AWS Bedrock Agents

Connect Agent Identity Security to Amazon Web Services Bedrock to discover agents built on Bedrock foundation models such as Claude, Titan, and Llama by reading model invocation logs from Amazon CloudWatch.

Agent Identity Security reads Bedrock model invocation logs from Amazon CloudWatch to surface agent activity. An IAM user or role with the appropriate permissions is required for authentication.

Prerequisites

  • An active AWS account.
  • An IAM user or role with the following three permissions:
    • bedrock:ListAgents Allows Agent Identity Security to find and list all Bedrock agents.
    • logs:GetLogEvents Allows Agent Identity Security to read Bedrock activity logs from CloudWatch.
    • logs:FilterLogEvents Allows Agent Identity Security to search through those activity logs.
  • The name of the CloudWatch log group configured for Bedrock model invocation logs. The default name is /aws/bedrock/model-invocations.
  • The AWS region where your Bedrock workloads run. Example: us-east-1.

Integrate AWS Bedrock Agents

  1. On the Integrations page, select + Add Integration.
  2. In the Integration Catalog, select AWS Bedrock Agents.
    The AWS Bedrock Agents configuration page opens.
  3. Under Instance Details, enter the following information:
    Field Description
    *Instance Name A unique name for this integration. Example: Production AWS Bedrock Agents.
    Description An optional description to identify the purpose or environment of this integration.
  4. Under Credentials, enter the following information:
    Field Description
    *AWS Access Key ID The access key ID for an IAM user or role with Bedrock and CloudWatch read permissions.
    *AWS Secret Access Key The secret access key that corresponds to the Access Key ID. Copy this value when you create the access key, as it is shown only once.
    *Region Name The AWS region where your Bedrock workloads run. Example: us-east-1.
    *CloudWatch Log Group Name The CloudWatch log group configured for Bedrock model invocation logs. Example: /aws/bedrock/model-invocations.
    *: Mandatory field
  5. Select Test Configuration.
    Agent Identity Security validates the credentials. A checkmark indicates success.
  6. Select Create Instance.
    Agent Identity Security creates the integration, runs an initial sync, and returns you to the Integrations list.
The AWS Bedrock Agents integration is active. Go to Registry > Agents to view discovered agents.
Note: If Test Configuration fails with a permission error, the IAM user is missing one or more of the required permissions (Check the required permssions list in the Before you begin section. Update the IAM policy and try again.