AgentCore 執行期的 IAM 許可
以下是在 AgentCore 執行期中建立代理程式所需的 IAM 許可，以及代理程式在 AgentCore 執行期中執行所需的執行角色許可。您也可以使用資源型政策來控制對執行期資源的存取。
如需有關使用資源型政策來控制對 AgentCore 執行期資源的存取的資訊，請參閱 Amazon Bedrock AgentCore 的資源型政策。
主題
使用 Amazon Bedrock AgentCore
若要使用 Amazon Bedrock AgentCore，您可以將 BedrockAgentCoreFullAccess AWS 受管政策連接至 IAM 使用者或 IAM 角色。此 AWS 受管政策授予廣泛的許可，包括 GetWorkloadAccessTokenForUserId，其允許使用發起人提供的使用者識別符字串發出工作負載存取字符，而無需進行 IdP 字符驗證。我們建議您透過複製相關陳述式並將資源限制為特定使用案例，來建立僅具有應用程式所需許可的自訂政策。對於您的應用程式有 JWT 字符可用的生產部署，明確拒絕GetWorkloadAccessTokenForUserId並僅授予 GetWorkloadAccessTokenForJWT。如需詳細資訊，請參閱取得工作負載存取字符。若要使用 AgentCore CLI，您需要額外的許可。
使用 AgentCore CLI
若要使用 AgentCore CLI，請將下列 IAM 政策連接至您的 IAM 使用者或角色。若要變更 IAM 許可，請參閱變更 IAM 使用者的許可。
重要
AgentCore CLI 建立的 IAM 政策旨在用於開發和測試目的。這些許可授予廣泛的存取權，以促進快速原型設計，並不適合生產環境。對於生產部署，請建立遵循最低權限原則的自訂 IAM 政策，並將許可限制為僅限 Amazon Bedrock AgentCore 應用程式所需的特定資源和動作。如需完整的 IAM 安全指南，請參閱 AgentCore 執行期的安全最佳實務。
{ "Version":"2012-10-17", "Statement": [ { "Sid": "IAMRoleManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DeleteRole", "iam:GetRole", "iam:PutRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:DetachRolePolicy", "iam:TagRole", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/*BedrockAgentCore*", "arn:aws:iam::*:role/service-role/*BedrockAgentCore*" ] }, { "Sid": "CodeBuildProjectAccess", "Effect": "Allow", "Action": [ "codebuild:StartBuild", "codebuild:BatchGetBuilds", "codebuild:ListBuildsForProject", "codebuild:CreateProject", "codebuild:UpdateProject", "codebuild:BatchGetProjects" ], "Resource": [ "arn:aws:codebuild:*:*:project/bedrock-agentcore-*", "arn:aws:codebuild:*:*:build/bedrock-agentcore-*" ] }, { "Sid": "CodeBuildListAccess", "Effect": "Allow", "Action": [ "codebuild:ListProjects" ], "Resource": "*" }, { "Sid": "IAMPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AmazonBedrockAgentCore*", "arn:aws:iam::*:role/service-role/AmazonBedrockAgentCore*" ] }, { "Sid": "CloudWatchLogsAccess", "Effect": "Allow", "Action": [ "logs:GetLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/*", "arn:aws:logs:*:*:log-group:/aws/codebuild/*" ] }, { "Sid": "S3Access", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket", "s3:CreateBucket", "s3:PutLifecycleConfiguration" ], "Resource": [ "arn:aws:s3:::bedrock-agentcore-*", "arn:aws:s3:::bedrock-agentcore-*/*" ] }, { "Sid": "ECRRepositoryAccess", "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:CompleteLayerUpload", "ecr:PutImage", "ecr:UploadLayerPart", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:ListImages", "ecr:TagResource" ], "Resource": [ "arn:aws:ecr:*:*:repository/bedrock-agentcore-*" ] }, { "Sid": "ECRAuthorizationAccess", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*" } ] }
Amazon Bedrock AgentCore 主控台的使用者許可
將 BedrockAgentCoreFullAccess 政策連接至主控台角色。此外，如果您希望服務主控台自動建立執行角色，請新增 IAM 的下列許可。
{ "Version": "2012-10-17", "Statement": [{ "Sid": "IAMRoleAccess", "Effect": "Allow", "Action": ["iam:CreateRole"], "Resource": ["arn:aws:iam::*:role/service-role/AmazonBedrockAgentCoreRuntimeDefaultServiceRole-*"] }, { "Sid": "IAMPolicyAccess", "Effect": "Allow", "Action": ["iam:CreatePolicy"], "Resource": ["arn:aws:iam::*:policy/service-role/AmazonBedrockAgentCoreRuntimeExecutionPolicy_*"] }, { "Sid": "IAMRolePolicyAccess", "Effect": "Allow", "Action": ["iam:AttachRolePolicy"], "Resource": ["arn:aws:iam::*:role/service-role/AmazonBedrockAgentCoreRuntimeDefaultServiceRole-*"], "Condition": { "ArnLike": { "iam:PolicyARN": "arn:aws:iam::*:policy/service-role/AmazonBedrockAgentCoreRuntimeExecutionPolicy_*" } } }] }
在 AgentCore 執行時間中執行代理程式的執行角色
若要在 AgentCore 執行期中執行代理程式或工具，您需要 AWS Identity and Access Management 執行角色。如需建立 IAM 角色的資訊，請參閱建立 IAM 角色。
Amazon Bedrock AgentCore 直接部署執行角色是 Amazon Bedrock AgentCore 擔任以執行代理程式的 IAM 角色。取代以下項目：
-
us-east-1搭配您正在使用的 AWS 區域 -
123456789012使用 AWS 您的帳戶 ID -
agentName與代理程式的名稱。您需要先決定代理程式名稱，才能建立角色和 AgentCore 執行期。
{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock-agentcore/runtimes/*" ] }, { "Effect": "Allow", "Action": [ "logs:PutResourcePolicy" ], "Resource": [ "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock-agentcore/runtimes/agentName-*" ] }, { "Effect": "Allow", "Action": ["logs:DescribeLogGroups"], "Resource": ["arn:aws:logs:us-east-1:123456789012:log-group:*"] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*" ] }, { "Effect": "Allow", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets" ], "Resource": ["*"] }, { "Effect": "Allow", "Resource": "*", "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": "bedrock-agentcore" } } }, { "Sid": "BedrockModelInvocation", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:us-east-1:123456789012:*" ] }] }
AgentCore 執行期執行角色是 AgentCore 執行期擔任以執行代理程式的 IAM 角色。取代以下項目：
-
us-east-1搭配您正在使用的 AWS 區域 -
123456789012使用 AWS 您的帳戶 ID -
agentName與代理程式的名稱。您需要先決定代理程式名稱，才能建立角色和 AgentCore 執行期。
{ "Version":"2012-10-17", "Statement": [ { "Sid": "ECRImageAccess", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "arn:aws:ecr:us-east-1:123456789012:repository/*" ] }, { "Effect": "Allow", "Action": [ "logs:DescribeLogStreams", "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock-agentcore/runtimes/*" ] }, { "Effect": "Allow", "Action": [ "logs:PutResourcePolicy" ], "Resource": [ "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock-agentcore/runtimes/agentName-*" ] }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": [ "arn:aws:logs:us-east-1:123456789012:log-group:*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*" ] }, { "Sid": "ECRTokenAccess", "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Resource": "*", "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": "bedrock-agentcore" } } }, { "Sid": "GetAgentAccessToken", "Effect": "Allow", "Action": [ "bedrock-agentcore:GetWorkloadAccessToken", "bedrock-agentcore:GetWorkloadAccessTokenForJWT", "bedrock-agentcore:GetWorkloadAccessTokenForUserId" ], "Resource": [ "arn:aws:bedrock-agentcore:us-east-1:123456789012:workload-identity-directory/default", "arn:aws:bedrock-agentcore:us-east-1:123456789012:workload-identity-directory/default/workload-identity/agentName-*" ] }, {"Sid": "BedrockModelInvocation", "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:us-east-1:123456789012:*" ] } ] }
AgentCore 執行期信任政策
AgentCore 執行期執行角色必須包含下列信任政策，允許 AgentCore 執行期擔任該角色。
在政策中，取代：
-
us-east-1搭配您正在使用的 AWS 區域 -
123456789012使用 AWS 您的帳戶 ID
若要將信任政策新增至 AgentCore 執行期執行角色，請前往 AWS 管理主控台，導覽至角色，選擇信任關係索引標籤，然後選擇編輯信任政策。
{ "Version":"2012-10-17", "Statement": [ { "Sid": "AssumeRolePolicy", "Effect": "Allow", "Principal": { "Service": "bedrock-agentcore.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "123456789012" }, "ArnLike": { "aws:SourceArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:*" } } } ] }
