View a markdown version of this page

設定登入資料提供者 - Amazon Bedrock AgentCore
建立 OAuth 2.0 登入資料提供者建立 API 金鑰登入資料提供者建立付款憑證提供者

設定登入資料提供者

AgentCore Identity 中的資源登入資料提供者充當智慧型中介裝置，可管理客服人員、身分提供者和資源伺服器之間的複雜關係。每個提供者會封裝特定服務或身分系統所需的特定端點組態。此服務為 Google、GitHub、Slack 和 Salesforce 等熱門服務提供內建提供者，其中包含預先設定的授權伺服器端點和提供者特定參數，以減少開發工作。AgentCore Identity 透過可設定的 OAuth2 登入資料提供者支援自訂組態，這些登入資料提供者可量身打造來與任何 OAuth2-compatible的資源伺服器搭配使用。如需 OAuth2 登入資料提供者限制的資訊，請參閱 AgentCore Identity Service Quotas。

資源登入資料提供者與字符保存庫深度整合，以提供無縫的登入資料生命週期管理。當代理程式請求存取資源時，提供者會處理身分驗證流程、將產生的憑證存放在字符文件庫中，並為代理程式提供必要的存取權杖。

建立 OAuth 2.0 登入資料提供者

AgentCore Identity 中的提供者組態會定義使用不同資源和身分驗證系統進行憑證管理所需的基本參數。

如果您使用的是 AgentCore CLI，您可以使用 agentcore add credential命令建立 OAuth 2.0 憑證提供者：

agentcore add credential --type oauth \
  --name github-provider \
  --discovery-url https://your-idp/.well-known/openid-configuration \
  --client-id your-github-client-id \
  --client-secret your-github-client-secret \
  --scopes repo,user

CLI 會將登入資料組態存放在 中，agentcore/agentcore.json並將敏感值 （用戶端 ID 和用戶端秘密） 儲存到 agentcore/.env.local。

或者，您也可以提供已存放在 Secrets Manager 中的用戶端秘密參考，以使用自己的 AWS 秘密：

aws bedrock-agentcore-control create-oauth2-credential-provider \
  --name "github-provider" \
  --credential-provider-vendor "GithubOauth2" \
  --oauth2-provider-config-input '{
    "githubOauth2ProviderConfig": {
      "clientId": "your-github-client-id",
      "clientSecretSource": "EXTERNAL",
      "clientSecretConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret",
        "jsonKey": "clientSecret"
      }
    }
  }' \
  --region us-east-1

或者，您可以使用 AgentCore SDK 以程式設計方式設定 OAuth 2.0 登入資料提供者。下列範例會設定 GitHub 的提供者。

from bedrock_agentcore.services.identity import IdentityClient
identity_client = IdentityClient("us-east-1")
github_provider = identity_client.create_oauth2_credential_provider({
        "name": "github-provider",
        "credentialProviderVendor": "GithubOauth2",
        "oauth2ProviderConfigInput": {
            "githubOauth2ProviderConfig": {
                "clientId": "your-github-client-id",
                "clientSecret": "your-github-client-secret"
            }
        }
    })

若要在 OAuth 2.0 登入資料提供者上設定on-behalf-of(OBO) 權杖交換，請將 onBehalfOfTokenExchangeConfig 新增至提供者組態。如需支援的模式、參數和範例，請參閱On-behalf-of權杖交換。

建立 API 金鑰登入資料提供者

對於使用 API 金鑰進行身分驗證而非 OAuth 的服務，AgentCore Identity 會安全地存放和擷取代理程式的金鑰。如需 API 金鑰登入資料提供者限制的資訊，請參閱 AgentCore Identity Service Quotas。

如果您使用的是 AgentCore CLI，則可以使用單一命令存放 API 金鑰：

agentcore add credential --name your-service-name --api-key your-api-key

或者，您也可以提供已存放在 Secrets Manager 中的 API 金鑰參考，以使用自己的 AWS 秘密：

aws bedrock-agentcore-control create-api-key-credential-provider \
  --name "your-service-name" \
  --api-key-secret-source EXTERNAL \
  --api-key-secret-config secretId=arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret,jsonKey=api_key \
  --region us-east-1

或者，您可以使用 AgentCore SDK 以程式設計方式存放 API 金鑰：

from bedrock_agentcore.services.identity import IdentityClient
identity_client= IdentityClient("us-east-1")
apikey_provider= identity_client.create_api_key_credential_provider({
        "name": "your-service-name",
        "apiKey": "your-api-key"
    })

建立付款憑證提供者

對於使用 Coinbase CDP 或 Stripe Privy 等付款處理器登入資料的服務，AgentCore Identity 會將相關聯的 API 金鑰、應用程式秘密和錢包/授權秘密安全地存放在 Secrets Manager 中，並僅將其 ARNs給您的代理。如需付款憑證提供者限制的相關資訊，請參閱 AgentCore Identity Service Quotas。

付款憑證供應商目前支援兩個廠商： CoinbaseCDP和 StripePrivy。在 下僅提供一個providerConfigurationInput符合您credentialProviderVendor所選 的組態區塊。或者，您也可以提供已存放在 Secrets Manager 中的秘密參考，以使用自己的 AWS 秘密。

範例
AWS CLI

下列範例會建立 Coinbase CDP 的付款憑證提供者：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "coinbase-provider" \
  --credential-provider-vendor CoinbaseCDP \
  --provider-configuration-input '{
    "coinbaseCdpConfiguration": {
      "apiKeyId": "your-coinbase-api-key-id",
      "apiKeySecret": "your-coinbase-api-key-secret",
      "walletSecret": "your-coinbase-wallet-secret"
    }
  }' \
  --region us-east-1

下列範例會建立 Coinbase CDP 付款憑證提供者，其中包含存放在 AWS Secrets Manager 中的秘密：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "coinbase-provider" \
  --credential-provider-vendor "CoinbaseCDP" \
  --provider-configuration-input '{
    "coinbaseCdpConfiguration": {
      "apiKeyId": "your-coinbase-api-key-id",
      "apiKeySecretSource": "EXTERNAL",
      "apiKeySecretConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-api-secret",
        "jsonKey": "apiKeySecret"
      },
      "walletSecretSource": "EXTERNAL",
      "walletSecretConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-wallet-secret",
        "jsonKey": "walletSecret"
      }
    }
  }' \
  --region us-east-1

下列範例會建立 Stripe Privy 的付款憑證提供者：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "stripe-privy-provider" \
  --credential-provider-vendor StripePrivy \
  --provider-configuration-input '{
    "stripePrivyConfiguration": {
      "appId": "your-stripe-privy-app-id",
      "appSecret": "your-stripe-privy-app-secret",
      "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
      "authorizationId": "your-stripe-privy-authorization-id"
    }
  }' \
  --region us-east-1

下列範例會使用存放在 AWS Secrets Manager 中的秘密建立 Stripe Privy 付款憑證提供者：

aws bedrock-agentcore-control create-payment-credential-provider \
  --name "stripe-privy-provider" \
  --credential-provider-vendor "StripePrivy" \
  --provider-configuration-input '{
    "stripePrivyConfiguration": {
      "appId": "your-stripe-privy-app-id",
      "appSecretSource": "EXTERNAL",
      "appSecretConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-secret",
        "jsonKey": "appSecret"
      },
      "authorizationPrivateKeySource": "EXTERNAL",
      "authorizationPrivateKeyConfig": {
        "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-auth-key-secret",
        "jsonKey": "authorizationPrivateKey"
      },
      "authorizationId": "your-stripe-privy-authorization-id"
    }
  }' \
  --region us-east-1
AWS SDK

下列範例會設定 Coinbase CDP 的提供者：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

coinbase_provider = client.create_payment_credential_provider(
    name="coinbase-provider",
    credentialProviderVendor="CoinbaseCDP",
    providerConfigurationInput={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecret": "your-coinbase-api-key-secret",
            "walletSecret": "your-coinbase-wallet-secret"
        }
    }
)

下列範例會使用存放在 AWS Secrets Manager 中的秘密來設定 Coinbase CDP 提供者：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

coinbase_provider = client.create_payment_credential_provider(
    name="coinbase-provider",
    credentialProviderVendor="CoinbaseCDP",
    providerConfigurationInput={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecretSource": "EXTERNAL",
            "apiKeySecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-api-secret",
                "jsonKey": "apiKeySecret"
            },
            "walletSecretSource": "EXTERNAL",
            "walletSecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-wallet-secret",
                "jsonKey": "walletSecret"
            }
        }
    }
)

下列範例會設定 Stripe Privy 的提供者：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

stripe_privy_provider = client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credentialProviderVendor="StripePrivy",
    providerConfigurationInput={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecret": "your-stripe-privy-app-secret",
            "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)

下列範例會使用存放在 AWS Secrets Manager 中的秘密來設定 Stripe Privy 提供者：

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

stripe_privy_provider = client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credentialProviderVendor="StripePrivy",
    providerConfigurationInput={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecretSource": "EXTERNAL",
            "appSecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-secret",
                "jsonKey": "appSecret"
            },
            "authorizationPrivateKeySource": "EXTERNAL",
            "authorizationPrivateKeyConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-auth-key-secret",
                "jsonKey": "authorizationPrivateKey"
            },
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)
AgentCore SDK

下列範例會設定 Coinbase CDP 的提供者：

from bedrock_agentcore.services.identity import IdentityClient

identity_client = IdentityClient("us-east-1")

coinbase_provider = identity_client.create_payment_credential_provider(
    name="coinbase-provider",
    credential_provider_vendor="CoinbaseCDP",
    provider_configuration_input={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecret": "your-coinbase-api-key-secret",
            "walletSecret": "your-coinbase-wallet-secret"
        }
    }
)

下列範例會使用存放在 AWS Secrets Manager 中的秘密來設定 Coinbase CDP 提供者：

from bedrock_agentcore.services.identity import IdentityClient

identity_client = IdentityClient("us-east-1")

coinbase_provider = identity_client.create_payment_credential_provider(
    name="coinbase-provider",
    credential_provider_vendor="CoinbaseCDP",
    provider_configuration_input={
        "coinbaseCdpConfiguration": {
            "apiKeyId": "your-coinbase-api-key-id",
            "apiKeySecretSource": "EXTERNAL",
            "apiKeySecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-api-secret",
                "jsonKey": "apiKeySecret"
            },
            "walletSecretSource": "EXTERNAL",
            "walletSecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-wallet-secret",
                "jsonKey": "walletSecret"
            }
        }
    }
)

下列範例會設定 Stripe Privy 的提供者：

from bedrock_agentcore.services.identity import IdentityClient

identity_client = IdentityClient("us-east-1")

stripe_privy_provider = identity_client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credential_provider_vendor="StripePrivy",
    provider_configuration_input={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecret": "your-stripe-privy-app-secret",
            "authorizationPrivateKey": "your-stripe-privy-authorization-private-key",
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)

下列範例會使用存放在 AWS Secrets Manager 中的秘密來設定 Stripe Privy 提供者：

from bedrock_agentcore.services.identity import IdentityClient

identity_client = IdentityClient("us-east-1")

stripe_privy_provider = identity_client.create_payment_credential_provider(
    name="stripe-privy-provider",
    credential_provider_vendor="StripePrivy",
    provider_configuration_input={
        "stripePrivyConfiguration": {
            "appId": "your-stripe-privy-app-id",
            "appSecretSource": "EXTERNAL",
            "appSecretConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-secret",
                "jsonKey": "appSecret"
            },
            "authorizationPrivateKeySource": "EXTERNAL",
            "authorizationPrivateKeyConfig": {
                "secretId": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-auth-key-secret",
                "jsonKey": "authorizationPrivateKey"
            },
            "authorizationId": "your-stripe-privy-authorization-id"
        }
    }
)