AWS bedrock-agentcore documentation change
Summary
Added detailed documentation for creating registry records via synchronization from external endpoints, including configuration for IAM and OAuth authorization, and updated manual creation and editing processes.
Security assessment
The changes document new security features for authorizing connections to external endpoints (IAM roles for SigV4 signing and OAuth via AgentCore Identity). This adds security documentation but does not indicate a fix for a specific vulnerability. The changes are feature enhancements for secure synchronization.
Diff
diff --git a/bedrock-agentcore/latest/devguide/registry-create-manage-records.md b/bedrock-agentcore/latest/devguide/registry-create-manage-records.md index 73292e0d8..000e44e58 100644 --- a//bedrock-agentcore/latest/devguide/registry-create-manage-records.md +++ b//bedrock-agentcore/latest/devguide/registry-create-manage-records.md @@ -19 +19,39 @@ Create a registry recordList registry recordsView record detailsUpdate a registr - 3. Under **Record details** , enter: + 3. Choose a source type: + + 1. **Synchronize from endpoint** — Provide an endpoint URL and optional credentials to invoke the endpoint, and the registry fetches metadata from the source. Available for MCP and Agent record types only. To update the record after the source changes, you must manually trigger synchronization. See [Synchronize records from external sources](./registry-sync-records.html) for details. + + 2. **Manual** — Manually configure the record details and protocol configuration. + + + + +**Synchronize from endpoint** + + 1. Under **Record details** , select the record type: **MCP** or **Agent**. + +###### Note + +Synchronization is only supported for MCP and Agent record types. Agent Skills and Custom record types do not support synchronization — use the Manual source type instead. + + 2. Enter the **Endpoint** URL. Must be a valid HTTPS URL. + + 3. Under **Credential type** , choose how the registry authorizes with the endpoint: + + 1. **IAM** — Provide a **Role ARN** for SigV4 signing and a **Service** name (e.g., `bedrock-agentcore`, `execute-api`, `lambda`). Optionally specify a **Region** for signing. + + 2. **OAuth** — Select or enter a **Credential provider** ARN from AgentCore Identity. Optionally configure **Scopes** and **Custom parameters** under Additional configuration. + + 3. **None** — No authorization (for public endpoints). + + 4. Choose **Create record**. + +The record is created in CREATING status. The registry connects to the endpoint, extracts metadata, and populates the record’s descriptors. After synchronization completes, the record transitions to DRAFT. If synchronization fails, the record transitions to CREATE_FAILED status with the error details available in the Status Reason field on the record detail page. For troubleshooting, see [Record synchronization errors](./registry-troubleshooting.html#registry-troubleshooting-sync-errors). To update the record when the source changes, use the **Sync** button on the record detail page or select **Re-sync from endpoint** during editing. + + + + +For AWS CLI and SDK examples of creating records with synchronization, see [Synchronize records from external sources](./registry-sync-records.html). + +**Manual** + + 1. Under **Record details** , enter: @@ -27 +65 @@ Create a registry recordList registry recordsView record detailsUpdate a registr - 4. Under **Record type** , select one of: **MCP** , **Agent** , **Agent Skills** , or **Custom**. + 2. Under **Record type** , select one of: **MCP** , **Agent** , **Agent Skills** , or **Custom**. @@ -29 +67 @@ Create a registry recordList registry recordsView record detailsUpdate a registr - 5. A type-specific editor appears. Enter your protocol configuration in JSON format. + 3. A type-specific editor appears. Enter your protocol configuration in JSON format. @@ -35 +73 @@ Create a registry recordList registry recordsView record detailsUpdate a registr - 6. Choose one of: + 4. Choose one of: @@ -134 +172,3 @@ Create a registry recordList registry recordsView record detailsUpdate a registr - 2. **Protocol configuration** section — The descriptor content displayed as formatted JSON (e.g., "Agent card" for A2A records, "Server" and "Tools" for MCP records). + 2. **Synchronization configuration** section (if configured) — Synchronization type, Source URL, and credential provider details (IAM role ARN, service, region or OAuth provider ARN, grant type, scopes, custom parameters). + + 3. **Protocol configuration** section — The descriptor content displayed as formatted JSON (e.g., "Agent card" for A2A records, "Server" and "Tools" for MCP records). @@ -138 +178 @@ Create a registry recordList registry recordsView record detailsUpdate a registr - 1. **Update status** dropdown — Submit for approval, Approve, Reject, or Deprecate. + 1. **Sync** button (MCP and Agent records only) — Triggers a fresh synchronization from the configured endpoint. Opens a confirmation dialog before proceeding. The record transitions to UPDATING status during synchronization. @@ -140 +180,3 @@ Create a registry recordList registry recordsView record detailsUpdate a registr - 2. **Three-dot menu (⋮)** — Edit or Delete. + 2. **Update status** dropdown — Submit for approval, Approve, Reject, or Deprecate. + + 3. **Three-dot menu (⋮)** — Edit or Delete. @@ -180 +222 @@ Create a registry recordList registry recordsView record detailsUpdate a registr - 2. **Protocol configuration** in the JSON editor. + 2. **Record type** — Change the protocol type if needed. @@ -182 +224 @@ Create a registry recordList registry recordsView record detailsUpdate a registr - 3. The console validates your JSON against the official schema and shows inline errors with a **Diagnose with Amazon Q** button. + 3. (MCP and Agent records only) Under **Synchronize from endpoint** , optionally configure synchronization: @@ -184 +226,17 @@ Create a registry recordList registry recordsView record detailsUpdate a registr - 4. Choose one of: +You can update records via synchronization regardless of whether they were originally created with synchronization. When synchronization is triggered during an update, the record transitions to UPDATING status. If it succeeds, a new record version is created in DRAFT status. If it fails, the record transitions to UPDATE_FAILED status with error details in the Status Reason field. The synchronized data overwrites the record’s name, description, version, tool definitions, and server definitions with the values found at the source, but does not modify fields that the source does not provide. An admin or curator must review and approve the new draft for it to become visible in search. Until then, the previous approved revision (if any) remains searchable. For more information on dual-revision behavior, see [Record lifecycle](./registry-record-lifecycle.html). + + 1. Enter an **Endpoint** URL to enable synchronization. Credential type fields appear when an endpoint is provided. If the record already has synchronization configured, the endpoint and credential provider fields are pre-populated with the existing configuration. + + 2. Choose a **Credential type** (IAM, OAuth, or None) and fill in the required fields. If the record was previously configured with a credential provider, the existing values are pre-filled. + + 3. Select **Re-sync from endpoint** to trigger a fresh synchronization when saving. The record transitions to UPDATING status during synchronization. + + 4. To remove synchronization, choose the clear button next to the endpoint field. This resets the endpoint and all credential fields. + + 4. Under **Record configuration** , update the record’s definitions in the JSON editor. + + 1. You can configure both the endpoint for synchronization and manually edit the record’s definitions. When synchronization is triggered, the registry fetches the latest metadata from the endpoint and updates the record’s name, description, version, tool definitions, and server definitions with the values found at the source, taking precedence over any manual edits to those fields. Fields that the source does not provide are not modified. + + 5. The console validates your JSON against the official schema and shows inline errors with a **Diagnose with Amazon Q** button. + + 6. Choose one of: