mirror of
https://github.com/awslabs/amazon-bedrock-agentcore-samples.git
synced 2025-09-08 20:50:46 +00:00
17a75597fe
* feat: Add AWS Operations Agent with AgentCore Runtime - Complete rewrite of AWS Operations Agent using Amazon Bedrock AgentCore - Added comprehensive deployment scripts for DIY and SDK runtime modes - Implemented OAuth2/PKCE authentication with Okta integration - Added MCP (Model Context Protocol) tool support for AWS service operations - Sanitized all sensitive information (account IDs, domains, client IDs) with placeholders - Added support for 17 AWS services: EC2, S3, Lambda, CloudFormation, IAM, RDS, CloudWatch, Cost Explorer, ECS, EKS, SNS, SQS, DynamoDB, Route53, API Gateway, SES, Bedrock, SageMaker - Includes chatbot client, gateway management scripts, and comprehensive testing - Ready for public GitHub with security-cleared configuration files Security: All sensitive values replaced with <YOUR_AWS_ACCOUNT_ID>, <YOUR_OKTA_DOMAIN>, <YOUR_OKTA_CLIENT_ID> placeholders * Update AWS Operations Agent architecture diagram --------- Co-authored-by: name <alias@amazon.com>
152 lines
5.3 KiB
JSON
152 lines
5.3 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "ECRImageAccess",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ecr:BatchGetImage",
|
|
"ecr:GetDownloadUrlForLayer"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:ecr:*:<YOUR_AWS_ACCOUNT_ID>:repository/*"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"logs:DescribeLogStreams",
|
|
"logs:CreateLogGroup"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:logs:*:<YOUR_AWS_ACCOUNT_ID>:log-group:/aws/bedrock-agentcore/runtimes/*"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"logs:DescribeLogGroups"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:logs:*:<YOUR_AWS_ACCOUNT_ID>:log-group:*"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"logs:CreateLogStream",
|
|
"logs:PutLogEvents"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:logs:*:<YOUR_AWS_ACCOUNT_ID>:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "ECRTokenAccess",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ecr:GetAuthorizationToken"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"xray:PutTraceSegments",
|
|
"xray:PutTelemetryRecords",
|
|
"xray:GetSamplingRules",
|
|
"xray:GetSamplingTargets"
|
|
],
|
|
"Resource": [ "*" ]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Resource": "*",
|
|
"Action": "cloudwatch:PutMetricData",
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"cloudwatch:namespace": "bedrock-agentcore"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "GetAgentAccessToken",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"bedrock-agentcore:GetWorkloadAccessToken",
|
|
"bedrock-agentcore:GetWorkloadAccessTokenForJWT",
|
|
"bedrock-agentcore:GetWorkloadAccessTokenForUserId"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:bedrock-agentcore:*:<YOUR_AWS_ACCOUNT_ID>:workload-identity-directory/default",
|
|
"arn:aws:bedrock-agentcore:*:<YOUR_AWS_ACCOUNT_ID>:workload-identity-directory/default/workload-identity/*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AgentCoreIdentityManagement",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"bedrock-agentcore:CreateOauth2CredentialProvider",
|
|
"bedrock-agentcore:CreateWorkloadIdentity",
|
|
"bedrock-agentcore:GetResourceOauth2Token",
|
|
"bedrock-agentcore:ListOauth2CredentialProviders",
|
|
"bedrock-agentcore:ListWorkloadIdentities",
|
|
"bedrock-agentcore:DeleteOauth2CredentialProvider",
|
|
"bedrock-agentcore:DeleteWorkloadIdentity",
|
|
"bedrock-agentcore:GetOauth2CredentialProvider",
|
|
"bedrock-agentcore:GetWorkloadIdentity",
|
|
"bedrock-agentcore:UpdateOauth2CredentialProvider",
|
|
"bedrock-agentcore:UpdateWorkloadIdentity"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:bedrock-agentcore:*:<YOUR_AWS_ACCOUNT_ID>:token-vault/default",
|
|
"arn:aws:bedrock-agentcore:*:<YOUR_AWS_ACCOUNT_ID>:token-vault/default/*",
|
|
"arn:aws:bedrock-agentcore:*:<YOUR_AWS_ACCOUNT_ID>:workload-identity-directory/default",
|
|
"arn:aws:bedrock-agentcore:*:<YOUR_AWS_ACCOUNT_ID>:workload-identity-directory/default/workload-identity/*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AgentCoreGatewayManagement",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"bedrock-agentcore:CreateGateway",
|
|
"bedrock-agentcore:DeleteGateway",
|
|
"bedrock-agentcore:GetGateway",
|
|
"bedrock-agentcore:ListGateways",
|
|
"bedrock-agentcore:UpdateGateway",
|
|
"bedrock-agentcore:CreateGatewayTarget",
|
|
"bedrock-agentcore:DeleteGatewayTarget",
|
|
"bedrock-agentcore:GetGatewayTarget",
|
|
"bedrock-agentcore:ListGatewayTargets",
|
|
"bedrock-agentcore:UpdateGatewayTarget"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:bedrock-agentcore:*:<YOUR_AWS_ACCOUNT_ID>:gateway/*",
|
|
"arn:aws:bedrock-agentcore:*:<YOUR_AWS_ACCOUNT_ID>:gateway/*/target/*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "SecretsManagerAccess",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"secretsmanager:GetSecretValue"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:secretsmanager:*:<YOUR_AWS_ACCOUNT_ID>:secret:*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "BedrockModelInvocation",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"bedrock:InvokeModel",
|
|
"bedrock:InvokeModelWithResponseStream"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:bedrock:*::foundation-model/*",
|
|
"arn:aws:bedrock:*:<YOUR_AWS_ACCOUNT_ID>:*"
|
|
]
|
|
}
|
|
]
|
|
}
|