AWS bedrock-agentcore documentation change
Summary
Restructured documentation for Lambda targets with emphasis on key considerations, tool schema definitions, and input format. Removed detailed CLI/SDK examples and added limitations section.
Security assessment
Changes focus on documentation structure and schema definitions rather than addressing security vulnerabilities. While permission configuration is mentioned, there's no evidence of specific security fixes or vulnerability disclosures. The 'key considerations' section includes operational best practices but no explicit security controls.
Diff
diff --git a/bedrock-agentcore/latest/devguide/gateway-add-target-lambda.md b/bedrock-agentcore/latest/devguide/gateway-add-target-lambda.md index faa678202..ff0ce01b0 100644 --- a//bedrock-agentcore/latest/devguide/gateway-add-target-lambda.md +++ b//bedrock-agentcore/latest/devguide/gateway-add-target-lambda.md @@ -5 +5 @@ -PrerequisitesConfiguring permissionsAdding a Lambda targetLambda function schemaAdding multiple tools to a Lambda targetUsing S3 for tool schemasLambda function input format +Key considerations and limitationsLambda function tool schemaLambda function input format @@ -7,3 +7 @@ PrerequisitesConfiguring permissionsAdding a Lambda targetLambda function schema -Amazon Bedrock AgentCore is in preview release and is subject to change. - -# Add Lambda targets to your gateway +# AWS Lambda function targets @@ -13,21 +11 @@ Lambda targets allow you to connect your gateway to AWS Lambda functions that im -To add a Lambda target, you need: - - * A Lambda function ARN - - * A tool schema that defines the tools implemented by your Lambda function - - * Credential Provider configuration for how the Gateway authenticates with the Lambda function - - - - -## Prerequisites - -Before adding a Lambda target, ensure you have: - - * Created a Gateway: Follow the instructions in the "Set Up Gateway" guide to create your Gateway - - * Created a Lambda Function: Create a Lambda function that implements the tools you want to expose - - * Configured Permissions: Ensure your Gateway's execution role has permission to invoke the Lambda function - +You create a Lambda function using the AWS Lambda service. In order to create the function, you should do the following: @@ -34,0 +13 @@ Before adding a Lambda target, ensure you have: + * Create a tool schema that defines the tools that your Lambda function can call. @@ -35,0 +15 @@ Before adding a Lambda target, ensure you have: + * Understand the Lambda input format. You can then follow the steps in the [AWS Lambda Developer Guide](https://docs.aws.amazon.com/lambda/latest/dg/) for **Building with** the language of your choice. @@ -37 +16,0 @@ Before adding a Lambda target, ensure you have: -## Configuring permissions @@ -39 +17,0 @@ Before adding a Lambda target, ensure you have: -For Lambda function targets, your Gateway's execution role needs the `lambda:InvokeFunction` permission: @@ -41 +18,0 @@ For Lambda function targets, your Gateway's execution role needs the `lambda:Inv -(Optional) Additionally, if your Lambda function was created in an account that's different from where the Gateway is being set up, it needs a resource-based policy that allows the Gateway's execution role to invoke it: @@ -43 +20 @@ For Lambda function targets, your Gateway's execution role needs the `lambda:Inv -You can add this policy using the AWS CLI: +After you create the function, you configure permissions for the gateway to be able to access it. @@ -44,0 +22 @@ You can add this policy using the AWS CLI: +Review the key considerations and limitations to help you decide whether a Lambda target is applicable to your use case. If it is, you can create the tool schema and the Lambda function and then set up permissions for the gateway to be able to access the target. Select a topic to learn more: @@ -46,6 +24 @@ You can add this policy using the AWS CLI: - aws lambda add-permission \ - --function-name "YourLambdaFunction" \ - --statement-id "GatewayInvoke" \ - --action "lambda:InvokeFunction" \ - --principal "arn:aws:iam::{{accountId}}:role/YourGatewayExecutionRole" \ - --region {{region}} +###### Topics @@ -52,0 +26 @@ You can add this policy using the AWS CLI: + * Key considerations and limitations @@ -54 +28 @@ You can add this policy using the AWS CLI: -## Adding a Lambda target + * Lambda function tool schema @@ -56 +30 @@ You can add this policy using the AWS CLI: -You can add a Lambda target to your Gateway using one of the following methods: + * Lambda function input format @@ -58 +31,0 @@ You can add a Lambda target to your Gateway using one of the following methods: -CLI @@ -61 +33,0 @@ CLI -The AgentCore CLI provides a simple way to add Lambda targets: @@ -62,0 +35 @@ The AgentCore CLI provides a simple way to add Lambda targets: +## Key considerations and limitations @@ -64,7 +37 @@ The AgentCore CLI provides a simple way to add Lambda targets: - # Create a Gateway with Lambda target - agentcore create_mcp_gateway_target \ - --region us-east-1 \ - --gateway-arn arn:aws:bedrock-agentcore:us-east-1:123456789012:gateway/gateway-id \ - --gateway-url https://gateway-id.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp \ - --role-arn arn:aws:iam::123456789012:role/BedrockAgentCoreGatewayRole \ - --target-type lambda +When working with Lambda targets, be aware of the following limitations and considerations: @@ -71,0 +39 @@ The AgentCore CLI provides a simple way to add Lambda targets: + * Tool name prefixes will need to be manually stripped off from the toolname in your AWS Lambda function. For more information, see [Understand how AgentCore Gateway tools are named](./gateway-tool-naming.html). @@ -73 +41 @@ The AgentCore CLI provides a simple way to add Lambda targets: -Console + * If you are using an existing AWS Lambda function and import it as a tool into the gateway, you will need to change the function code to account for a schema change for event and context objects @@ -74,0 +43 @@ Console + * The Lambda function must return a valid JSON response that can be parsed by the gateway @@ -76 +45 @@ Console -###### To add a target to an existing gateway + * Lambda function timeouts should be configured appropriately to handle the expected processing time of your tools @@ -78 +47 @@ Console - 1. Open the AgentCore console at [https://console.aws.amazon.com/bedrock-agentcore/home#](https://console.aws.amazon.com/bedrock-agentcore/home#). + * Consider implementing error handling in your LLambda function to provide meaningful error messages to the client @@ -80 +48,0 @@ Console - 2. Select the gateway to which you want to add a target. @@ -82 +49,0 @@ Console - 3. Choose the **Targets** tab. @@ -84 +50,0 @@ Console - 4. Choose **Add target**. @@ -86 +52 @@ Console - 5. Enter a **Target name**. +## Lambda function tool schema @@ -88 +54 @@ Console - 6. (Optional) Provide an optional **Target description**. +This section explains the structure of the tool schema that defines a tool that your Lambda function can return. After you define your tool schema, you can do one of the following: @@ -90 +56 @@ Console - 7. For **Target type** , choose **Lambda function**. + * Upload it to an Amazon S3 bucket and refer to the S3 location when you add the target to your gateway. @@ -92 +58 @@ Console - 8. For **Lambda function** , enter the ARN of your Lambda function. + * Paste the definition inline when you add the target to your gateway. @@ -94 +59,0 @@ Console - 9. For **Tool schema** , choose to either provide the schema inline or reference an Amazon S3 location containing your tool schema. @@ -96 +60,0 @@ Console - 10. In the **Outbound authentication** section, configure authentication for accessing the Lambda function: @@ -98 +61,0 @@ Console - 1. For **Authentication type** , choose **GATEWAY_IAM_ROLE**. @@ -100 +63 @@ Console - 11. Choose **Add target**. +Select a topic to learn more about the details of the tool schema or to see examples: @@ -101,0 +65 @@ Console +###### Topics @@ -102,0 +67 @@ Console + * Tool definition @@ -103,0 +69 @@ Console + * Top level schema definition for input and output schemas @@ -105 +71 @@ Console -AgentCore SDK + * Property schema definition @@ -106,0 +73 @@ AgentCore SDK + * Example Lambda tool definitions @@ -108 +74,0 @@ AgentCore SDK -You can add a Lambda target using the AgentCore SDK: @@ -111,8 +76,0 @@ You can add a Lambda target using the AgentCore SDK: - # create a lambda target. - lambda_target = client.create_mcp_gateway_target( - gateway=gateway, - name=None, # the name of the Target - if you don't set one, one will be generated. - target_type="lambda", # the type of the Target - you will see other target types later in the tutorial. - target_payload=None, # the target details - set this to define your own lambda if you pre-created one. Otherwise leave this None and one will be created for you. - credentials=None, # you will see later in the tutorial how to use this to connect to APIs using API keys and OAuth credentials. - ) @@ -119,0 +78 @@ You can add a Lambda target using the AgentCore SDK: +### Tool definition @@ -121 +80 @@ You can add a Lambda target using the AgentCore SDK: -Example of target_payload for Lambda. Note this Lambda will be created for you if you don't provide a target_payload: +When you add a Lambda function as a gateway target, you provide a [ToolDefinition](https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_ToolDefinition.html) when providing the target configuration. The structure of the tool definition is as follows: @@ -125,6 +84,2 @@ Example of target_payload for Lambda. Note this Lambda will be created for you i - "lambdaArn": "<insert your lambda arn>", - "toolSchema": { - "inlinePayload": [ - { - "name": "get_weather", - "description": "Get weather for a location", + "name": "string", + "description": "string", @@ -132,0 +88 @@ Example of target_payload for Lambda. Note this Lambda will be created for you i + "description" "string", @@ -134,4 +90 @@ Example of target_payload for Lambda. Note this Lambda will be created for you i - "location": { - "type": "string", - "description": "the location e.g. seattle, wa" - } + "string": [SchemaDefinition](https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_SchemaDefinition.html) @@ -139,4 +92 @@ Example of target_payload for Lambda. Note this Lambda will be created for you i - "required": [ - "location" - ] - } + "required": ["string"] @@ -144,4 +94 @@ Example of target_payload for Lambda. Note this Lambda will be created for you i - { - "name": "get_time", - "description": "Get time for a timezone", - "inputSchema": { + "outputSchema": { @@ -148,0 +96 @@ Example of target_payload for Lambda. Note this Lambda will be created for you i + "description" "string", @@ -150,3 +98 @@ Example of target_payload for Lambda. Note this Lambda will be created for you i - "timezone": { - "type": "string" - } + "string": [SchemaDefinition](https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_SchemaDefinition.html) @@ -154,6 +100 @@ Example of target_payload for Lambda. Note this Lambda will be created for you i - "required": [ - "timezone" - ] - } - } - ] + "required": ["string"] @@ -162,0 +104 @@ Example of target_payload for Lambda. Note this Lambda will be created for you i +The tool definition contains the following fields: @@ -164 +106 @@ Example of target_payload for Lambda. Note this Lambda will be created for you i -Boto3 + * **name** (required) – The name of the tool. @@ -165,0 +108 @@ Boto3 + * **description** (required) – A description of the tool and its purpose and usage. @@ -167 +110 @@ Boto3