth2Token" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:token-vault/*" ] }, { "Sid": "AllowPassRoleForIamBasedSynchronization", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::<account>:role/<your-sync-role-name>" ], "Condition": { "StringEquals": { "iam:PassedToService": "bedrock-agentcore.amazonaws.com" }, "StringLike": { "iam:AssociatedResourceARN": "arn:aws:bedrock-agentcore:<region>:<account>:registry/*/record/*" } } } ] }
取用者許可
對於搜尋和使用已核准資源的消費者：
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "bedrock-agentcore:ListRegistries" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:GetRegistry" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] }, { "Effect": "Allow", "Action": [ "bedrock-agentcore:SearchRegistryRecords", "bedrock-agentcore:InvokeRegistryMcp" ], "Resource": [ "arn:aws:bedrock-agentcore:*:<account>:registry/*" ] } ] }
如需 IAM 政策範例，請參閱 Amazon Bedrock AgentCore 的 Identity and Access Management。
（選用） JWT 授權的身分提供者
如果您計劃對傳入身分使用 JWT 授權 （讓消費者使用非 IAM 身分搜尋登錄檔），請在建立登錄檔之前設定 Amazon Cognito 或您自己的身分提供者：
-
建立 Cognito 使用者集區 （或使用您現有的身分提供者）
-
註冊應用程式用戶端並記下用戶端 ID
-
使用使用者名稱和密碼建立測試使用者
如需詳細說明，請參閱設定傳入 JWT 授權方。
