AWS bedrock-agentcore documentation change
Summary
Added extensive CLI examples and workflows for payment operations including credential storage, payment manager/connector creation, instrument funding, session management, and payment processing. Enhanced SDK examples and added AgentCore CLI alternatives throughout.
Security assessment
The changes document payment processing workflows involving sensitive operations like credential storage (API keys/secrets), crypto wallet management, and transaction processing. While these are security-relevant features, there's no evidence of addressing a specific vulnerability. Changes improve documentation of existing security features without patching weaknesses.
Diff
diff --git a/bedrock-agentcore/latest/devguide/payments-getting-started.md b/bedrock-agentcore/latest/devguide/payments-getting-started.md index 7503ef900..24a81173d 100644 --- a//bedrock-agentcore/latest/devguide/payments-getting-started.md +++ b//bedrock-agentcore/latest/devguide/payments-getting-started.md @@ -35,0 +36,4 @@ Verify your credentials are configured: +###### Tip + +If you have the AgentCore CLI v0.19.0 or later installed, you can use CLI commands as an alternative to the SDK in Steps 2, 3, 5, and 6. Each step below shows both options. + @@ -135,0 +140,4 @@ For the complete request and response schema, see [CreatePaymentCredentialProvid +### CLI alternative: Store credentials + +With the AgentCore CLI, credential storage happens automatically when you add a payment connector (Step 3). Skip this step if you plan to use the CLI path. + @@ -139,0 +148,19 @@ A Payment Manager is the top-level resource that coordinates payment operations. +###### Example + +AWS CLI + + +Create the Payment Manager: + + + aws bedrock-agentcore-control create-payment-manager \ + --name "my-first-payment-manager" \ + --authorizer-type AWS_IAM \ + --role-arn "<YOUR_SERVICE_ROLE_ARN>" \ + --region us-west-2 + +After the manager reaches `READY` status, create a credential provider and connector. See [Create a Payment Manager and Connector](./payments-create-manager.html) for the full AWS CLI workflow. + +AWS SDK + + @@ -163,4 +190 @@ Then create the Payment Connector for your provider: -###### Example - -Coinbase CDP - +**Coinbase CDP:** @@ -178,2 +202 @@ Coinbase CDP -Privy - +**Privy:** @@ -192,0 +216,52 @@ If you do not have a service role, see [IAM roles for AgentCore payments](./paym +AgentCore CLI + + +The CLI creates the credential provider, Payment Manager, and Payment Connector in one flow. From your AgentCore project directory, add a payment manager and connector together. + +**Interactive wizard:** + + + agentcore add payment-manager + +The wizard prompts for the manager name, pattern (interceptor), auto-payment toggle, and default spend limit. It then asks whether to add a connector and walks through provider selection and credential input. + +**Non-interactive (Coinbase CDP):** + + + agentcore add payment-manager \ + --name my-payment-manager \ + --auto-payment \ + --default-spend-limit 5.00 + + agentcore add payment-connector \ + --manager my-payment-manager \ + --name my-coinbase-connector \ + --provider CoinbaseCDP \ + --api-key-id <YOUR_CDP_API_KEY_ID> \ + --api-key-secret <YOUR_CDP_API_KEY_SECRET> \ + --wallet-secret <YOUR_CDP_WALLET_SECRET> + +**Non-interactive (Privy):** + + + agentcore add payment-manager \ + --name my-payment-manager \ + --auto-payment \ + --default-spend-limit 5.00 + + agentcore add payment-connector \ + --manager my-payment-manager \ + --name my-privy-connector \ + --provider StripePrivy \ + --app-id <YOUR_PRIVY_APP_ID> \ + --app-secret <YOUR_PRIVY_APP_SECRET> \ + --authorization-id <YOUR_PRIVY_AUTHORIZATION_ID> \ + --authorization-private-key <YOUR_PRIVY_PRIVATE_KEY_BASE64> + +After adding, deploy to provision the payment infrastructure: + + + agentcore deploy + +The deploy step creates IAM roles, stores credentials in AgentCore Identity, and provisions the Payment Manager and Connector. You will see "Creating payment infrastructure…" in the output. + @@ -196,0 +272,25 @@ A payment instrument is an embedded crypto wallet that your agent uses to pay me +###### Example + +AWS CLI + + + + aws bedrock-agentcore create-payment-instrument \ + --payment-manager-arn "$PAYMENT_MANAGER_ARN" \ + --payment-connector-id "$PAYMENT_CONNECTOR_ID" \ + --user-id "test-user-123" \ + --payment-instrument-type "EMBEDDED_CRYPTO_WALLET" \ + --payment-instrument-details '{ + "embeddedCryptoWallet": { + "network": "ETHEREUM", + "linkedAccounts": [{"email": {"emailAddress": "[email protected]"}}] + } + }' \ + --client-token "$(uuidgen)" \ + --region us-west-2 + +Save the `paymentInstrumentId` and `redirectUrl` from the response. + +AWS SDK + + @@ -225 +325 @@ For the complete request and response schema, see [CreatePaymentInstrument](http -Before the agent can transact, the end user must fund the wallet and grant signing permissions. Open the `REDIRECT_URL` printed above in a browser. From the wallet hub, the user can: +Before the agent can transact, the end user must fund the wallet and grant signing permissions. Open the `redirectUrl` from the response above in a browser. From the wallet hub, the user can: @@ -237,0 +338,14 @@ After funding, poll the instrument status until it becomes `ACTIVE`: +###### Example + +AWS CLI + + + + aws bedrock-agentcore get-payment-instrument \ + --payment-manager-arn "$PAYMENT_MANAGER_ARN" \ + --payment-instrument-id "$INSTRUMENT_ID" \ + --region us-west-2 + +AWS SDK + + @@ -255,0 +370,17 @@ A payment session is a time-bounded context with optional spending limits. When +###### Example + +AWS CLI + + + + aws bedrock-agentcore create-payment-session \ + --payment-manager-arn "$PAYMENT_MANAGER_ARN" \ + --user-id "test-user-123" \ + --expiry-time-in-minutes 60 \ + --limits '{"maxSpendAmount": {"value": "5.00", "currency": "USD"}}' \ + --client-token "$(uuidgen)" \ + --region us-west-2 + +AWS SDK + + @@ -268,0 +400,14 @@ For the complete request and response schema, see [CreatePaymentSession](https:/ +AgentCore CLI + + +When using the CLI, you do not need to create a session manually. Pass `--auto-session` to `agentcore invoke` and the CLI creates or reuses a session with the default spend limit you configured on the payment manager. + + + agentcore invoke \ + --prompt "your prompt here" \ + --payment-instrument-id <INSTRUMENT_ID> \ + --auto-session \ + --payment-user-id test-user-123 + +To use a specific session you created through the SDK, pass `--payment-session-id` instead of `--auto-session`. + @@ -272,0 +418,35 @@ With all resources in place, create a Strands agent that handles x402 payments a +###### Example + +AWS CLI + + +Call `process-payment` directly with an x402 payload (used when you handle payment orchestration yourself): + + + aws bedrock-agentcore process-payment \ + --payment-manager-arn "$PAYMENT_MANAGER_ARN" \ + --payment-session-id "$SESSION_ID" \ + --payment-instrument-id "$INSTRUMENT_ID" \ + --payment-type "CRYPTO_X402" \ + --payment-input '{ + "cryptoX402": { + "version": "2", + "payload": { + "scheme": "exact", + "network": "eip155:84532", + "amount": "100000", + "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e", + "payTo": "0xMERCHANT_ADDRESS", + "maxTimeoutSeconds": 300, + "extra": {"name": "USDC", "version": "2"} + }