AWS bedrock-agentcore documentation change
Summary
Expanded SigV4 authorization requirements to include OpenAPI targets and updated service examples
Security assessment
Changes clarify authentication requirements for API targets and improve documentation of security features (SigV4 signing). No specific vulnerability is addressed.
Diff
diff --git a/bedrock-agentcore/latest/devguide/gateway-building-adding-targets-authorization.md b/bedrock-agentcore/latest/devguide/gateway-building-adding-targets-authorization.md index 8a2b58929..c93150536 100644 --- a//bedrock-agentcore/latest/devguide/gateway-building-adding-targets-authorization.md +++ b//bedrock-agentcore/latest/devguide/gateway-building-adding-targets-authorization.md @@ -39 +39 @@ The `iamCredentialProvider` configuration is not needed because the target servi -**For MCP server targets** +**For MCP server and OpenAPI targets** @@ -41 +41 @@ The `iamCredentialProvider` configuration is not needed because the target servi -For MCP server targets, you must also provide an `iamCredentialProvider` with the service name used for [AWS Signature Version 4 (Sig V4)](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html) signing. The `service` field is required. The `region` field is optional and defaults to the gateway’s Region. +For MCP server and OpenAPI targets, you must also provide an `iamCredentialProvider` with the service name used for [AWS Signature Version 4 (Sig V4)](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html) signing. The `service` field is required. The `region` field is optional and defaults to the gateway’s Region. @@ -48 +48 @@ For MCP server targets, you must also provide an `iamCredentialProvider` with th - "service": "bedrock-agentcore", + "service": "execute-api", @@ -58 +58,7 @@ Field | Required | Description -`service` | Yes | The AWS service name used for SigV4 signing. This value must match the service name that the target expects when verifying the SigV4 signature. The following are common values: `bedrock-agentcore` – For MCP servers hosted on Amazon Bedrock AgentCore, such as the runtime (see [Deploy MCP servers in AgentCore Runtime](./runtime-mcp.html) ) or another gateway. `execute-api` – For MCP servers behind Amazon API Gateway. `lambda` – For MCP servers behind Lambda Function URLs. +`service` | Yes | The AWS service name used for SigV4 signing. This value must match the service name that the target expects when verifying the SigV4 signature. The following are common values: + + * `bedrock-agentcore` – For MCP servers hosted on Amazon Bedrock AgentCore, such as the runtime (see [Deploy MCP servers in AgentCore Runtime](./runtime-mcp.html)) or another gateway. + * `execute-api` – For MCP servers or OpenAPI targets behind Amazon API Gateway. + * `lambda` – For MCP servers behind Lambda Function URLs. + +