AWS bedrock-agentcore documentation change
Summary
Added documentation for two new connector targets: Amazon Bedrock Managed Knowledge Bases and Web Search Tool. Includes setup instructions, configuration examples (Boto3/AWS CLI), IAM role requirements, and security controls like domain filtering.
Security assessment
The change adds documentation for new features without addressing any specific vulnerability. It includes security documentation about IAM role configuration (permissions boundaries, resource scoping) and domain filtering capabilities that help prevent access to unwanted websites.
Diff
diff --git a/bedrock-agentcore/latest/devguide/gateway-add-target-api-target-config.md b/bedrock-agentcore/latest/devguide/gateway-add-target-api-target-config.md index e93e60828..7a3750aa8 100644 --- a//bedrock-agentcore/latest/devguide/gateway-add-target-api-target-config.md +++ b//bedrock-agentcore/latest/devguide/gateway-add-target-api-target-config.md @@ -7 +7 @@ -Add a Lambda targetAdd an API Gateway stage targetAdd an OpenAPI targetAdd a Smithy targetAdd an HTTP runtime targetAdd an MCP server target +Add a Lambda targetAdd an API Gateway stage targetAdd an OpenAPI targetAdd a Smithy targetAdd an HTTP runtime targetAdd an MCP server targetAdd a Connector target with Amazon Bedrock Managed Knowledge BasesAdd a Connector target with Web Search Tool @@ -28,0 +29,4 @@ Select a topic to see examples of adding a target type: + * Add a Connector target with Amazon Bedrock Managed Knowledge Bases + + * Add a Connector target with Web Search Tool + @@ -793,0 +798,440 @@ Boto3 +## Add a Connector target with Amazon Bedrock Managed Knowledge Bases + +You can add the Amazon Bedrock Managed Knowledge Bases connector as a target to your gateway. + +For more information about the Amazon Bedrock Managed Knowledge Bases connector, see [Amazon Bedrock Managed Knowledge Bases](./gateway-target-connector-managed-kb.html). + +### Set up a managed knowledge base + +The connector exposes two tools, each named after its backend operation: `AgenticRetrieveStream` (multi-step, streaming agentic retrieval) and `Retrieve` (a single hybrid search). You add a configuration entry per tool. + +For `AgenticRetrieveStream`, set `retrievers` (the managed knowledge bases to query) and `agenticRetrieveConfiguration` in `parameterValues`. Both are required — omitting `agenticRetrieveConfiguration` causes a runtime error. It can be an empty object (`{}`) to accept service-managed defaults, but specifying `foundationModelType` and `rerankingModelType` makes the configuration explicit. The agent does not supply knowledge base IDs at call time. For `Retrieve`, set the `knowledgeBaseId` in `parameterValues`; it is required. + +The connector supports only managed knowledge bases. Connector targets support only the `GATEWAY_IAM_ROLE` credential provider type. + +###### Example + +Boto3 + + + 1. The following Python code shows how to create a Gateway Target with the Amazon Bedrock Managed Knowledge Bases connector configuration using the AWS Python SDK (Boto3): + + import boto3 + + gateway_client = boto3.client("bedrock-agentcore-control", region_name="<REGION>") + + gateway_client.create_gateway_target( + name="managed-kb", + gatewayIdentifier="<GATEWAY_ID>", + targetConfiguration={ + "mcp": { + "connector": { + "source": {"connectorId": "bedrock-knowledge-bases"}, + "configurations": [ + { + "name": "AgenticRetrieveStream", + "parameterValues": { + "retrievers": [ + { + "description": "Product documentation", + "configuration": {"knowledgeBase": {"knowledgeBaseId": "<KB_ID_1>"}}, + }, + { + "description": "Engineering runbooks", + "configuration": {"knowledgeBase": {"knowledgeBaseId": "<KB_ID_2>"}}, + }, + ], + "agenticRetrieveConfiguration": { + "foundationModelType": "MANAGED", + "rerankingModelType": "MANAGED", + }, + }, + }, + { + "name": "Retrieve", + "parameterValues": {"knowledgeBaseId": "<KB_ID>"}, + }, + ], + } + } + }, + credentialProviderConfigurations=[ + {"credentialProviderType": "GATEWAY_IAM_ROLE"} + ], + ) + + + + +AWS CLI + + + 1. The following command creates a Gateway Target with the Amazon Bedrock Managed Knowledge Bases connector configuration using the AWS CLI: + + aws bedrock-agentcore-control create-gateway-target \ + --gateway-identifier "<GATEWAY_ID>" \ + --name "managed-kb" \ + --target-configuration '{ + "mcp": { + "connector": { + "source": { + "connectorId": "bedrock-knowledge-bases" + }, + "configurations": [ + { + "name": "AgenticRetrieveStream", + "parameterValues": { + "retrievers": [ + { + "description": "Product documentation", + "configuration": {"knowledgeBase": {"knowledgeBaseId": "<KB_ID_1>"}} + }, + { + "description": "Engineering runbooks", + "configuration": {"knowledgeBase": {"knowledgeBaseId": "<KB_ID_2>"}} + } + ], + "agenticRetrieveConfiguration": { + "foundationModelType": "MANAGED", + "rerankingModelType": "MANAGED" + } + } + }, + { + "name": "Retrieve", + "parameterValues": { + "knowledgeBaseId": "<KB_ID>" + } + } + ] + } + } + }' \ + --credential-provider-configurations '[{"credentialProviderType": "GATEWAY_IAM_ROLE"}]' \ + --region "<REGION>" + + + + +After you call `CreateGatewayTarget`, the Gateway validates the configuration asynchronously (typically within about 30 seconds), which includes a `GetKnowledgeBase` check on each bound knowledge base. Poll `GetGatewayTarget` until `status` is `READY`; a `FAILED` status includes a reason describing the problem. + +To customize agentic retrieval — for example, to cap planning iterations or attach a guardrail — add the optional fields to `agenticRetrieveConfiguration`. If you omit them, service-managed defaults apply. For all accepted values, see [Configuration reference](./gateway-target-connector-managed-kb.html#gateway-target-connector-managed-kb-config-reference). + + + { + "name": "AgenticRetrieveStream", + "parameterValues": { + "retrievers": [ + { "configuration": { "knowledgeBase": { "knowledgeBaseId": "<KB_ID>" } } } + ], + "agenticRetrieveConfiguration": { + "maxAgentIteration": 5, + "policyConfiguration": { + "guardrailConfiguration": { + "guardrailId": "<GUARDRAIL_ID>", + "guardrailVersion": "1" + } + } + } + } + } + +### Control which parameters the agent can set + +Each tool configuration entry accepts two parameter controls that determine what the calling agent sees and what the Gateway sends to the knowledge base: + + * `parameterValues` — administrator-set values sent to the knowledge base on every call, such as the bound `knowledgeBaseId` or a default `numberOfResults`. These are used unless the agent overrides a field you have exposed. + + * `parameterOverrides` — a list that controls which request fields the agent can see and set at call time. Each entry has: + + * `path` — the field in the `Retrieve` request, for example `$.retrievalQuery.text` or `$.retrievalConfiguration.managedSearchConfiguration.numberOfResults`. + + * `description` — optional text shown to the agent describing the field. + + * `visible` — set to `true` to expose the field to the agent, or `false` to hide it while still sending any administrator-configured default. + + + + +Bind `knowledgeBaseId` in `parameterValues` and do not expose it. + +The following configuration entry binds the knowledge base, sets a default of 10 results, and exposes the query text and result count to the agent: + + + { + "name": "Retrieve", + "description": "Search the knowledge base for relevant documents.", + "parameterValues": { + "knowledgeBaseId": "<KB_ID>", + "retrievalConfiguration": { + "managedSearchConfiguration": { + "numberOfResults": 10 + } + } + }, + "parameterOverrides": [ + { + "path": "$.retrievalQuery.text", + "description": "The search query. Use specific keywords for best results.", + "visible": true + }, + { + "path": "$.retrievalConfiguration.managedSearchConfiguration.numberOfResults", + "description": "Number of results to retrieve (1-100).", + "visible": true + } + ] + }