amazon-bedrock-agentcore-samples/02-use-cases/AWS-operations-agent/mcp-tool-lambda/mcp-tool-template-zip.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: MCP Tool Lambda for Bedrock AgentCore Gateway MCP testing (ZIP-based deployment)

Parameters:
  Environment:
    Type: String
    Default: prod
    Description: Environment name for CloudFormation tags only

Globals:
  Function:
    Timeout: 900  # 15 minutes
    MemorySize: 3008  # Maximum memory for performance
    Runtime: python3.12
    Architectures: [x86_64]

Resources:
  # Bedrock AgentCore Gateway Execution Role - Role that Bedrock AgentCore Gateway assumes to invoke Lambda functions
  BedrockAgentCoreGatewayExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: bac-gateway-execution-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          # Production Bedrock AgentCore Gateway - Bedrock AgentCore service principal with required conditions
          - Effect: Allow
            Principal:
              Service: bedrock-agentcore.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub "arn:aws:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:gateway/bac-gtw-*"
      Policies:
        - PolicyName: BedrockAgentCoreGatewayExecutionPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: InvokeLambdaFunctions
                Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: '*'
              - Sid: BedrockAgentCorePermissions
                Effect: Allow
                Action:
                  - bedrock-agentcore:*
                Resource: '*'
              - Sid: CloudWatchLogsPermissions
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                Resource: '*'
      Tags:
        - Key: Project
          Value: lambda-adaptor-bedrock-agentcore
        - Key: Component
          Value: bedrock-agentcore-gateway-execution
        - Key: Environment
          Value: !Ref Environment
        - Key: ManagedBy
          Value: SAM

  # Custom Lambda Execution Role with Bedrock AgentCore Trust and AWS Service Permissions
  MCPToolFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          # Allow Lambda service to assume this role
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
          # Allow Bedrock AgentCore service to assume this role
          - Effect: Allow
            Principal:
              Service: bedrock-agentcore.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/ReadOnlyAccess
      Policies:
        - PolicyName: BedrockInvokePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - bedrock:InvokeModel
                  - bedrock:InvokeModelWithResponseStream
                Resource: '*'
        - PolicyName: CostExplorerPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ce:GetCostAndUsage
                  - ce:GetUsageReport
                  - ce:GetReservationCoverage
                  - ce:GetReservationPurchaseRecommendation
                  - ce:GetReservationUtilization
                  - ce:GetDimensionValues
                  - ce:GetMetricValues
                  - ce:ListCostCategoryDefinitions
                  - ce:GetCostCategories
                  - ce:GetRightsizingRecommendation
                  - ce:GetSavingsPlansUtilization
                  - ce:GetSavingsPlansUtilizationDetails
                  - ce:GetSavingsPlansCoverage
                  - ce:GetSavingsPlansUsage
                  - ce:GetUsageForecast
                  - ce:GetCostForecast
                Resource: '*'
        - PolicyName: BudgetsPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - budgets:ViewBudget
                  - budgets:DescribeBudgets
                  - budgets:DescribeBudget
                  - budgets:DescribeBudgetAction
                  - budgets:DescribeBudgetActions
                  - budgets:DescribeBudgetActionsForAccount
                  - budgets:DescribeBudgetActionsForBudget
                  - budgets:DescribeBudgetNotificationsForAccount
                  - budgets:DescribeBudgetPerformanceHistory
                  - budgets:DescribeNotificationsForBudget
                  - budgets:DescribeSubscribersForNotification
                Resource: '*'
        - PolicyName: CloudWatchLogsPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/bac-mcp-tool:*"
      Tags:
        - Key: Project
          Value: lambda-adaptor-bedrock-agentcore
        - Key: Component
          Value: mcp-tool-lambda
        - Key: Environment
          Value: !Ref Environment

  # CloudWatch Log Group
  MCPToolLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/bac-mcp-tool
      RetentionInDays: 14

  # MCP Tool Lambda Function (ZIP-based)
  MCPToolFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: "bac-mcp-tool"
      PackageType: Zip
      CodeUri: packaging/mcp-tool-lambda.zip
      Handler: mcp-tool-handler.lambda_handler
      Description: MCP Tool Lambda for Bedrock AgentCore Gateway MCP testing (ZIP-based)
      Role: !GetAtt MCPToolFunctionRole.Arn
      
      # Environment variables
      Environment:
        Variables:
          ENVIRONMENT: !Ref Environment
          LOG_LEVEL: INFO
      
      # Tracing
      Tracing: Active

Outputs:
  MCPToolFunctionName:
    Description: MCP Tool Lambda Function Name
    Value: !Ref MCPToolFunction
    Export:
      Name: !Sub "${AWS::StackName}-MCPToolFunctionName"

  MCPToolFunctionArn:
    Description: MCP Tool Lambda Function ARN
    Value: !GetAtt MCPToolFunction.Arn
    Export:
      Name: !Sub "${AWS::StackName}-MCPToolFunctionArn"

  MCPToolFunctionRoleArn:
    Description: MCP Tool Lambda Function Role ARN
    Value: !GetAtt MCPToolFunctionRole.Arn
    Export:
      Name: !Sub "${AWS::StackName}-MCPToolFunctionRoleArn"

  BedrockAgentCoreGatewayExecutionRoleName:
    Description: Bedrock AgentCore Gateway Execution Role Name
    Value: !Ref BedrockAgentCoreGatewayExecutionRole
    Export:
      Name: !Sub "${AWS::StackName}-BedrockAgentCoreGatewayExecutionRoleName"

  BedrockAgentCoreGatewayExecutionRoleArn:
    Description: Bedrock AgentCore Gateway Execution Role ARN - Use this role when creating Bedrock AgentCore Gateway targets
    Value: !GetAtt BedrockAgentCoreGatewayExecutionRole.Arn
    Export:
      Name: !Sub "${AWS::StackName}-BedrockAgentCoreGatewayExecutionRoleArn"