View a markdown version of this page

Configure with API operations or an Amazon SDK - Amazon Bedrock AgentCore
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Configure with API operations or an Amazon SDK

Set your key configuration in a SetTokenVaultCMK API request. The following partial example request body sets the token vault to use the provided customer managed key.

"KmsConfiguration": {
    "KeyType": "CUSTOMER_MANAGED_KEY",
    "KmsKeyArn": "arn:aws:kms:us-east-1:111122223333:key/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
}

The following partial example request body sets a token vault to use an Amazon owned key.

"KmsConfiguration": {
    "KeyType": "AWS_OWNED_KEY"
}

If your GetTokenVault response doesn’t include a KmsConfiguration parameter, your token vault is configured to encrypt data at rest with an Amazon owned key.