View a markdown version of this page

Configure KMS key for a registry - Amazon Bedrock AgentCore
ConsoleAmazon CLIAmazon SDKVerify encryption configuration
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Configure KMS key for a registry

The KMS key determines how your registry encrypts data at rest. You can choose between an Amazon owned key or a customer managed key that you store in your account and manage through Amazon KMS. You can only configure the KMS key during registry creation. You cannot change the KMS key after the registry is created.

Important

You cannot change the KMS key after the registry is created. Make sure that you select the correct key before creating the registry.

Console

  1. Open the Amazon Agent Registry console and choose Create registry.

  2. Complete the required fields (Name, and optionally Description, Discovery Authorization, Record approval, and Tags).

  3. Expand the KMS key - optional section.

  4. Under KMS key selection, your data is encrypted by default with a key that we own and manage for you. To choose a different key, customize your encryption settings:

    • Amazon owned key (default) — Leave the Customize encryption settings (advanced) checkbox unselected. We own and manage the KMS key.

    • Customer managed key — Select the Customize encryption settings (advanced) checkbox. In the Choose an Amazon KMS key field, enter an ARN or choose Create an Amazon KMS key to open the Amazon KMS console and create a new key.

  5. Choose Create registry.

To confirm the encryption type after creation, view the registry details page and check the KMS key section.

Amazon CLI

The following example creates a registry with a customer managed key:

aws agent-registry-control create-registry \
  --name "MyEncryptedRegistry" \
  --description "Registry with customer managed encryption" \
  --encryption-configuration '{"kmsKeyArn":"arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"}' \
  --region us-east-1

To create a registry with the default Amazon owned key, omit the --encryption-configuration parameter:

aws agent-registry-control create-registry \
  --name "MyRegistry" \
  --description "Registry with default encryption" \
  --region us-east-1

Amazon SDK

The following Python example creates a registry with a customer managed key:

import boto3

client = boto3.client('agent-registry-control')

response = client.create_registry(
    name='MyEncryptedRegistry',
    description='Registry with customer managed encryption',
    encryptionConfiguration={
        'kmsKeyArn': 'arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab'
    }
)

print(f"Registry ID: {response['registryId']}")

To create a registry with the default Amazon owned key, omit the encryptionConfiguration parameter:

import boto3

client = boto3.client('agent-registry-control')

response = client.create_registry(
    name='MyRegistry',
    description='Registry with default encryption'
)

print(f"Registry ID: {response['registryId']}")

Verify encryption configuration

To verify the KMS key configuration of an existing registry, use GetRegistry:

import boto3

client = boto3.client('agent-registry-control')

response = client.get_registry(
    registryId='<registryId>'
)

encryption_config = response.get('encryptionConfiguration')
if encryption_config:
    print(f"KMS Key ARN: {encryption_config['kmsKeyArn']}")
else:
    print("Encryption: AWS owned key (default)")

If your GetRegistry response doesn’t include an encryptionConfiguration parameter, your registry is configured to encrypt data at rest with an Amazon owned key.