本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
# 先决条件
**迁移现已开放**
Amazon 代理注册表已在新`agent-registry`命名空间下启动。2026 年 10 月 30 日将停止对公共预览版`bedrock-agentcore`命名空间的支持。有关迁移说明，请参阅[注册表迁移综合指南](registry-faq.md)。
在使用 Amazon Agent Registry 之前，请完成以下先决条件。
## Amazon 账户和凭证
您需要一个配置了凭据的 Amazon 账户。要配置凭据，请按照 [Amazon CLI 入门](https://docs.amazonaws.cn/cli/latest/userguide/cli-chap-getting-started.html)中的步骤安装和使用 Amazon 命令行界面。
```
# Verify installation
aws --version # Should show version 2.
```
## Python 和 Amazon SDK
要访问您的 Amazon 证书并将其配置为与软件开发工具包一起使用，请按照[使用 IAM Identity Center 对 Amazon SDK 和工具进行身份验证](https://docs.amazonaws.cn/sdkref/latest/guide/access-sso.html)中的步骤进行操作。如果你打算使用 Amazon Python SDK (Boto3) 以编程方式与 Amazon 代理注册表进行交互：
1. 安装 **Python 3.10\+**。
1. 安装 Amazon 软件开发工具包：`pip install boto3`
1. 验证您的凭证是否已配置：`aws sts get-caller-identity`
有关如何设置和使用 Amazon SDK 的更多信息，请参阅[Amazon 生成器工具](https://builder.aws.com/build/tools)。
## IAM 权限
根据与您的角色相匹配的角色设置 IAM 权限。IAM 注册表权限的完整列表可在 [IAM 权限](registry-iam-permissions.md)中找到。
### 管理员权限
对于管理注册表、记录和 approve/reject /deprecate 记录的整个生命周期的管理员：
**Example**
```
{
"Version": "2012-10-17",
"Statement":
[
{
"Sid": "AllowCreatingAndListingRegistries",
"Effect": "Allow",
"Action":
[
"agent-registry:CreateRegistry",
"agent-registry:ListRegistries"
],
"Resource":
[
"arn:aws:agent-registry:*::*"
]
},
{
"Sid": "AllowGetUpdateDeleteRegistry",
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistry",
"agent-registry:UpdateRegistry",
"agent-registry:DeleteRegistry"
],
"Resource":
[
"arn:aws:agent-registry:*::registry/*"
]
},
{
"Sid": "AllowCreatingAndListingRecords",
"Effect": "Allow",
"Action":
[
"agent-registry:CreateRegistryRecord",
"agent-registry:ListRegistryRecords"
],
"Resource":
[
"arn:aws:agent-registry:*::registry/*"
]
},
{
"Sid": "AllowRecordLevelOperations",
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistryRecord",
"agent-registry:UpdateRegistryRecord",
"agent-registry:DeleteRegistryRecord",
"agent-registry:SubmitRegistryRecordForApproval"
],
"Resource":
[
"arn:aws:agent-registry:*::registry/*/record/*"
]
},
{
"Sid": "AllowApproveRejectDeprecateRecords",
"Effect": "Allow",
"Action":
[
"agent-registry:UpdateRegistryRecordStatus"
],
"Resource":
[
"arn:aws:agent-registry:*::registry/*/record/*"
]
},
{
"Sid": "AdditionalPermissionForRegistryManagedWorkloadIdentity",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:*WorkloadIdentity"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::workload-identity-directory/default/*"
]
},
{
"Sid": "AllowPermissionForCreatingServiceLinkedRole",
"Effect": "Allow",
"Action":
[
"iam:CreateServiceLinkedRole"
],
"Resource":
[
"arn:aws:iam::*:role/aws-service-role/agent-registry.amazonaws.com/AWSServiceRoleForAgentRegistry"
],
"Condition":
{
"StringLike": { "iam:AWSServiceName": "agent-registry.amazonaws.com" }
}
}
]
}
```
```
{
"Version": "2012-10-17",
"Statement":
[
{
"Sid": "AllowCreatingAndListingRegistries",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:CreateRegistry",
"bedrock-agentcore:ListRegistries"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::*"
]
},
{
"Sid": "AllowGetUpdateDeleteRegistry",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistry",
"bedrock-agentcore:UpdateRegistry",
"bedrock-agentcore:DeleteRegistry"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::registry/*"
]
},
{
"Sid": "AllowCreatingAndListingRecords",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:CreateRegistryRecord",
"bedrock-agentcore:ListRegistryRecords"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::registry/*"
]
},
{
"Sid": "AllowRecordLevelOperations",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistryRecord",
"bedrock-agentcore:UpdateRegistryRecord",
"bedrock-agentcore:DeleteRegistryRecord",
"bedrock-agentcore:SubmitRegistryRecordForApproval"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::registry/*/record/*"
]
},
{
"Sid": "AllowApproveRejectDeprecateRecords",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:UpdateRegistryRecordStatus"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::registry/*/record/*"
]
},
{
"Sid": "AdditionalPermissionForRegistryManagedWorkloadIdentity",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:*WorkloadIdentity"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::workload-identity-directory/default/*"
]
},
{
"Sid": "AllowPermissionForCreatingServiceLinkedRole",
"Effect": "Allow",
"Action":
[
"iam:CreateServiceLinkedRole"
],
"Resource":
[
"arn:aws:iam::*:role/aws-service-role/agent-registry.amazonaws.com/AWSServiceRoleForAgentRegistry"
],
"Condition":
{
"StringLike": { "iam:AWSServiceName": "agent-registry.amazonaws.com" }
}
}
]
}
```
### 策展人/批准者权限
对于审阅和 approve/reject 记录但不执行管理操作的策展人：
**Example**
```
{
"Version": "2012-10-17",
"Statement":
[
{
"Effect": "Allow",
"Action":
[
"agent-registry:ListRegistries"
],
"Resource":
[
"arn:aws:agent-registry:*::*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistry"
],
"Resource":
[
"arn:aws:agent-registry:*::registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:ListRegistryRecords"
],
"Resource":
[
"arn:aws:agent-registry:*::registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistryRecord"
],
"Resource":
[
"arn:aws:agent-registry:*::registry/*/record/*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:UpdateRegistryRecordStatus"
],
"Resource":
[
"arn:aws:agent-registry:*::registry/*/record/*"
]
}
]
}
```
```
{
"Version": "2012-10-17",
"Statement":
[
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:ListRegistries"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistry"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:ListRegistryRecords"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistryRecord"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::registry/*/record/*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:UpdateRegistryRecordStatus"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::registry/*/record/*"
]
}
]
}
```
### 发布者权限
对于向注册表提交 MCP 服务器、代理或其他资源的发布商：
**注意**
三个与同步相关的语句（`AllowWorkloadIdentityForSynchronization`、`AllowGetResourceOauth2TokenForOauthBasedSynchronization`、`AllowPassRoleForIamBasedSynchronization`）授权由 Identity 管理的工作负载身份和 OAuth 凭证提供者资源。 AgentCore 这些资源故意保留在`bedrock-agentcore`命名空间下，因此它们的操作、ARN 和服务主体不会改变。
**注意**
将`AllowGetResourceOauth2TokenForOauthBasedSynchronization`声明的范围限定为该身份需要其访问令牌的特定 OAuth 凭证提供商 ARN。避免在 ARN 的提供者分区中使用通配符，`token-vault/ `例如`token-vault/default/oauth2credentialprovider/`或向账户中的每个 OAuth 凭证提供者授予访问权限，这样可以启用跨团队凭证访问权限。例如，通过在`Resource`字段中命名特定的提供商来遵循最低权限原则`arn:aws:bedrock-agentcore:::token-vault/default/oauth2credentialprovider/`。
**Example**
```
{
"Version": "2012-10-17",
"Statement":
[
{
"Effect": "Allow",
"Action":
[
"agent-registry:ListRegistries"
],
"Resource":
[
"arn:aws:agent-registry:*::*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistry"
],
"Resource":
[
"arn:aws:agent-registry:*::registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:CreateRegistryRecord",
"agent-registry:ListRegistryRecords"
],
"Resource":
[
"arn:aws:agent-registry:*::registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistryRecord",
"agent-registry:UpdateRegistryRecord",
"agent-registry:DeleteRegistryRecord",
"agent-registry:SubmitRegistryRecordForApproval"
],
"Resource":
[
"arn:aws:agent-registry:*::registry/*/record/*"
]
},
{
"Sid": "AllowWorkloadIdentityForSynchronization",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetWorkloadAccessToken"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::workload-identity-directory/*"
]
},
{
"Sid": "AllowGetResourceOauth2TokenForOauthBasedSynchronization",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetResourceOauth2Token"
],
"Resource":
[
"arn:aws:bedrock-agentcore:::token-vault/default/oauth2credentialprovider/"
]
},
{
"Sid": "AllowPassRoleForIamBasedSynchronization",
"Effect": "Allow",
"Action":
[
"iam:PassRole"
],
"Resource":
[
"arn:aws:iam:::role/"
],
"Condition":
{
"StringEquals":
{
"iam:PassedToService": "bedrock-agentcore.amazonaws.com"
},
"ArnLike":
{
"iam:AssociatedResourceARN": "arn:aws:bedrock-agentcore:::registry/*/record/*"
}
}
}
]
}
```
```
{
"Version": "2012-10-17",
"Statement":
[
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:ListRegistries"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistry"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:CreateRegistryRecord",
"bedrock-agentcore:ListRegistryRecords"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistryRecord",
"bedrock-agentcore:UpdateRegistryRecord",
"bedrock-agentcore:DeleteRegistryRecord",
"bedrock-agentcore:SubmitRegistryRecordForApproval"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::registry/*/record/*"
]
},
{
"Sid": "AllowWorkloadIdentityForSynchronization",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetWorkloadAccessToken"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::workload-identity-directory/*"
]
},
{
"Sid": "AllowGetResourceOauth2TokenForOauthBasedSynchronization",
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetResourceOauth2Token"
],
"Resource":
[
"arn:aws:bedrock-agentcore:::token-vault/default/oauth2credentialprovider/"
]
},
{
"Sid": "AllowPassRoleForIamBasedSynchronization",
"Effect": "Allow",
"Action":
[
"iam:PassRole"
],
"Resource":
[
"arn:aws:iam:::role/"
],
"Condition":
{
"StringEquals":
{
"iam:PassedToService": "bedrock-agentcore.amazonaws.com"
},
"ArnLike":
{
"iam:AssociatedResourceARN": "arn:aws:bedrock-agentcore:::registry/*/record/*"
}
}
}
]
}
```
### 使用者权限
对于搜索和使用经批准的资源的消费者：
**Example**
```
{
"Version": "2012-10-17",
"Statement":
[
{
"Effect": "Allow",
"Action":
[
"agent-registry:ListRegistries"
],
"Resource":
[
"arn:aws:agent-registry:*::*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:GetRegistry"
],
"Resource":
[
"arn:aws:agent-registry:*::registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"agent-registry:SearchDiscoverableRegistryRecords",
"agent-registry:ListDiscoverableRegistryRecords",
"agent-registry:GetDiscoverableRegistryRecord",
"agent-registry:InvokeRegistryMcp"
],
"Resource":
[
"arn:aws:agent-registry:*::registry/*"
]
}
]
}
```
```
{
"Version": "2012-10-17",
"Statement":
[
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:ListRegistries"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:GetRegistry"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::registry/*"
]
},
{
"Effect": "Allow",
"Action":
[
"bedrock-agentcore:SearchRegistryRecords",
"bedrock-agentcore:InvokeRegistryMcp"
],
"Resource":
[
"arn:aws:bedrock-agentcore:*::registry/*"
]
}
]
}
```
有关 IAM 策略的示例，请参阅 A [mazon Bedrock AgentCore 的身份和访问管理](https://docs.amazonaws.cn/bedrock-agentcore/latest/devguide/security-iam.html)。
## （可选）用于 JWT 授权的身份提供商
如果您计划对入站身份使用 JWT 授权（使消费者能够使用 Non-IAM 身份搜索注册表），请在创建注册表之前设置 Amazon Cognito 或您自己的身份提供商：
1. **创建 Cognito 用户池**（或使用您现有的身份提供商）
1. **注册应用程序客户端**并记下客户端 ID
1. 使用@@ **用户名和密码创建测试用户**
有关详细说明，请参阅[配置入站 JWT 授权方](https://docs.amazonaws.cn/bedrock-agentcore/latest/devguide/inbound-jwt-authorizer.html)。