AWS bedrock-agentcore documentation change
Summary
Updated documentation for creating AgentCore gateways, changing from 'AgentCore starter toolkit' to 'AgentCore CLI' with new commands, adding interactive TUI instructions, and restructuring authorization configuration examples.
Security assessment
The changes primarily update tooling and command syntax without addressing specific vulnerabilities. However, they add documentation about security features including Custom JWT authorization configuration, IAM authorization limitations, and policy engine integration for security enforcement. The note about AgentCore CLI not supporting IAM authorization is a security consideration but not evidence of a security issue.
Diff
diff --git a/bedrock-agentcore/latest/devguide/gateway-create-api.md b/bedrock-agentcore/latest/devguide/gateway-create-api.md index e3b7b110c..b81e74d9c 100644 --- a//bedrock-agentcore/latest/devguide/gateway-create-api.md +++ b//bedrock-agentcore/latest/devguide/gateway-create-api.md @@ -63 +63 @@ If your authorizer type is `CUSTOM_JWT`, you must also include an authorizer con - "customClaims:" see below + "customClaims": see below @@ -183,16 +183 @@ Select one of the following methods: -AgentCore starter toolkit (CLI) - - -The AgentCore starter toolkit CLI provides a simple way to create a gateway in a command line interface. - -To create the gateway, you use the `create_mcp_gateway` method. The following list enumerates the default value used for each argument if you omit it: - - * **\--region** – us-west-2 - - * **\--name** – TestGateway + random alphanumeric sequence - - * **\--role-arn** – arn:aws:iam:::`your-account-id`:role/AgentCoreGatewayExecutionRole (if the role doesn't exist yet, it's automatically created for you) - - * **\--authorizer-config** – Creates an Amazon Cognito OAuth configuration for you. - - * **\--enable-semantic-search** – True +AgentCore CLI @@ -200,0 +186 @@ To create the gateway, you use the `create_mcp_gateway` method. The following li +The AgentCore CLI provides a simple way to create a gateway in a command line interface. @@ -201,0 +188 @@ To create the gateway, you use the `create_mcp_gateway` method. The following li +To create the gateway, you use the `agentcore add gateway` command. The gateway service role and Amazon Cognito authorization are automatically configured for you during deployment. @@ -205 +192 @@ To create the gateway, you use the `create_mcp_gateway` method. The following li -Run the following command in a terminal to create a gateway with default specifications: +Run the following command in a terminal to create a gateway with no authorization (the default). To add Custom JWT authorization, specify the authorizer flags as shown in the next example: @@ -208 +195 @@ Run the following command in a terminal to create a gateway with default specifi - agentcore create_mcp_gateway + agentcore add gateway --name my-gateway @@ -212 +199 @@ Run the following command in a terminal to create a gateway with default specifi -The following command shows how to create a gateway with overt arguments: +The following command shows how to create a gateway with Custom JWT authorization and explicit configuration: @@ -215,2 +202 @@ The following command shows how to create a gateway with overt arguments: - agentcore create_mcp_gateway \ - --region us-west-2 \ + agentcore add gateway \ @@ -218,31 +204,4 @@ The following command shows how to create a gateway with overt arguments: - --role-arn arn:aws:iam::123456789012:role/my-gateway-service-role \ - --authorizer-config '{ - "customJWTAuthorizer": { - "discoveryUrl": "https://cognito-idp.us-west-2.amazonaws.com/some-user-pool/.well-known/openid-configuration", - "allowedClients": ["clientId"] - } - }' \ - --enable_semantic_search - -The `gatewayUrl` in the response is the endpoint to use when you invoke the gateway. - -AgentCore starter toolkit (Python) - - -The AgentCore starter toolkit helps you easily create a gateway with minimal specification. First, you initialize a client and then you use the `create_mcp_gateway` method of the client. The following list enumerates the default value used for each argument if you omit it: - - * `GatewayClient` arguments: - - * **region_name** – us-west-2 - - * `GatewayClient create_mcp_gateway` method arguments: - - * **name** – TestGateway + random alphanumeric sequence - - * **role_arn** – arn:aws:iam:::`your-account-id`:role/AgentCoreGatewayExecutionRole (if the role doesn't exist yet, it's automatically created for you) - - * **authorizer_config** – Creates an Amazon Cognito OAuth configuration for you. - - * **enable_semantic_search** – True - - + --authorizer-type CUSTOM_JWT \ + --discovery-url "https://cognito-idp.us-west-2.amazonaws.com/some-user-pool/.well-known/openid-configuration" \ + --allowed-audience "api.example.com" + agentcore deploy @@ -249,0 +209 @@ The AgentCore starter toolkit helps you easily create a gateway with minimal spe +After deployment, the `gatewayUrl` shown by **agentcore status** is the endpoint to use when you invoke the gateway. @@ -251 +211 @@ The AgentCore starter toolkit helps you easily create a gateway with minimal spe -###### Using default arguments +Interactive @@ -253 +212,0 @@ The AgentCore starter toolkit helps you easily create a gateway with minimal spe -The following example code shows how to create a gateway with default specifications: @@ -254,0 +214 @@ The following example code shows how to create a gateway with default specificat +Run `agentcore` to open the TUI, then select **add** and choose **Gateway** : @@ -256 +216 @@ The following example code shows how to create a gateway with default specificat - from bedrock_agentcore_starter_toolkit.operations.gateway.client import GatewayClient + 1. Enter the gateway name: @@ -258,2 +218 @@ The following example code shows how to create a gateway with default specificat - # Initialize the Gateway client - client = GatewayClient() + @@ -261,2 +220 @@ The following example code shows how to create a gateway with default specificat - # Create a gateway with default configurations - gateway = client.create_mcp_gateway() + 2. Select **Custom JWT** as the authorizer type and press **Enter** : @@ -264 +222 @@ The following example code shows how to create a gateway with default specificat - print(f"MCP Endpoint: {gateway['gatewayUrl']}") + @@ -266 +224 @@ The following example code shows how to create a gateway with default specificat -###### Specifying arguments + 3. Configure advanced options: @@ -268 +226 @@ The following example code shows how to create a gateway with default specificat -The following example code shows how to use the AgentCore starter toolkit to set up a client, outbound authorization, and a gateway with your own arguments: + @@ -269,0 +228 @@ The following example code shows how to use the AgentCore starter toolkit to set + 4. Review the configuration summary and press **Enter** to confirm: @@ -271 +230 @@ The following example code shows how to use the AgentCore starter toolkit to set - from bedrock_agentcore_starter_toolkit.operations.gateway.client import GatewayClient + @@ -273,2 +231,0 @@ The following example code shows how to use the AgentCore starter toolkit to set - # Initialize the Gateway client - client = GatewayClient(region_name="us-west-2") @@ -276,12 +232,0 @@ The following example code shows how to use the AgentCore starter toolkit to set - # Create the gateway - gateway = client.create_mcp_gateway( - name="my-gateway", - role_arn="arn:aws:iam::123456789012:role/my-gateway-service-role", - authorizer_config={ - "customJWTAuthorizer": { - "discoveryUrl": "https://cognito-idp.us-west-2.amazonaws.com/some-user-pool/.well-known/openid-configuration", - "allowedClients": ["clientId"] - } - }, - enable_semantic_search=False - ) @@ -289 +233,0 @@ The following example code shows how to use the AgentCore starter toolkit to set - print(f"MCP Endpoint: {gateway['gatewayUrl']}") @@ -341,0 +286,4 @@ This section provides basic examples of creating a gateway using IAM authorizati +###### Note + +The AgentCore CLI does not support creating gateways with IAM authorization. Use the AWS Command Line Interface or AWS Python SDK (Boto3) to create a gateway with IAM authorization. + @@ -388 +336 @@ Select one of the following methods: -AgentCore starter toolkit (CLI) +AgentCore CLI @@ -391 +339 @@ AgentCore starter toolkit (CLI) -The AgentCore starter toolkit CLI provides a simple way to create a gateway with NONE authorizer type in a command line interface. +The AgentCore CLI provides a simple way to create a gateway with NONE authorizer type in a command line interface. @@ -396,2 +344 @@ The following command shows how to create a gateway with NONE authorizer type: - agentcore create_mcp_gateway \ - --region us-west-2 \ + agentcore add gateway \ @@ -399,3 +346,2 @@ The following command shows how to create a gateway with NONE authorizer type: - --role-arn arn:aws:iam::123456789012:role/my-gateway-service-role \ - --authorizer-type NONE \ - --enable_semantic_search + --authorizer-type NONE + agentcore deploy @@ -403 +349 @@ The following command shows how to create a gateway with NONE authorizer type: -The `gatewayUrl` in the response is the endpoint to use when you invoke the gateway. +After deployment, the `gatewayUrl` shown by **agentcore status** is the endpoint to use when you invoke the gateway. @@ -405 +351 @@ The `gatewayUrl` in the response is the endpoint to use when you invoke the gate -AgentCore starter toolkit (Python) +Interactive @@ -408 +354 @@ AgentCore starter toolkit (Python) -The AgentCore starter toolkit helps you easily create a gateway with NONE authorizer type. First, you initialize a client and then you use the `create_mcp_gateway` method of the client. +Run `agentcore` to open the TUI, then select **add** and choose **Gateway** : @@ -410 +356 @@ The AgentCore starter toolkit helps you easily create a gateway with NONE author -The following example code shows how to create a gateway with NONE authorizer type: + 1. Enter the gateway name: @@ -411,0 +358 @@ The following example code shows how to create a gateway with NONE authorizer ty + @@ -413 +360,11 @@ The following example code shows how to create a gateway with NONE authorizer ty - from bedrock_agentcore_starter_toolkit.operations.gateway.client import GatewayClient + 2. Select **NONE** as the authorizer type and press **Enter** : + + + + 3. Configure advanced options: + + + + 4. Review the configuration summary and press **Enter** to confirm: + + @@ -415,2 +371,0 @@ The following example code shows how to create a gateway with NONE authorizer ty - # Initialize the Gateway client - client = GatewayClient(region_name="us-west-2") @@ -418,7 +372,0 @@ The following example code shows how to create a gateway with NONE authorizer ty - # Create the gateway with NONE authorizer type - gateway = client.create_mcp_gateway( - name="my-gateway", - role_arn="arn:aws:iam::123456789012:role/my-gateway-service-role", - authorizer_type="NONE", - enable_semantic_search=False - ) @@ -426 +373,0 @@ The following example code shows how to create a gateway with NONE authorizer ty - print(f"MCP Endpoint: {gateway['gatewayUrl']}") @@ -469 +416 @@ Select one of the following methods: -AgentCore starter toolkit (CLI) +AgentCore CLI @@ -472 +419 @@ AgentCore starter toolkit (CLI) -By default, semantic search is enabled if you don't overtly specify the `--enable_semantic_search` flag when you send a `create_mcp_gateway` request using the AgentCore starter toolkit CLI, as in the following example: +By default, semantic search is enabled when you create a gateway using the AgentCore CLI. To disable it, use the `--no-semantic-search` flag. To create a gateway with default semantic search enabled: @@ -475 +422,2 @@ By default, semantic search is enabled if you don't overtly specify the `--enabl - agentcore create_mcp_gateway + agentcore add gateway --name my-gateway