AWS bedrock-agentcore medium security documentation change
Summary
Added AWS CLI/jq requirement, updated OAuth callback URL handling instructions, and added session binding parameter
Security assessment
Explicit instructions to add callback URLs to Google apps and proper session binding help prevent OAuth misconfiguration vulnerabilities. The changes address secure implementation of OAuth2 flows by ensuring proper redirect URI validation.
Diff
diff --git a/bedrock-agentcore/latest/devguide/runtime-oauth.md b/bedrock-agentcore/latest/devguide/runtime-oauth.md index 781bfcc45..485e1e1fd 100644 --- a//bedrock-agentcore/latest/devguide/runtime-oauth.md +++ b//bedrock-agentcore/latest/devguide/runtime-oauth.md @@ -111,0 +112,2 @@ Before you begin, make sure you have: + * The latest AWS CLI and `jq` installed + @@ -164 +166 @@ To set up a Cognito user pool and create a user, you'll use a shell script that -For more information, see [Step 2: Set up an OAuth 2.0 Credential Provider](./identity-getting-started-google.html#identity-getting-started-step2). +For more information, see [Step 2: Import Identity and Auth modules](./identity-getting-started-google.html#identity-getting-started-step2). @@ -501 +504 @@ To set up a Google Credential Provider, you need to: - aws bedrock-agentcore-control create-oauth2-credential-provider \ + OAUTH2_CREDENTIAL_PROVIDER_RESPONSE=$(aws bedrock-agentcore-control create-oauth2-credential-provider \ @@ -509 +512,10 @@ To set up a Google Credential Provider, you need to: - }' + }' \ + --output json) + + OAUTH2_CALLBACK_URL=$(echo $OAUTH2_CREDENTIAL_PROVIDER_RESPONSE | jq -r '.callbackUrl') + + echo "OAuth2 Callback URL: $OAUTH2_CALLBACK_URL" + +###### Note + +Obtain the `callbackUrl` from the [ CreateOauth2CredentialProvider ](https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_CreateOauth2CredentialProvider.html) response above and add the URI to your Google application's redirect URI list. The callback URL should look like: ` https://bedrock-agentcore.us-east-1.amazonaws.com/identities/oauth2/callback/********-****-****-****-************` @@ -530,0 +543 @@ Create a tool with agent core SDK annotations as shown below to automatically in + callback_url='insert_oauth2_callback_url_for_session_binding'