AWS bedrock-agentcore documentation change
Summary
Expanded documentation for adding gateway targets with detailed configuration steps, API examples, and authentication methods. Added console/API workflows, code samples for Lambda/OpenAPI/Smithy targets, and credential configuration details.
Security assessment
The changes add documentation about security-related configurations including credential provider setups (API keys, OAuth, IAM roles) and outbound authorization methods. However, there's no indication these changes address a specific security vulnerability - they document standard security practices for feature implementation.
Diff
diff --git a/bedrock-agentcore/latest/devguide/gateway-building-adding-targets.md b/bedrock-agentcore/latest/devguide/gateway-building-adding-targets.md index 0fde2878a..7b401cef6 100644 --- a//bedrock-agentcore/latest/devguide/gateway-building-adding-targets.md +++ b//bedrock-agentcore/latest/devguide/gateway-building-adding-targets.md @@ -5 +5 @@ -Amazon Bedrock AgentCore is in preview release and is subject to change. +Add a target using the AWS Management ConsoleAdd a target using the API @@ -7 +7 @@ Amazon Bedrock AgentCore is in preview release and is subject to change. -# Add targets to an existing gateway +# Add targets to an existing AgentCore gateway @@ -11 +11,23 @@ After creating a gateway, you can add targets, which define the tools that your -The following topics explain how target names are constructed for a gateway, how to set up outbound authorization for a target, and how to create different target types. +When you add a target, you provide the following required fields: + + * The ID of the gateway to which to add the target. + + * A name for the gateway target. To understand how the target name affects tool names, see [Understand how AgentCore Gateway tools are named](./gateway-tool-naming.html). + + * A target configuration. The configuration differs depending on your gateway target type. + + * A credential provider configuration. The configuration depends on the [outbound authorization](./gateway-outbound-auth.html). + + + + +You can optionally provide the following fields: + + * A description of the gateway target. + + * A client token value to ensure that a request completes no more than once. If you don't include this token, one is randomly generated for you. If you don't include a value, one is randomly generated for you. For more information, see [Ensuring idempotency](https://docs.aws.amazon.com/ec2/latest/devguide/ec2-api-idempotency.html). + + + + +Select a topic to learn how to add a target to an existing gateway using that method: @@ -15 +37,345 @@ The following topics explain how target names are constructed for a gateway, how - * [Understand how AgentCore Gateway tools are named](./gateway-target-naming.html) + * Add a target using the AWS Management Console + + * Add a target using the API + + + + +## Add a target using the AWS Management Console + +In the AWS Management Console, you can add gateway targets when you create the gateway. After you've created a gateway, you can add targets by doing the following: + +###### To add a target to an existing gateway + + 1. Open the AgentCore console at [https://console.aws.amazon.com/bedrock-agentcore/home#](https://console.aws.amazon.com/bedrock-agentcore/home#). + + 2. Choose **Gateways**. + + 3. Select the gateway to which you want to add a target. + + 4. In the **Targets** section, choose **Add**. + + 5. (Optional) Change the auto-generated **Target name**. + + 6. (Optional) Provide an **Target description**. + + 7. Select the **Target type** and fill in the fields that appear. + + 8. (If applicable) Choose whether to define the target inline or by selecting an S3 location. + + 9. Select a supported outbound authorization configuration and choose the outbound authorization resource, if applicable. + + 10. (Optional, if applicable) Expand **Additional configurations** and configure them. + + 11. Choose **Add target**. + + + + +## Add a target using the API + +To add a target using the API, make a [CreateGatewayTarget](https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_CreateGatewayTarget.html) request with one of the [AgentCore control plane endpoints](https://docs.aws.amazon.com/general/latest/gr/bedrock_agentcore.html#bedrock_agentcore_cp). + +To see examples of adding different target types, expand the following sections: + +Select one of the following methods: + +AgentCore CLI + + + + # Create a gateway with Lambda target + agentcore create_mcp_gateway_target \ + --region us-east-1 \ + --gateway-arn arn:aws:bedrock-agentcore:us-east-1:123456789012:gateway/gateway-id \ + --gateway-url https://gateway-id.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp \ + --role-arn arn:aws:iam::123456789012:role/BedrockAgentCoreGatewayRole \ + --target-type lambda + + +AgentCore starter toolkit + + +With the AgentCore starter toolkit, you can easily create a Lambda target with default configurations.s + + + # Import dependencies + from bedrock_agentcore_starter_toolkit.operations.gateway.client import GatewayClient + + # Initialize the client + client = GatewayClient(region_name="us-east-1") + + # Create a lambda target. + lambda_target = client.create_mcp_gateway_target( + gateway=gateway, + name=None, # If you don't set one, one will be generated. + target_type="lambda", + target_payload=None, # Define your own lambda if you pre-created one. Otherwise leave this as None and one will be created for you. + credentials=None, # If you leave this as None, one will be created for you + ) + + +The following is an example argument you can provide for the `target_payload`. If you omit the `target_payload` argument, this payload is used: + + + { + "lambdaArn": "<insert your lambda arn>", + "toolSchema": { + "inlinePayload": [ + { + "name": "get_weather", + "description": "Get weather for a location", + "inputSchema": { + "type": "object", + "properties": { + "location": { + "type": "string", + "description": "the location e.g. seattle, wa" + } + }, + "required": [ + "location" + ] + } + }, + { + "name": "get_time", + "description": "Get time for a timezone", + "inputSchema": { + "type": "object", + "properties": { + "timezone": { + "type": "string" + } + }, + "required": [ + "timezone" + ] + } + } + ] + } + } + +Boto3 + + +The following Python code shows how to add a Lambda target using the Boto3 Python SDK: + + + import boto3 + + # Create the agentcore client + agentcore_client = boto3.client('bedrock-agentcore-control') + + # Create a Lambda target + target = agentcore_client.create_gateway_target( + gatewayIdentifier="your-gateway-id", + name="LambdaTarget", + targetConfiguration={ + "mcp": { + "lambda": { + "lambdaArn": "arn:aws:lambda:us-west-2:123456789012:function:YourLambdaFunction", + "toolSchema": { + "inlinePayload": [ + { + "name": "get_weather", + "description": "Get weather for a location", + "inputSchema": { + "type": "object", + "properties": {"location": {"type": "string"}}, + "required": ["location"], + }, + }, + { + "name": "get_time", + "description": "Get time for a timezone", + "inputSchema": { + "type": "object", + "properties": {"timezone": {"type": "string"}}, + "required": ["timezone"], + }, + }, + ]