View a markdown version of this page

先决条件 - Amazon Bedrock AgentCore
Amazon 账户和凭证Python 和 Amazon SDKIAM 权限（可选）用于 JWT 授权的身份提供商
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

先决条件

迁移现已开放

Amazon 代理注册表已在新agent-registry命名空间下启动。2026 年 10 月 30 日将停止对公共预览版bedrock-agentcore命名空间的支持。有关迁移说明，请参阅注册表迁移综合指南。

在使用 Amazon Agent Registry 之前，请完成以下先决条件。

Amazon 账户和凭证

您需要一个配置了凭据的 Amazon 账户。要配置凭据，请按照 Amazon CLI 入门中的步骤安装和使用 Amazon 命令行界面。

# Verify installation
aws --version  # Should show version 2.

Python 和 Amazon SDK

要访问您的 Amazon 证书并将其配置为与软件开发工具包一起使用，请按照使用 IAM Identity Center 对 Amazon SDK 和工具进行身份验证中的步骤进行操作。如果你打算使用 Amazon Python SDK (Boto3) 以编程方式与 Amazon 代理注册表进行交互：

  1. 安装 Python 3.10+。

  2. 安装 Amazon 软件开发工具包：pip install boto3

  3. 验证您的凭证是否已配置：aws sts get-caller-identity

有关如何设置和使用 Amazon SDK 的更多信息，请参阅Amazon 生成器工具。

IAM 权限

根据与您的角色相匹配的角色设置 IAM 权限。IAM 注册表权限的完整列表可在 IAM 权限中找到。

管理员权限

对于管理注册表、记录和 approve/reject /deprecate 记录的整个生命周期的管理员：

例
Amazon Agent Registry namespace
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Sid": "AllowCreatingAndListingRegistries",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:CreateRegistry",
                "agent-registry:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:*"
            ]
        },
        {
            "Sid": "AllowGetUpdateDeleteRegistry",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistry",
                "agent-registry:UpdateRegistry",
                "agent-registry:DeleteRegistry"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Sid": "AllowCreatingAndListingRecords",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:CreateRegistryRecord",
                "agent-registry:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Sid": "AllowRecordLevelOperations",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistryRecord",
                "agent-registry:UpdateRegistryRecord",
                "agent-registry:DeleteRegistryRecord",
                "agent-registry:SubmitRegistryRecordForApproval"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AllowApproveRejectDeprecateRecords",
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:UpdateRegistryRecordStatus"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AdditionalPermissionForRegistryManagedWorkloadIdentity",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:*WorkloadIdentity"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/default/*"
            ]
        },
        {
            "Sid": "AllowPermissionForCreatingServiceLinkedRole",
            "Effect": "Allow",
            "Action":
            [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource":
            [
                "arn:aws:iam::*:role/aws-service-role/agent-registry.amazonaws.com/AWSServiceRoleForAgentRegistry"
            ],
            "Condition":
            {
                "StringLike": { "iam:AWSServiceName": "agent-registry.amazonaws.com" }
            }
        }
    ]
}
Amazon Bedrock AgentCore namespace (to be deprecated)
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Sid": "AllowCreatingAndListingRegistries",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:CreateRegistry",
                "bedrock-agentcore:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:*"
            ]
        },
        {
            "Sid": "AllowGetUpdateDeleteRegistry",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistry",
                "bedrock-agentcore:UpdateRegistry",
                "bedrock-agentcore:DeleteRegistry"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Sid": "AllowCreatingAndListingRecords",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:CreateRegistryRecord",
                "bedrock-agentcore:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Sid": "AllowRecordLevelOperations",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistryRecord",
                "bedrock-agentcore:UpdateRegistryRecord",
                "bedrock-agentcore:DeleteRegistryRecord",
                "bedrock-agentcore:SubmitRegistryRecordForApproval"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AllowApproveRejectDeprecateRecords",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:UpdateRegistryRecordStatus"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AdditionalPermissionForRegistryManagedWorkloadIdentity",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:*WorkloadIdentity"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/default/*"
            ]
        },
        {
            "Sid": "AllowPermissionForCreatingServiceLinkedRole",
            "Effect": "Allow",
            "Action":
            [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource":
            [
                "arn:aws:iam::*:role/aws-service-role/agent-registry.amazonaws.com/AWSServiceRoleForAgentRegistry"
            ],
            "Condition":
            {
                "StringLike": { "iam:AWSServiceName": "agent-registry.amazonaws.com" }
            }
        }
    ]
}

策展人/批准者权限

对于审阅和 approve/reject 记录但不执行管理操作的策展人：

例
Amazon Agent Registry namespace
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistryRecord"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:UpdateRegistryRecordStatus"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        }
    ]
}
Amazon Bedrock AgentCore namespace (to be deprecated)
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistryRecord"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:UpdateRegistryRecordStatus"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        }
    ]
}

发布者权限

对于向注册表提交 MCP 服务器、代理或其他资源的发布商：

注意

三个与同步相关的语句（AllowWorkloadIdentityForSynchronization、AllowGetResourceOauth2TokenForOauthBasedSynchronization、AllowPassRoleForIamBasedSynchronization）授权由 Identity 管理的工作负载身份和 OAuth 凭证提供者资源。 AgentCore 这些资源故意保留在bedrock-agentcore命名空间下，因此它们的操作、ARN 和服务主体不会改变。

注意

将AllowGetResourceOauth2TokenForOauthBasedSynchronization声明的范围限定为该身份需要其访问令牌的特定 OAuth 凭证提供商 ARN。避免在 ARN 的提供者分区中使用通配符，token-vault/ 例如token-vault/default/oauth2credentialprovider/或向账户中的每个 OAuth 凭证提供者授予访问权限，这样可以启用跨团队凭证访问权限。例如，通过在Resource字段中命名特定的提供商来遵循最低权限原则arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/oauth2credentialprovider/<oauthProviderName>。

例
Amazon Agent Registry namespace
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:CreateRegistryRecord",
                "agent-registry:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistryRecord",
                "agent-registry:UpdateRegistryRecord",
                "agent-registry:DeleteRegistryRecord",
                "agent-registry:SubmitRegistryRecordForApproval"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AllowWorkloadIdentityForSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetWorkloadAccessToken"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/*"
            ]
        },
        {
            "Sid": "AllowGetResourceOauth2TokenForOauthBasedSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetResourceOauth2Token"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/oauth2credentialprovider/<oauthProviderName>"
            ]
        },
        {
            "Sid": "AllowPassRoleForIamBasedSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "iam:PassRole"
            ],
            "Resource":
            [
                "arn:aws:iam::<account>:role/<your-sync-role-name>"
            ],
            "Condition":
            {
                "StringEquals":
                {
                    "iam:PassedToService": "bedrock-agentcore.amazonaws.com"
                },
                "ArnLike":
                {
                    "iam:AssociatedResourceARN": "arn:aws:bedrock-agentcore:<region>:<account>:registry/*/record/*"
                }
            }
        }
    ]
}
Amazon Bedrock AgentCore namespace (to be deprecated)
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:CreateRegistryRecord",
                "bedrock-agentcore:ListRegistryRecords"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistryRecord",
                "bedrock-agentcore:UpdateRegistryRecord",
                "bedrock-agentcore:DeleteRegistryRecord",
                "bedrock-agentcore:SubmitRegistryRecordForApproval"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*/record/*"
            ]
        },
        {
            "Sid": "AllowWorkloadIdentityForSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetWorkloadAccessToken"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:workload-identity-directory/*"
            ]
        },
        {
            "Sid": "AllowGetResourceOauth2TokenForOauthBasedSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetResourceOauth2Token"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default/oauth2credentialprovider/<oauthProviderName>"
            ]
        },
        {
            "Sid": "AllowPassRoleForIamBasedSynchronization",
            "Effect": "Allow",
            "Action":
            [
                "iam:PassRole"
            ],
            "Resource":
            [
                "arn:aws:iam::<account>:role/<your-sync-role-name>"
            ],
            "Condition":
            {
                "StringEquals":
                {
                    "iam:PassedToService": "bedrock-agentcore.amazonaws.com"
                },
                "ArnLike":
                {
                    "iam:AssociatedResourceARN": "arn:aws:bedrock-agentcore:<region>:<account>:registry/*/record/*"
                }
            }
        }
    ]
}

使用者权限

对于搜索和使用经批准的资源的消费者：

例
Amazon Agent Registry namespace
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "agent-registry:SearchDiscoverableRegistryRecords",
                "agent-registry:ListDiscoverableRegistryRecords",
                "agent-registry:GetDiscoverableRegistryRecord",
                "agent-registry:InvokeRegistryMcp"
            ],
            "Resource":
            [
                "arn:aws:agent-registry:*:<account>:registry/*"
            ]
        }
    ]
}
Amazon Bedrock AgentCore namespace (to be deprecated)
{
"Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:ListRegistries"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:GetRegistry"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action":
            [
                "bedrock-agentcore:SearchRegistryRecords",
                "bedrock-agentcore:InvokeRegistryMcp"
            ],
            "Resource":
            [
                "arn:aws:bedrock-agentcore:*:<account>:registry/*"
            ]
        }
    ]
}

有关 IAM 策略的示例，请参阅 A mazon Bedrock AgentCore 的身份和访问管理。

（可选）用于 JWT 授权的身份提供商

如果您计划对入站身份使用 JWT 授权（使消费者能够使用 Non-IAM 身份搜索注册表），请在创建注册表之前设置 Amazon Cognito 或您自己的身份提供商：

  1. 创建 Cognito 用户池（或使用您现有的身份提供商）

  2. 注册应用程序客户端并记下客户端 ID

  3. 使用@@ 用户名和密码创建测试用户

有关详细说明，请参阅配置入站 JWT 授权方。