AWS bedrock-agentcore documentation change
Summary
Updated examples to use AgentCore CLI instead of starter toolkit, changing the workflow to create/deploy gateway first then configure interceptors separately using AWS CLI or Boto3.
Security assessment
This change is primarily about tooling and workflow updates, moving from starter toolkit to CLI and changing the interceptor configuration process. There is no evidence of security vulnerability fixes or security feature additions in this change. The modifications appear to be routine documentation updates for tooling changes.
Diff
diff --git a/bedrock-agentcore/latest/devguide/gateway-interceptors-configuration.md b/bedrock-agentcore/latest/devguide/gateway-interceptors-configuration.md index baaae015c..9f444e736 100644 --- a//bedrock-agentcore/latest/devguide/gateway-interceptors-configuration.md +++ b//bedrock-agentcore/latest/devguide/gateway-interceptors-configuration.md @@ -28 +28 @@ The following examples show how to create a gateway with interceptors that have -AgentCore starter toolkit (CLI) +AgentCore CLI @@ -31 +31 @@ AgentCore starter toolkit (CLI) -Use the following command to create a gateway with interceptors configured to pass request headers: +With the AgentCore CLI, first create and deploy the gateway, then configure interceptors using the AWS CLI or AWS Python SDK (Boto3). @@ -32,0 +33 @@ Use the following command to create a gateway with interceptors configured to pa +Create the gateway: @@ -34,2 +35,2 @@ Use the following command to create a gateway with interceptors configured to pa - agentcore create_mcp_gateway \ - --region us-west-2 \ + + agentcore add gateway \ @@ -37,55 +38,6 @@ Use the following command to create a gateway with interceptors configured to pa - --role-arn arn:aws:iam::123456789012:role/my-gateway-service-role \ - --authorizer-config '{ - "customJWTAuthorizer": { - "discoveryUrl": "https://cognito-idp.us-west-2.amazonaws.com/some-user-pool/.well-known/openid-configuration", - "allowedClients": ["clientId"] - } - }' \ - --interceptor-configurations '[{ - "interceptor": { - "lambda": { - "arn":"arn:aws:lambda:us-west-2:123456789012:function:my-interceptor-lambda" - } - }, - "interceptionPoints": ["REQUEST", "RESPONSE"], - "inputConfiguration": { - "passRequestHeaders": true - } - }]' - -AgentCore starter toolkit (Python) - - -Use the following Python code to create a gateway with interceptors configured to pass request headers: - - - from bedrock_agentcore_starter_toolkit.operations.gateway.client import GatewayClient - - # Initialize the Gateway client - client = GatewayClient(region_name="us-west-2") - - # Create the gateway with interceptor configurations - gateway = client.create_mcp_gateway( - name="my-gateway-with-headers", - role_arn="arn:aws:iam::123456789012:role/my-gateway-service-role", - authorizer_config={ - "customJWTAuthorizer": { - "discoveryUrl": "https://cognito-idp.us-west-2.amazonaws.com/some-user-pool/.well-known/openid-configuration", - "allowedClients": ["clientId"] - } - }, - interceptor_configurations=[{ - "interceptor": { - "lambda": { - "arn":"arn:aws:lambda:us-west-2:123456789012:function:my-interceptor-lambda" - } - }, - "interceptionPoints": ["REQUEST", "RESPONSE"], - "inputConfiguration": { - "passRequestHeaders": True - } - }], - enable_semantic_search=False - ) - - print(f"MCP Endpoint: {gateway['gatewayUrl']}") + --authorizer-type CUSTOM_JWT \ + --discovery-url "https://cognito-idp.us-west-2.amazonaws.com/some-user-pool/.well-known/openid-configuration" \ + --allowed-audience "api.example.com" + agentcore deploy + +After deployment, configure interceptors on the gateway using the AWS CLI `update-gateway` command or the AWS Python SDK (Boto3) as shown in the other tabs.