Skip to content

Commit d59b996

Browse files
author
AWS
committed
Amazon Bedrock AgentCore Control Update: Support for AgentCore Policy GA
1 parent 7f04638 commit d59b996

3 files changed

Lines changed: 113 additions & 28 deletions

File tree

‎.changes/next-release/feature-AmazonBedrockAgentCoreControl-c6ab163.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"type": "feature",
3+
"category": "Amazon Bedrock AgentCore Control",
4+
"contributor": "",
5+
"description": "Support for AgentCore Policy GA"
6+
}

‎services/bedrockagentcorecontrol/src/main/resources/codegen-resources/service-2.json‎

Lines changed: 101 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -276,10 +276,10 @@
276276
"errors":[
277277
{"shape":"ServiceQuotaExceededException"},
278278
{"shape":"AccessDeniedException"},
279-
{"shape":"ConflictException"},
280279
{"shape":"ValidationException"},
281-
{"shape":"ResourceNotFoundException"},
280+
{"shape":"ConflictException"},
282281
{"shape":"ThrottlingException"},
282+
{"shape":"ResourceNotFoundException"},
283283
{"shape":"InternalServerException"}
284284
],
285285
"documentation":"<p>Creates a policy within the AgentCore Policy system. Policies provide real-time, deterministic control over agentic interactions with AgentCore Gateway. Using the Cedar policy language, you can define fine-grained policies that specify which interactions with Gateway tools are permitted based on input parameters and OAuth claims, ensuring agents operate within defined boundaries and business rules. The policy is validated during creation against the Cedar schema generated from the Gateway's tools' input schemas, which defines the available tools, their parameters, and expected data types. This is an asynchronous operation. Use the <a href=\"https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetPolicy.html\">GetPolicy</a> operation to poll the <code>status</code> field to track completion.</p>"
@@ -573,9 +573,9 @@
573573
"input":{"shape":"DeletePolicyRequest"},
574574
"output":{"shape":"DeletePolicyResponse"},
575575
"errors":[
576+
{"shape":"ValidationException"},
576577
{"shape":"AccessDeniedException"},
577578
{"shape":"ConflictException"},
578-
{"shape":"ValidationException"},
579579
{"shape":"ResourceNotFoundException"},
580580
{"shape":"ThrottlingException"},
581581
{"shape":"InternalServerException"}
@@ -593,9 +593,9 @@
593593
"input":{"shape":"DeletePolicyEngineRequest"},
594594
"output":{"shape":"DeletePolicyEngineResponse"},
595595
"errors":[
596+
{"shape":"ValidationException"},
596597
{"shape":"AccessDeniedException"},
597598
{"shape":"ConflictException"},
598-
{"shape":"ValidationException"},
599599
{"shape":"ResourceNotFoundException"},
600600
{"shape":"ThrottlingException"},
601601
{"shape":"InternalServerException"}
@@ -886,8 +886,8 @@
886886
"errors":[
887887
{"shape":"AccessDeniedException"},
888888
{"shape":"ValidationException"},
889-
{"shape":"ResourceNotFoundException"},
890889
{"shape":"ThrottlingException"},
890+
{"shape":"ResourceNotFoundException"},
891891
{"shape":"InternalServerException"}
892892
],
893893
"documentation":"<p>Retrieves detailed information about a specific policy within the AgentCore Policy system. This operation returns the complete policy definition, metadata, and current status, allowing administrators to review and manage policy configurations.</p>",
@@ -905,8 +905,8 @@
905905
"errors":[
906906
{"shape":"AccessDeniedException"},
907907
{"shape":"ValidationException"},
908-
{"shape":"ResourceNotFoundException"},
909908
{"shape":"ThrottlingException"},
909+
{"shape":"ResourceNotFoundException"},
910910
{"shape":"InternalServerException"}
911911
],
912912
"documentation":"<p>Retrieves detailed information about a specific policy engine within the AgentCore Policy system. This operation returns the complete policy engine configuration, metadata, and current status, allowing administrators to review and manage policy engine settings.</p>",
@@ -924,8 +924,8 @@
924924
"errors":[
925925
{"shape":"AccessDeniedException"},
926926
{"shape":"ValidationException"},
927-
{"shape":"ResourceNotFoundException"},
928927
{"shape":"ThrottlingException"},
928+
{"shape":"ResourceNotFoundException"},
929929
{"shape":"InternalServerException"}
930930
],
931931
"documentation":"<p>Retrieves information about a policy generation request within the AgentCore Policy system. Policy generation converts natural language descriptions into Cedar policy statements using AI-powered translation, enabling non-technical users to create policies.</p>",
@@ -1242,8 +1242,8 @@
12421242
"errors":[
12431243
{"shape":"AccessDeniedException"},
12441244
{"shape":"ValidationException"},
1245-
{"shape":"ResourceNotFoundException"},
12461245
{"shape":"ThrottlingException"},
1246+
{"shape":"ResourceNotFoundException"},
12471247
{"shape":"InternalServerException"}
12481248
],
12491249
"documentation":"<p>Retrieves a list of policies within the AgentCore Policy engine. This operation supports pagination and filtering to help administrators manage and discover policies across policy engines. Results can be filtered by policy engine or resource associations.</p>",
@@ -1279,8 +1279,8 @@
12791279
"errors":[
12801280
{"shape":"AccessDeniedException"},
12811281
{"shape":"ValidationException"},
1282-
{"shape":"ResourceNotFoundException"},
12831282
{"shape":"ThrottlingException"},
1283+
{"shape":"ResourceNotFoundException"},
12841284
{"shape":"InternalServerException"}
12851285
],
12861286
"documentation":"<p>Retrieves a list of generated policy assets from a policy generation request within the AgentCore Policy system. This operation returns the actual Cedar policies and related artifacts produced by the AI-powered policy generation process, allowing users to review and select from multiple generated policy options.</p>",
@@ -1298,8 +1298,8 @@
12981298
"errors":[
12991299
{"shape":"AccessDeniedException"},
13001300
{"shape":"ValidationException"},
1301-
{"shape":"ResourceNotFoundException"},
13021301
{"shape":"ThrottlingException"},
1302+
{"shape":"ResourceNotFoundException"},
13031303
{"shape":"InternalServerException"}
13041304
],
13051305
"documentation":"<p>Retrieves a list of policy generation requests within the AgentCore Policy system. This operation supports pagination and filtering to help track and manage AI-powered policy generation operations.</p>",
@@ -1659,18 +1659,18 @@
16591659
"UpdatePolicy":{
16601660
"name":"UpdatePolicy",
16611661
"http":{
1662-
"method":"PUT",
1662+
"method":"PATCH",
16631663
"requestUri":"/policy-engines/{policyEngineId}/policies/{policyId}",
16641664
"responseCode":202
16651665
},
16661666
"input":{"shape":"UpdatePolicyRequest"},
16671667
"output":{"shape":"UpdatePolicyResponse"},
16681668
"errors":[
16691669
{"shape":"AccessDeniedException"},
1670-
{"shape":"ConflictException"},
16711670
{"shape":"ValidationException"},
1672-
{"shape":"ResourceNotFoundException"},
1671+
{"shape":"ConflictException"},
16731672
{"shape":"ThrottlingException"},
1673+
{"shape":"ResourceNotFoundException"},
16741674
{"shape":"InternalServerException"}
16751675
],
16761676
"documentation":"<p>Updates an existing policy within the AgentCore Policy system. This operation allows modification of the policy description and definition while maintaining the policy's identity. The updated policy is validated against the Cedar schema before being applied. This is an asynchronous operation. Use the <code>GetPolicy</code> operation to poll the <code>status</code> field to track completion.</p>",
@@ -1679,18 +1679,18 @@
16791679
"UpdatePolicyEngine":{
16801680
"name":"UpdatePolicyEngine",
16811681
"http":{
1682-
"method":"PUT",
1682+
"method":"PATCH",
16831683
"requestUri":"/policy-engines/{policyEngineId}",
16841684
"responseCode":202
16851685
},
16861686
"input":{"shape":"UpdatePolicyEngineRequest"},
16871687
"output":{"shape":"UpdatePolicyEngineResponse"},
16881688
"errors":[
16891689
{"shape":"AccessDeniedException"},
1690-
{"shape":"ConflictException"},
16911690
{"shape":"ValidationException"},
1692-
{"shape":"ResourceNotFoundException"},
1691+
{"shape":"ConflictException"},
16931692
{"shape":"ThrottlingException"},
1693+
{"shape":"ResourceNotFoundException"},
16941694
{"shape":"InternalServerException"}
16951695
],
16961696
"documentation":"<p>Updates an existing policy engine within the AgentCore Policy system. This operation allows modification of the policy engine description while maintaining its identity. This is an asynchronous operation. Use the <code>GetPolicyEngine</code> operation to poll the <code>status</code> field to track completion.</p>",
@@ -1746,7 +1746,8 @@
17461746
"PYTHON_3_10",
17471747
"PYTHON_3_11",
17481748
"PYTHON_3_12",
1749-
"PYTHON_3_13"
1749+
"PYTHON_3_13",
1750+
"PYTHON_3_14"
17501751
]
17511752
},
17521753
"AgentRuntime":{
@@ -3671,6 +3672,14 @@
36713672
"shape":"ClientToken",
36723673
"documentation":"<p>A unique, case-sensitive identifier that you provide to ensure the idempotency of the request. If you retry a request with the same client token, the service returns the same response without creating a duplicate policy engine.</p>",
36733674
"idempotencyToken":true
3675+
},
3676+
"encryptionKeyArn":{
3677+
"shape":"KmsKeyArn",
3678+
"documentation":"<p>The Amazon Resource Name (ARN) of the KMS key used to encrypt the policy engine data.</p>"
3679+
},
3680+
"tags":{
3681+
"shape":"TagsMap",
3682+
"documentation":"<p>A map of tag keys and values to assign to an AgentCore Policy. Tags enable you to categorize your resources in different ways, for example, by purpose, owner, or environment.</p>"
36743683
}
36753684
}
36763685
},
@@ -3717,6 +3726,10 @@
37173726
"statusReasons":{
37183727
"shape":"PolicyStatusReasons",
37193728
"documentation":"<p>Additional information about the policy engine status. This provides details about any failures or the current state of the policy engine creation process.</p>"
3729+
},
3730+
"encryptionKeyArn":{
3731+
"shape":"KmsKeyArn",
3732+
"documentation":"<p>The Amazon Resource Name (ARN) of the KMS key used to encrypt the policy engine data.</p>"
37203733
}
37213734
}
37223735
},
@@ -4716,6 +4729,10 @@
47164729
"statusReasons":{
47174730
"shape":"PolicyStatusReasons",
47184731
"documentation":"<p>Additional information about the deletion status. This provides details about the deletion process or any issues that may have occurred.</p>"
4732+
},
4733+
"encryptionKeyArn":{
4734+
"shape":"KmsKeyArn",
4735+
"documentation":"<p>The Amazon Resource Name (ARN) of the KMS key used to encrypt the policy engine data.</p>"
47194736
}
47204737
}
47214738
},
@@ -5764,6 +5781,10 @@
57645781
"requestHeaderConfiguration":{
57655782
"shape":"RequestHeaderConfiguration",
57665783
"documentation":"<p>Configuration for HTTP request headers that will be passed through to the runtime.</p>"
5784+
},
5785+
"metadataConfiguration":{
5786+
"shape":"RuntimeMetadataConfiguration",
5787+
"documentation":"<p>Configuration for microVM Metadata Service (MMDS) settings for the AgentCore Runtime.</p>"
57675788
}
57685789
}
57695790
},
@@ -6477,6 +6498,10 @@
64776498
"statusReasons":{
64786499
"shape":"PolicyStatusReasons",
64796500
"documentation":"<p>Additional information about the policy engine status. This provides details about any failures or the current state of the policy engine.</p>"
6501+
},
6502+
"encryptionKeyArn":{
6503+
"shape":"KmsKeyArn",
6504+
"documentation":"<p>The Amazon Resource Name (ARN) of the KMS key used to encrypt the policy engine data.</p>"
64806505
}
64816506
}
64826507
},
@@ -8864,6 +8889,10 @@
88648889
"cedar":{
88658890
"shape":"CedarPolicy",
88668891
"documentation":"<p>The Cedar policy definition within the policy definition structure. This contains the Cedar policy statement that defines the authorization logic using Cedar's human-readable, analyzable policy language. Cedar policies specify principals (who can access), actions (what operations are allowed), resources (what can be accessed), and optional conditions for fine-grained control. Cedar provides a formal policy language designed for authorization with deterministic evaluation, making policies testable, reviewable, and auditable. All Cedar policies follow a default-deny model where actions are denied unless explicitly permitted, and forbid policies always override permit policies.</p>"
8892+
},
8893+
"policyGeneration":{
8894+
"shape":"PolicyGenerationDetails",
8895+
"documentation":"<p>The generated policy asset information within the policy definition structure. This contains information identifying a generated policy asset from the AI-powered policy generation process within the AgentCore Policy system. Each asset contains a Cedar policy statement generated from natural language input, along with associated metadata and analysis findings to help users evaluate and select the most appropriate policy option.</p>"
88678896
}
88688897
},
88698898
"documentation":"<p>Represents the definition structure for policies within the AgentCore Policy system. This structure encapsulates different policy formats and languages that can be used to define access control rules.</p>",
@@ -8912,6 +8941,10 @@
89128941
"statusReasons":{
89138942
"shape":"PolicyStatusReasons",
89148943
"documentation":"<p>Additional information about the policy engine status. This provides details about any failures or the current state of the policy engine lifecycle.</p>"
8944+
},
8945+
"encryptionKeyArn":{
8946+
"shape":"KmsKeyArn",
8947+
"documentation":"<p>The Amazon Resource Name (ARN) of the KMS key used to encrypt the policy engine data.</p>"
89158948
}
89168949
},
89178950
"documentation":"<p>Represents a policy engine resource within the AgentCore Policy system. Policy engines serve as containers for grouping related policies and provide the execution context for policy evaluation and management. Each policy engine can be associated with one Gateway (one engine per Gateway), where it intercepts all agent tool calls and evaluates them against the contained policies before allowing tools to execute. The policy engine maintains the Cedar schema generated from the Gateway's tool manifest, ensuring that policies are validated against the actual tools and parameters available. Policy engines support two enforcement modes that can be configured when associating with a Gateway: log-only mode for testing (evaluates decisions without blocking) and enforce mode for production (actively allows or denies based on policy evaluation).</p>"
@@ -9037,6 +9070,24 @@
90379070
"type":"list",
90389071
"member":{"shape":"PolicyGenerationAsset"}
90399072
},
9073+
"PolicyGenerationDetails":{
9074+
"type":"structure",
9075+
"required":[
9076+
"policyGenerationId",
9077+
"policyGenerationAssetId"
9078+
],
9079+
"members":{
9080+
"policyGenerationId":{
9081+
"shape":"ResourceId",
9082+
"documentation":"<p>The unique identifier for this policy generation request.</p>"
9083+
},
9084+
"policyGenerationAssetId":{
9085+
"shape":"ResourceId",
9086+
"documentation":"<p>The unique identifier for this generated policy asset within the policy generation request.</p>"
9087+
}
9088+
},
9089+
"documentation":"<p>Represents the information identifying a generated policy asset from the AI-powered policy generation process within the AgentCore Policy system. Each asset contains a Cedar policy statement generated from natural language input, along with associated metadata and analysis findings to help users evaluate and select the most appropriate policy option.</p>"
9090+
},
90409091
"PolicyGenerationName":{
90419092
"type":"string",
90429093
"max":48,
@@ -9313,6 +9364,17 @@
93139364
"min":1,
93149365
"pattern":"([0-9]{12})\\.dkr\\.ecr\\.([a-z0-9-]+)\\.amazonaws\\.com/((?:[a-z0-9]+(?:[._-][a-z0-9]+)*/)*[a-z0-9]+(?:[._-][a-z0-9]+)*)(?::([^:@]{1,300}))?(?:@(.+))?"
93159366
},
9367+
"RuntimeMetadataConfiguration":{
9368+
"type":"structure",
9369+
"required":["requireMMDSV2"],
9370+
"members":{
9371+
"requireMMDSV2":{
9372+
"shape":"Boolean",
9373+
"documentation":"<p>Enables MMDSv2 (microVM Metadata Service Version 2) requirement for the agent runtime. When set to <code>true</code>, the runtime microVM will only accept MMDSv2 requests.</p>"
9374+
}
9375+
},
9376+
"documentation":"<p>Configuration for microVM metadata service settings.</p>"
9377+
},
93169378
"S3BucketUri":{
93179379
"type":"string",
93189380
"pattern":"s3://.{1,2043}"
@@ -9861,7 +9923,7 @@
98619923
},
98629924
"Statement":{
98639925
"type":"string",
9864-
"max":153600,
9926+
"max":10000,
98659927
"min":35
98669928
},
98679929
"StatusReason":{
@@ -10506,6 +10568,10 @@
1050610568
"shape":"LifecycleConfiguration",
1050710569
"documentation":"<p>The updated life cycle configuration for the AgentCore Runtime.</p>"
1050810570
},
10571+
"metadataConfiguration":{
10572+
"shape":"RuntimeMetadataConfiguration",
10573+
"documentation":"<p>The updated configuration for microVM Metadata Service (MMDS) settings for the AgentCore Runtime.</p>"
10574+
},
1050910575
"environmentVariables":{
1051010576
"shape":"EnvironmentVariablesMap",
1051110577
"documentation":"<p>Updated environment variables to set in the AgentCore Runtime environment.</p>"
@@ -11119,7 +11185,7 @@
1111911185
"locationName":"policyEngineId"
1112011186
},
1112111187
"description":{
11122-
"shape":"Description",
11188+
"shape":"UpdatedDescription",
1112311189
"documentation":"<p>The new description for the policy engine.</p>"
1112411190
}
1112511191
}
@@ -11167,15 +11233,18 @@
1116711233
"statusReasons":{
1116811234
"shape":"PolicyStatusReasons",
1116911235
"documentation":"<p>Additional information about the update status.</p>"
11236+
},
11237+
"encryptionKeyArn":{
11238+
"shape":"KmsKeyArn",
11239+
"documentation":"<p>The Amazon Resource Name (ARN) of the KMS key used to encrypt the policy engine data.</p>"
1117011240
}
1117111241
}
1117211242
},
1117311243
"UpdatePolicyRequest":{
1117411244
"type":"structure",
1117511245
"required":[
1117611246
"policyEngineId",
11177-
"policyId",
11178-
"definition"
11247+
"policyId"
1117911248
],
1118011249
"members":{
1118111250
"policyEngineId":{
@@ -11191,7 +11260,7 @@
1119111260
"locationName":"policyId"
1119211261
},
1119311262
"description":{
11194-
"shape":"Description",
11263+
"shape":"UpdatedDescription",
1119511264
"documentation":"<p>The new human-readable description for the policy. This optional field allows updating the policy's documentation while keeping the same policy logic.</p>"
1119611265
},
1119711266
"definition":{
@@ -11305,6 +11374,16 @@
1130511374
}
1130611375
}
1130711376
},
11377+
"UpdatedDescription":{
11378+
"type":"structure",
11379+
"members":{
11380+
"optionalValue":{
11381+
"shape":"Description",
11382+
"documentation":"<p>Represents an optional value that is used to update the human-readable description of the resource. If set to null, it will clear the current description of the resource.</p>"
11383+
}
11384+
},
11385+
"documentation":"<p>Respresents an optional value that can be provided to update the human-readable description of the resource. If the field is omitted from the request, it will leave the current decription value unchanged.</p>"
11386+
},
1130811387
"UserPreferenceConsolidationOverride":{
1130911388
"type":"structure",
1131011389
"required":[

‎services/bedrockagentcorecontrol/src/main/resources/codegen-resources/waiters-2.json‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@
2424
},
2525
"PolicyActive" : {
2626
"description" : "Wait until a Policy is active",
27-
"delay" : 2,
28-
"maxAttempts" : 60,
27+
"delay" : 5,
28+
"maxAttempts" : 24,
2929
"operation" : "GetPolicy",
3030
"acceptors" : [ {
3131
"matcher" : "path",
@@ -72,8 +72,8 @@
7272
},
7373
"PolicyEngineActive" : {
7474
"description" : "Wait until a PolicyEngine is active",
75-
"delay" : 2,
76-
"maxAttempts" : 60,
75+
"delay" : 5,
76+
"maxAttempts" : 24,
7777
"operation" : "GetPolicyEngine",
7878
"acceptors" : [ {
7979
"matcher" : "path",
@@ -120,8 +120,8 @@
120120
},
121121
"PolicyGenerationCompleted" : {
122122
"description" : "Wait until policy generation is completed",
123-
"delay" : 2,
124-
"maxAttempts" : 60,
123+
"delay" : 5,
124+
"maxAttempts" : 24,
125125
"operation" : "GetPolicyGeneration",
126126
"acceptors" : [ {
127127
"matcher" : "path",

0 commit comments

Comments
 (0)