AWS bedrock-agentcore documentation change
Summary
Restructured payment setup documentation to add automated AgentCore Payments skill option alongside existing manual CLI/SDK method. Added prerequisites, invocation steps, and workflow details for the automated skill.
Security assessment
The changes document security features like credential storage in AgentCore Identity and payment authorization flows, but there's no evidence of addressing a specific security vulnerability. The update enhances documentation of existing security practices without indicating incident response.
Diff
diff --git a/bedrock-agentcore/latest/devguide/payments-getting-started.md b/bedrock-agentcore/latest/devguide/payments-getting-started.md index 24a81173d..58c6a491a 100644 --- a//bedrock-agentcore/latest/devguide/payments-getting-started.md +++ b//bedrock-agentcore/latest/devguide/payments-getting-started.md @@ -7 +7 @@ -PrerequisitesStep 1: Obtain payment provider credentialsStep 2: Store credentials in AgentCore IdentityStep 3: Create a Payment Manager and ConnectorStep 4: Create a payment instrumentStep 5: Create a payment sessionStep 6: Process a payment with a Strands agentVerify the paymentTroubleshootingCleanupWhat you’ve builtNext steps +Using the AgentCore Payments skillUsing CLI, SDK, or Boto3TroubleshootingCleanupWhat you’ve builtNext steps @@ -13 +13,116 @@ This tutorial walks you through setting up AgentCore payments and processing you -## Prerequisites +You can set up payments in two ways: + + * Using the AgentCore Payments skill — An automated setup experience that provisions all resources through a guided conversation with AI coding agents like Kiro, Claude Code, or Codex. The skill handles CLI commands, SDK scripts, and framework wiring for you. + + * Using CLI, SDK, or Boto3 — A step-by-step manual setup using the AgentCore CLI, AWS SDK, or AWS CLI directly. + + + + +## Using the AgentCore Payments skill + +The AgentCore Payments skill automates the entire setup process through an interactive, guided experience. It provisions the following resources: + + * **PaymentCredentialProvider** — Stores payment provider credentials in AgentCore Identity. + + * **Payment Manager** — The top-level resource that coordinates payment operations. + + * **Payment Connector** — Links the manager to your credentials via the AgentCore CLI. + + * **Payment Instrument** — A crypto wallet that your agent uses to pay merchants on behalf of a user. + + * **Payment Session** — A time-bounded context with spending limits. + + + + +The skill also wires payments into your agent with a framework-agnostic tool, so it works with Strands, LangGraph, OpenAI Agents SDK, or any Python framework. + +### Prerequisites + +Before starting, make sure you have: + + * **AWS Account** with credentials configured (`aws configure`) + + * **An AWS Region where AgentCore payments is available** — us-east-1, us-west-2, eu-central-1, or ap-southeast-2. See [Supported AWS Regions](./agentcore-regions.html). + + * **Node.js 20+** installed (the skill installs the AgentCore CLI automatically) + + * **An agent that accesses a paid endpoint** — The skill enables your agent to pay for x402-protected APIs. For testing, you can use the sandbox endpoint `https://sandbox.node4all.com/v1/x402-test`. + + * **The[ Agent Toolkit for AWS](https://github.com/aws/agent-toolkit-for-aws) `aws-agents` plugin** installed in your AI coding agent: + +###### Example + +Claude Code + + + /plugin marketplace add aws/agent-toolkit-for-aws + /plugin install aws-agents@agent-toolkit-for-aws + +Codex + + +The plugin is discovered automatically from the marketplace manifest. To add the marketplace, run the following command: + + codex plugin marketplace add aws/agent-toolkit-for-aws + + + + +### Invoke the skill + +The payments skill is part of the `agents-build` skill in the [Agent Toolkit for AWS](https://github.com/aws/agent-toolkit-for-aws). To trigger it, describe your intent in your AI coding agent. For example: + + * "Add payments to my agent using `agents-build` skill in `aws-agents` plugin" + + * "Set up microtransactions for my agent using `agents-build` skill in `aws-agents` plugin" + + * "I need to handle 402 Payment Required responses using `agents-build` skill in `aws-agents` plugin" + + * "Wire my agent to pay for x402-protected APIs using `agents-build` skill in `aws-agents` plugin" + + + + +The skill detects payment-related intent and loads the payments workflow automatically. + +### What the skill does + +The skill runs an automated process that provisions your payment infrastructure end-to-end. The skill runs most steps automatically and pauses twice for your input: + + 1. Verifies or installs the AgentCore CLI and sets up the project + + 2. Creates the payment manager + + 3. **Pauses** — You run `agentcore add payment-connector` to enter your provider secrets (Coinbase CDP or Stripe Privy credentials) + + 4. Deploys resources to your AWS account (`agentcore deploy -y`) + + 5. Wires a framework-agnostic payment tool (`x402_payment_tool.py`) into your agent + + 6. Creates a per-user wallet (instrument) and budget-bounded session via the SDK + + 7. **Pauses** — You authorize the wallet (delegation) and fund it with testnet USDC from the [Circle faucet](https://faucet.circle.com/) website + + 8. Sets environment variables and runs a test payment against a paid endpoint + + + + +Before running the connector command, obtain credentials from your provider: + + * **Coinbase CDP** — API Key ID, API Key Secret, and Wallet Secret from the [Coinbase Developer Platform](https://portal.cdp.coinbase.com/) website (with Delegated signing enabled). + + * **Stripe Privy** — App ID, App Secret, Authorization ID, and Authorization Private Key from the [Privy dashboard](https://dashboard.privy.io/) website. + + + + +A successful run shows the agent calling `x402_fetch`, detecting a `402`, settling payment via the AgentCore SDK, and the retry returning `200` with paid content. + +## Using CLI, SDK, or Boto3 + +This section walks you through each step manually using the AgentCore CLI, AWS CLI, or AWS SDK (Boto3). + +### Prerequisites @@ -40 +155 @@ If you have the AgentCore CLI v0.19.0 or later installed, you can use CLI comman -## Step 1: Obtain payment provider credentials +### Step 1: Obtain payment provider credentials @@ -91 +206 @@ For full details including security best practices and credential rotation, see -## Step 2: Store credentials in AgentCore Identity +### Step 2: Store credentials in AgentCore Identity @@ -140 +255 @@ For the complete request and response schema, see [CreatePaymentCredentialProvid -### CLI alternative: Store credentials +#### CLI alternative: Store credentials @@ -144 +259 @@ With the AgentCore CLI, credential storage happens automatically when you add a -## Step 3: Create a Payment Manager and Connector +### Step 3: Create a Payment Manager and Connector @@ -149,0 +265,52 @@ A Payment Manager is the top-level resource that coordinates payment operations. +AgentCore CLI + + +The CLI creates the credential provider, Payment Manager, and Payment Connector in one flow. From your AgentCore project directory, add a payment manager and connector together. + +**Interactive wizard:** + + + agentcore add payment-manager + +The wizard prompts for the manager name, pattern (interceptor), auto-payment toggle, and default spend limit. It then asks whether to add a connector and walks through provider selection and credential input. + +**Non-interactive (Coinbase CDP):** + + + agentcore add payment-manager \ + --name my-payment-manager \ + --auto-payment \ + --default-spend-limit 5.00 + + agentcore add payment-connector \ + --manager my-payment-manager \ + --name my-coinbase-connector \ + --provider CoinbaseCDP \ + --api-key-id <YOUR_CDP_API_KEY_ID> \ + --api-key-secret <YOUR_CDP_API_KEY_SECRET> \ + --wallet-secret <YOUR_CDP_WALLET_SECRET> + +**Non-interactive (Privy):** + + + agentcore add payment-manager \ + --name my-payment-manager \ + --auto-payment \ + --default-spend-limit 5.00 + + agentcore add payment-connector \ + --manager my-payment-manager \ + --name my-privy-connector \ + --provider StripePrivy \ + --app-id <YOUR_PRIVY_APP_ID> \ + --app-secret <YOUR_PRIVY_APP_SECRET> \ + --authorization-id <YOUR_PRIVY_AUTHORIZATION_ID> \ + --authorization-private-key <YOUR_PRIVY_PRIVATE_KEY_BASE64> + +After adding, deploy to provision the payment infrastructure: + + + agentcore deploy + +The deploy step creates IAM roles, stores credentials in AgentCore Identity, and provisions the Payment Manager and Connector. You will see "Creating payment infrastructure…" in the output. + @@ -216,53 +383 @@ If you do not have a service role, see [IAM roles for AgentCore payments](./paym -AgentCore CLI - - -The CLI creates the credential provider, Payment Manager, and Payment Connector in one flow. From your AgentCore project directory, add a payment manager and connector together. - -**Interactive wizard:** - - - agentcore add payment-manager