Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Bedrock Agentcore

Amazon Bedrock Agentcore (service prefix: bedrock-agentcore) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Bedrock Agentcore
Actions defined by Amazon Bedrock Agentcore
Permission-only actions for Amazon Bedrock Agentcore
Resource types defined by Amazon Bedrock Agentcore
Condition keys for Amazon Bedrock Agentcore

API operations defined by Amazon Bedrock Agentcore

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
BatchCreateMemoryRecords	bedrock-agentcore	bedrock-agentcore:BatchCreateMemoryRecords			Write
BatchDeleteMemoryRecords	bedrock-agentcore	bedrock-agentcore:BatchDeleteMemoryRecords			Write
BatchUpdateMemoryRecords	bedrock-agentcore	bedrock-agentcore:BatchUpdateMemoryRecords			Write
CompleteResourceTokenAuth	bedrock-agentcore	bedrock-agentcore:CompleteResourceTokenAuth			Read
CreateABTest	bedrock-agentcore	bedrock-agentcore:CreateABTest			Write
CreateABTest	bedrock-agentcore	iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
CreateEvent	bedrock-agentcore	bedrock-agentcore:CreateEvent			Write
CreatePaymentInstrument	bedrock-agentcore	bedrock-agentcore:CreatePaymentInstrument			Write
CreatePaymentSession	bedrock-agentcore	bedrock-agentcore:CreatePaymentSession			Write
DeleteABTest	bedrock-agentcore	bedrock-agentcore:DeleteABTest			Write
DeleteBatchEvaluation	bedrock-agentcore	bedrock-agentcore:DeleteBatchEvaluation			Write
DeleteEvent	bedrock-agentcore	bedrock-agentcore:DeleteEvent			Write
DeleteMemoryRecord	bedrock-agentcore	bedrock-agentcore:DeleteMemoryRecord			Write
DeletePaymentInstrument	bedrock-agentcore	bedrock-agentcore:DeletePaymentInstrument			Write
DeletePaymentSession	bedrock-agentcore	bedrock-agentcore:DeletePaymentSession			Write
DeleteRecommendation	bedrock-agentcore	bedrock-agentcore:DeleteRecommendation			Write
Evaluate	bedrock-agentcore	bedrock-agentcore:Evaluate			Write
GetABTest	bedrock-agentcore	bedrock-agentcore:GetABTest			Read
GetAgentCard	bedrock-agentcore	bedrock-agentcore:GetAgentCard			Read
GetBatchEvaluation	bedrock-agentcore	bedrock-agentcore:GetBatchEvaluation			Read
GetBrowserSession	bedrock-agentcore	bedrock-agentcore:GetBrowserSession			Read
GetCodeInterpreterSession	bedrock-agentcore	bedrock-agentcore:GetCodeInterpreterSession			Read
GetEvent	bedrock-agentcore	bedrock-agentcore:GetEvent			Read
GetMemoryRecord	bedrock-agentcore	bedrock-agentcore:GetMemoryRecord			Read
GetPaymentInstrument	bedrock-agentcore	bedrock-agentcore:GetPaymentInstrument			Read
GetPaymentInstrumentBalance	bedrock-agentcore	bedrock-agentcore:GetPaymentInstrumentBalance			Read
GetPaymentSession	bedrock-agentcore	bedrock-agentcore:GetPaymentSession			Read
GetRecommendation	bedrock-agentcore	bedrock-agentcore:GetRecommendation			Read
GetResourceApiKey	bedrock-agentcore	bedrock-agentcore:GetResourceApiKey			Read
GetResourceOauth2Token	bedrock-agentcore	bedrock-agentcore:GetResourceOauth2Token			Read
GetResourcePaymentToken	bedrock-agentcore	bedrock-agentcore:GetResourcePaymentToken			Read
GetWorkloadAccessToken	bedrock-agentcore	bedrock-agentcore:GetWorkloadAccessToken			Write
GetWorkloadAccessTokenForJWT	bedrock-agentcore	bedrock-agentcore:GetWorkloadAccessTokenForJWT			Write
GetWorkloadAccessTokenForUserId	bedrock-agentcore	bedrock-agentcore:GetWorkloadAccessTokenForUserId			Write
InvokeAgentRuntime	bedrock-agentcore	bedrock-agentcore:InvokeAgentRuntime			Write
InvokeAgentRuntime	bedrock-agentcore	bedrock-agentcore:InvokeAgentRuntimeForUser			Write
InvokeAgentRuntimeCommand	bedrock-agentcore	bedrock-agentcore:InvokeAgentRuntimeCommand			Write
InvokeCodeInterpreter	bedrock-agentcore	bedrock-agentcore:InvokeCodeInterpreter			Write
InvokeCodeInterpreter	bedrock-agentcore	bedrock-agentcore:StartCodeInterpreterSession			Write
InvokeHarness	bedrock-agentcore	bedrock-agentcore:InvokeAgentRuntime			Write
InvokeHarness	bedrock-agentcore	bedrock-agentcore:InvokeHarness			Write
ListABTests	bedrock-agentcore	bedrock-agentcore:ListABTests			List
ListActors	bedrock-agentcore	bedrock-agentcore:ListActors			List
ListBatchEvaluations	bedrock-agentcore	bedrock-agentcore:ListBatchEvaluations			List
ListBrowserSessions	bedrock-agentcore	bedrock-agentcore:ListBrowserSessions			List
ListCodeInterpreterSessions	bedrock-agentcore	bedrock-agentcore:ListCodeInterpreterSessions			List
ListEvents	bedrock-agentcore	bedrock-agentcore:ListEvents			List
ListMemoryExtractionJobs	bedrock-agentcore	bedrock-agentcore:ListMemoryExtractionJobs			List
ListMemoryRecords	bedrock-agentcore	bedrock-agentcore:ListMemoryRecords			List
ListPaymentInstruments	bedrock-agentcore	bedrock-agentcore:ListPaymentInstruments			List
ListPaymentSessions	bedrock-agentcore	bedrock-agentcore:ListPaymentSessions			List
ListRecommendations	bedrock-agentcore	bedrock-agentcore:ListRecommendations			List
ListSessions	bedrock-agentcore	bedrock-agentcore:ListSessions			List
ProcessPayment	bedrock-agentcore	bedrock-agentcore:ProcessPayment			Write
RetrieveMemoryRecords	bedrock-agentcore	bedrock-agentcore:RetrieveMemoryRecords			List
SaveBrowserSessionProfile	bedrock-agentcore	bedrock-agentcore:SaveBrowserSessionProfile			Write
SearchRegistryRecords	bedrock-agentcore	bedrock-agentcore:SearchRegistryRecords			Read
StartBatchEvaluation	bedrock-agentcore	bedrock-agentcore:StartBatchEvaluation			Write
StartBrowserSession	bedrock-agentcore	bedrock-agentcore:StartBrowserSession			Write
StartCodeInterpreterSession	bedrock-agentcore	bedrock-agentcore:StartCodeInterpreterSession			Write
StartMemoryExtractionJob	bedrock-agentcore	bedrock-agentcore:StartMemoryExtractionJob			Write
StartRecommendation	bedrock-agentcore	bedrock-agentcore:StartRecommendation			Write
StopBatchEvaluation	bedrock-agentcore	bedrock-agentcore:StopBatchEvaluation			Write
StopBrowserSession	bedrock-agentcore	bedrock-agentcore:StopBrowserSession			Write
StopCodeInterpreterSession	bedrock-agentcore	bedrock-agentcore:StopCodeInterpreterSession			Write
StopRuntimeSession	bedrock-agentcore	bedrock-agentcore:StopRuntimeSession			Write
UpdateABTest	bedrock-agentcore	bedrock-agentcore:UpdateABTest			Write
UpdateABTest	bedrock-agentcore	iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
UpdateBrowserStream	bedrock-agentcore	bedrock-agentcore:UpdateBrowserStream			Write
CreateAgentRuntime	bedrock-agentcore-control	bedrock-agentcore:CreateAgentRuntime			Write
		bedrock-agentcore:CreateAgentRuntimeEndpoint			Write
		bedrock-agentcore:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
CreateAgentRuntimeEndpoint	bedrock-agentcore-control	bedrock-agentcore:CreateAgentRuntimeEndpoint			Write
CreateAgentRuntimeEndpoint	bedrock-agentcore-control	bedrock-agentcore:TagResource			Tagging, Write
CreateApiKeyCredentialProvider	bedrock-agentcore-control	bedrock-agentcore:CreateApiKeyCredentialProvider			Write
CreateApiKeyCredentialProvider	bedrock-agentcore-control	bedrock-agentcore:TagResource			Tagging, Write
CreateBrowser	bedrock-agentcore-control	bedrock-agentcore:CreateBrowser			Write
		bedrock-agentcore:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
CreateBrowserProfile	bedrock-agentcore-control	bedrock-agentcore:CreateBrowserProfile			Write
CreateBrowserProfile	bedrock-agentcore-control	bedrock-agentcore:TagResource			Tagging, Write
CreateCodeInterpreter	bedrock-agentcore-control	bedrock-agentcore:CreateCodeInterpreter			Write
		bedrock-agentcore:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
CreateConfigurationBundle	bedrock-agentcore-control	bedrock-agentcore:CreateConfigurationBundle			Write
CreateConfigurationBundle	bedrock-agentcore-control	bedrock-agentcore:TagResource			Tagging, Write
CreateDataset	bedrock-agentcore-control	bedrock-agentcore:TagResource			Tagging, Write
CreateEvaluator	bedrock-agentcore-control	bedrock-agentcore:CreateEvaluator			Write
CreateEvaluator	bedrock-agentcore-control	bedrock-agentcore:TagResource			Tagging, Write
CreateGateway	bedrock-agentcore-control	bedrock-agentcore:CreateGateway			Write
		bedrock-agentcore:SynchronizeGatewayTargets			Permissions management, Write
		bedrock-agentcore:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
CreateGatewayRule	bedrock-agentcore-control	bedrock-agentcore:CreateGatewayRule			Write
CreateGatewayTarget	bedrock-agentcore-control	bedrock-agentcore:CreateGatewayTarget			Write
CreateGatewayTarget	bedrock-agentcore-control	bedrock-agentcore:SynchronizeGatewayTargets			Permissions management, Write
CreateHarness	bedrock-agentcore-control	bedrock-agentcore:CreateAgentRuntime			Write
		bedrock-agentcore:CreateHarness			Write
		bedrock-agentcore:GetMemory			Read
		bedrock-agentcore:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
CreateHarnessEndpoint	bedrock-agentcore-control	bedrock-agentcore:CreateHarnessEndpoint			Write
CreateHarnessEndpoint	bedrock-agentcore-control	bedrock-agentcore:TagResource			Tagging, Write
CreateMemory	bedrock-agentcore-control	bedrock-agentcore:CreateMemory			Write
		bedrock-agentcore:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
CreateOauth2CredentialProvider	bedrock-agentcore-control	bedrock-agentcore:CreateOauth2CredentialProvider			Write
CreateOauth2CredentialProvider	bedrock-agentcore-control	bedrock-agentcore:TagResource			Tagging, Write
CreateOnlineEvaluationConfig	bedrock-agentcore-control	bedrock-agentcore:CreateOnlineEvaluationConfig			Write
		bedrock-agentcore:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
CreatePaymentConnector	bedrock-agentcore-control	bedrock-agentcore:CreatePaymentConnector			Write
CreatePaymentCredentialProvider	bedrock-agentcore-control	bedrock-agentcore:CreatePaymentCredentialProvider			Write
CreatePaymentCredentialProvider	bedrock-agentcore-control	bedrock-agentcore:TagResource			Tagging, Write
CreatePaymentManager	bedrock-agentcore-control	bedrock-agentcore:CreatePaymentManager			Write
		bedrock-agentcore:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
CreatePolicy	bedrock-agentcore-control	bedrock-agentcore:CreatePolicy			Write
CreatePolicyEngine	bedrock-agentcore-control	bedrock-agentcore:CreatePolicyEngine			Write
CreateRegistry	bedrock-agentcore-control	bedrock-agentcore:CreateRegistry			Write
CreateRegistry	bedrock-agentcore-control	bedrock-agentcore:TagResource			Tagging, Write
CreateRegistryRecord	bedrock-agentcore-control	bedrock-agentcore:CreateRegistryRecord			Write
		bedrock-agentcore:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
CreateWorkloadIdentity	bedrock-agentcore-control	bedrock-agentcore:CreateWorkloadIdentity			Write
CreateWorkloadIdentity	bedrock-agentcore-control	bedrock-agentcore:TagResource			Tagging, Write
DeleteAgentRuntime	bedrock-agentcore-control	bedrock-agentcore:DeleteAgentRuntime			Write
		bedrock-agentcore:DeleteAgentRuntimeEndpoint			Write
		bedrock-agentcore:DeleteWorkloadIdentity			Write
DeleteAgentRuntimeEndpoint	bedrock-agentcore-control	bedrock-agentcore:DeleteAgentRuntimeEndpoint			Write
DeleteApiKeyCredentialProvider	bedrock-agentcore-control	bedrock-agentcore:DeleteApiKeyCredentialProvider			Write
DeleteBrowser	bedrock-agentcore-control	bedrock-agentcore:DeleteBrowser			Write
DeleteBrowserProfile	bedrock-agentcore-control	bedrock-agentcore:DeleteBrowserProfile			Write
DeleteCodeInterpreter	bedrock-agentcore-control	bedrock-agentcore:DeleteCodeInterpreter			Write
DeleteConfigurationBundle	bedrock-agentcore-control	bedrock-agentcore:DeleteConfigurationBundle			Write
DeleteEvaluator	bedrock-agentcore-control	bedrock-agentcore:DeleteEvaluator			Write
DeleteGateway	bedrock-agentcore-control	bedrock-agentcore:DeleteGateway			Write
DeleteGatewayRule	bedrock-agentcore-control	bedrock-agentcore:DeleteGatewayRule			Write
DeleteGatewayTarget	bedrock-agentcore-control	bedrock-agentcore:DeleteGatewayTarget			Write
DeleteHarness	bedrock-agentcore-control	bedrock-agentcore:DeleteAgentRuntime			Write
DeleteHarness	bedrock-agentcore-control	bedrock-agentcore:DeleteHarness			Write
DeleteHarnessEndpoint	bedrock-agentcore-control	bedrock-agentcore:DeleteHarnessEndpoint			Write
DeleteMemory	bedrock-agentcore-control	bedrock-agentcore:DeleteMemory			Write
DeleteOauth2CredentialProvider	bedrock-agentcore-control	bedrock-agentcore:DeleteOauth2CredentialProvider			Write
DeleteOnlineEvaluationConfig	bedrock-agentcore-control	bedrock-agentcore:DeleteOnlineEvaluationConfig			Write
DeletePaymentConnector	bedrock-agentcore-control	bedrock-agentcore:DeletePaymentConnector			Write
DeletePaymentCredentialProvider	bedrock-agentcore-control	bedrock-agentcore:DeletePaymentCredentialProvider			Write
DeletePaymentManager	bedrock-agentcore-control	bedrock-agentcore:DeletePaymentManager			Write
DeletePolicy	bedrock-agentcore-control	bedrock-agentcore:DeletePolicy			Write
DeletePolicyEngine	bedrock-agentcore-control	bedrock-agentcore:DeletePolicyEngine			Write
DeleteRegistry	bedrock-agentcore-control	bedrock-agentcore:DeleteRegistry			Write
DeleteRegistryRecord	bedrock-agentcore-control	bedrock-agentcore:DeleteRegistryRecord			Write
DeleteResourcePolicy	bedrock-agentcore-control	bedrock-agentcore:DeleteResourcePolicy			Write
DeleteWorkloadIdentity	bedrock-agentcore-control	bedrock-agentcore:DeleteWorkloadIdentity			Write
GetAgentRuntime	bedrock-agentcore-control	bedrock-agentcore:GetAgentRuntime			Read
GetAgentRuntimeEndpoint	bedrock-agentcore-control	bedrock-agentcore:GetAgentRuntimeEndpoint			Read
GetApiKeyCredentialProvider	bedrock-agentcore-control	bedrock-agentcore:GetApiKeyCredentialProvider			Read
GetBrowser	bedrock-agentcore-control	bedrock-agentcore:GetBrowser			Read
GetBrowserProfile	bedrock-agentcore-control	bedrock-agentcore:GetBrowserProfile			Read
GetCodeInterpreter	bedrock-agentcore-control	bedrock-agentcore:GetCodeInterpreter			Read
GetConfigurationBundle	bedrock-agentcore-control	bedrock-agentcore:GetConfigurationBundle			Read
GetConfigurationBundleVersion	bedrock-agentcore-control	bedrock-agentcore:GetConfigurationBundleVersion			Read
GetEvaluator	bedrock-agentcore-control	bedrock-agentcore:GetEvaluator			Read
GetGateway	bedrock-agentcore-control	bedrock-agentcore:GetGateway			Read
GetGatewayRule	bedrock-agentcore-control	bedrock-agentcore:GetGatewayRule			Read
GetGatewayTarget	bedrock-agentcore-control	bedrock-agentcore:GetGatewayTarget			Read
GetHarness	bedrock-agentcore-control	bedrock-agentcore:GetHarness			Read
GetHarnessEndpoint	bedrock-agentcore-control	bedrock-agentcore:GetHarnessEndpoint			Read
GetMemory	bedrock-agentcore-control	bedrock-agentcore:GetMemory			Read
GetOauth2CredentialProvider	bedrock-agentcore-control	bedrock-agentcore:GetOauth2CredentialProvider			Read
GetOnlineEvaluationConfig	bedrock-agentcore-control	bedrock-agentcore:GetOnlineEvaluationConfig			Read
GetPaymentConnector	bedrock-agentcore-control	bedrock-agentcore:GetPaymentConnector			Read
GetPaymentCredentialProvider	bedrock-agentcore-control	bedrock-agentcore:GetPaymentCredentialProvider			Read
GetPaymentManager	bedrock-agentcore-control	bedrock-agentcore:GetPaymentManager			Read
GetPolicy	bedrock-agentcore-control	bedrock-agentcore:GetPolicy			Read
GetPolicyEngine	bedrock-agentcore-control	bedrock-agentcore:GetPolicyEngine			Read
GetPolicyEngineSummary	bedrock-agentcore-control	bedrock-agentcore:GetPolicyEngineSummary			Read
GetPolicyGeneration	bedrock-agentcore-control	bedrock-agentcore:GetPolicyGeneration			Read
GetPolicyGenerationSummary	bedrock-agentcore-control	bedrock-agentcore:GetPolicyGenerationSummary			Read
GetPolicySummary	bedrock-agentcore-control	bedrock-agentcore:GetPolicySummary			Read
GetRegistry	bedrock-agentcore-control	bedrock-agentcore:GetRegistry			Read
GetRegistryRecord	bedrock-agentcore-control	bedrock-agentcore:GetRegistryRecord			Read
GetResourcePolicy	bedrock-agentcore-control	bedrock-agentcore:GetResourcePolicy			Read
GetTokenVault	bedrock-agentcore-control	bedrock-agentcore:GetTokenVault			Read
GetWorkloadIdentity	bedrock-agentcore-control	bedrock-agentcore:GetWorkloadIdentity			Read
ListAgentRuntimeEndpoints	bedrock-agentcore-control	bedrock-agentcore:ListAgentRuntimeEndpoints			List
ListAgentRuntimeVersions	bedrock-agentcore-control	bedrock-agentcore:ListAgentRuntimeVersions			List
ListAgentRuntimes	bedrock-agentcore-control	bedrock-agentcore:ListAgentRuntimes			List
ListApiKeyCredentialProviders	bedrock-agentcore-control	bedrock-agentcore:ListApiKeyCredentialProviders			Read
ListBrowserProfiles	bedrock-agentcore-control	bedrock-agentcore:ListBrowserProfiles			List
ListBrowsers	bedrock-agentcore-control	bedrock-agentcore:ListBrowsers			List
ListCodeInterpreters	bedrock-agentcore-control	bedrock-agentcore:ListCodeInterpreters			List
ListConfigurationBundleVersions	bedrock-agentcore-control	bedrock-agentcore:ListConfigurationBundleVersions			List
ListConfigurationBundles	bedrock-agentcore-control	bedrock-agentcore:ListConfigurationBundles			List
ListEvaluators	bedrock-agentcore-control	bedrock-agentcore:ListEvaluators			List
ListGatewayRules	bedrock-agentcore-control	bedrock-agentcore:ListGatewayRules			List
ListGatewayTargets	bedrock-agentcore-control	bedrock-agentcore:ListGatewayTargets			List
ListGateways	bedrock-agentcore-control	bedrock-agentcore:ListGateways			List
ListHarnessEndpoints	bedrock-agentcore-control	bedrock-agentcore:ListHarnessEndpoints			List
ListHarnesses	bedrock-agentcore-control	bedrock-agentcore:ListHarnesses			List
ListMemories	bedrock-agentcore-control	bedrock-agentcore:ListMemories			List
ListOauth2CredentialProviders	bedrock-agentcore-control	bedrock-agentcore:ListOauth2CredentialProviders			Read
ListOnlineEvaluationConfigs	bedrock-agentcore-control	bedrock-agentcore:ListOnlineEvaluationConfigs			List
ListPaymentConnectors	bedrock-agentcore-control	bedrock-agentcore:ListPaymentConnectors			List
ListPaymentCredentialProviders	bedrock-agentcore-control	bedrock-agentcore:ListPaymentCredentialProviders			List
ListPaymentManagers	bedrock-agentcore-control	bedrock-agentcore:ListPaymentManagers			List
ListPolicies	bedrock-agentcore-control	bedrock-agentcore:ListPolicies			List
ListPolicyEngineSummaries	bedrock-agentcore-control	bedrock-agentcore:ListPolicyEngineSummaries			List
ListPolicyEngines	bedrock-agentcore-control	bedrock-agentcore:ListPolicyEngines			List
ListPolicyGenerationAssets	bedrock-agentcore-control	bedrock-agentcore:ListPolicyGenerationAssets			List
ListPolicyGenerationSummaries	bedrock-agentcore-control	bedrock-agentcore:ListPolicyGenerationSummaries			List
ListPolicyGenerations	bedrock-agentcore-control	bedrock-agentcore:ListPolicyGenerations			List
ListPolicySummaries	bedrock-agentcore-control	bedrock-agentcore:ListPolicySummaries			List
ListRegistries	bedrock-agentcore-control	bedrock-agentcore:ListRegistries			List
ListRegistryRecords	bedrock-agentcore-control	bedrock-agentcore:ListRegistryRecords			List
ListTagsForResource	bedrock-agentcore-control	bedrock-agentcore:ListTagsForResource			List
ListWorkloadIdentities	bedrock-agentcore-control	bedrock-agentcore:ListWorkloadIdentities			Read
PutResourcePolicy	bedrock-agentcore-control	bedrock-agentcore:PutResourcePolicy			Write
SetTokenVaultCMK	bedrock-agentcore-control	bedrock-agentcore:SetTokenVaultCMK			Write
StartPolicyGeneration	bedrock-agentcore-control	bedrock-agentcore:StartPolicyGeneration			Write
SubmitRegistryRecordForApproval	bedrock-agentcore-control	bedrock-agentcore:SubmitRegistryRecordForApproval			Write
SynchronizeGatewayTargets	bedrock-agentcore-control	bedrock-agentcore:SynchronizeGatewayTargets			Permissions management, Write
TagResource	bedrock-agentcore-control	bedrock-agentcore:TagResource			Tagging, Write
UntagResource	bedrock-agentcore-control	bedrock-agentcore:UntagResource			Tagging, Write
UpdateAgentRuntime	bedrock-agentcore-control	bedrock-agentcore:UpdateAgentRuntime			Write
UpdateAgentRuntime	bedrock-agentcore-control	iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
UpdateAgentRuntimeEndpoint	bedrock-agentcore-control	bedrock-agentcore:UpdateAgentRuntimeEndpoint			Write
UpdateApiKeyCredentialProvider	bedrock-agentcore-control	bedrock-agentcore:UpdateApiKeyCredentialProvider			Write
UpdateConfigurationBundle	bedrock-agentcore-control	bedrock-agentcore:UpdateConfigurationBundle			Write
UpdateEvaluator	bedrock-agentcore-control	bedrock-agentcore:UpdateEvaluator			Write
UpdateGateway	bedrock-agentcore-control	bedrock-agentcore:UpdateGateway			Write
UpdateGateway	bedrock-agentcore-control	iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
UpdateGatewayRule	bedrock-agentcore-control	bedrock-agentcore:UpdateGatewayRule			Write
UpdateGatewayTarget	bedrock-agentcore-control	bedrock-agentcore:SynchronizeGatewayTargets			Permissions management, Write
UpdateGatewayTarget	bedrock-agentcore-control	bedrock-agentcore:UpdateGatewayTarget			Write
UpdateHarness	bedrock-agentcore-control	bedrock-agentcore:GetMemory			Read
		bedrock-agentcore:UpdateAgentRuntime			Write
		bedrock-agentcore:UpdateHarness			Write
		iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
UpdateHarnessEndpoint	bedrock-agentcore-control	bedrock-agentcore:UpdateHarnessEndpoint			Write
UpdateMemory	bedrock-agentcore-control	bedrock-agentcore:UpdateMemory			Write
UpdateMemory	bedrock-agentcore-control	iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
UpdateOauth2CredentialProvider	bedrock-agentcore-control	bedrock-agentcore:UpdateOauth2CredentialProvider			Write
UpdateOnlineEvaluationConfig	bedrock-agentcore-control	bedrock-agentcore:UpdateOnlineEvaluationConfig			Write
UpdateOnlineEvaluationConfig	bedrock-agentcore-control	iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
UpdatePaymentConnector	bedrock-agentcore-control	bedrock-agentcore:UpdatePaymentConnector			Write
UpdatePaymentCredentialProvider	bedrock-agentcore-control	bedrock-agentcore:UpdatePaymentCredentialProvider			Write
UpdatePaymentManager	bedrock-agentcore-control	bedrock-agentcore:UpdatePaymentManager			Write
UpdatePaymentManager	bedrock-agentcore-control	iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
UpdatePolicy	bedrock-agentcore-control	bedrock-agentcore:UpdatePolicy			Write
UpdatePolicyEngine	bedrock-agentcore-control	bedrock-agentcore:UpdatePolicyEngine			Write
UpdateRegistry	bedrock-agentcore-control	bedrock-agentcore:UpdateRegistry			Write
UpdateRegistryRecord	bedrock-agentcore-control	bedrock-agentcore:UpdateRegistryRecord			Write
UpdateRegistryRecord	bedrock-agentcore-control	iam:PassRole	iam:PassedToService	bedrock-agentcore.amazonaws.com	Write
UpdateRegistryRecordStatus	bedrock-agentcore-control	bedrock-agentcore:UpdateRegistryRecordStatus			Write
UpdateWorkloadIdentity	bedrock-agentcore-control	bedrock-agentcore:UpdateWorkloadIdentity			Write

Actions defined by Amazon Bedrock Agentcore

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchCreateMemoryRecords	Grants permission to create one or more memory records	memory*	aws:ResourceTag/${TagKey} bedrock-agentcore:namespace	Write
BatchDeleteMemoryRecords	Grants permission to delete one or more memory records	memory*	aws:ResourceTag/${TagKey}	Write
BatchUpdateMemoryRecords	Grants permission to update one or more memory records	memory*	aws:ResourceTag/${TagKey} bedrock-agentcore:namespace	Write
CompleteResourceTokenAuth	Grants permission to retrieve access token with OAuth2 for 3LO flow to access external resource	oauth2credentialprovider*	aws:ResourceTag/${TagKey} bedrock-agentcore:InboundJwtClaim/aud bedrock-agentcore:InboundJwtClaim/client_id bedrock-agentcore:InboundJwtClaim/iss bedrock-agentcore:InboundJwtClaim/scope bedrock-agentcore:InboundJwtClaim/sub bedrock-agentcore:userid	Read
		token-vault*	aws:ResourceTag/${TagKey} bedrock-agentcore:InboundJwtClaim/aud bedrock-agentcore:InboundJwtClaim/client_id bedrock-agentcore:InboundJwtClaim/iss bedrock-agentcore:InboundJwtClaim/scope bedrock-agentcore:InboundJwtClaim/sub bedrock-agentcore:userid
		workload-identity*	aws:ResourceTag/${TagKey} bedrock-agentcore:InboundJwtClaim/aud bedrock-agentcore:InboundJwtClaim/client_id bedrock-agentcore:InboundJwtClaim/iss bedrock-agentcore:InboundJwtClaim/scope bedrock-agentcore:InboundJwtClaim/sub bedrock-agentcore:userid
		workload-identity-directory*	aws:ResourceTag/${TagKey} bedrock-agentcore:InboundJwtClaim/aud bedrock-agentcore:InboundJwtClaim/client_id bedrock-agentcore:InboundJwtClaim/iss bedrock-agentcore:InboundJwtClaim/scope bedrock-agentcore:InboundJwtClaim/sub bedrock-agentcore:userid
ConnectBrowserAutomationStream	Grants permission to connect to a browser automation stream			Read
ConnectBrowserLiveViewStream	Grants permission to connect to a browser live view stream			Read
CreateABTest	Grants permission to create an A/B test			Write
CreateAgentRuntime	Grants permission to create a new agent runtime		aws:RequestTag/${TagKey} aws:TagKeys bedrock-agentcore:RuntimeAuthorizerType bedrock-agentcore:securityGroups bedrock-agentcore:subnets	Write
CreateAgentRuntimeEndpoint	Grants permission to create a new agent runtime endpoint	runtime*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateApiKeyCredentialProvider	Grants permission to create a new API Key Credential Provider	apikeycredentialprovider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateApiKeyCredentialProvider		token-vault*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateBrowser	Grants permission to create a new custom browser		aws:RequestTag/${TagKey} aws:TagKeys bedrock-agentcore:securityGroups bedrock-agentcore:subnets	Write
CreateBrowserProfile	Grants permission to create a new browser profile		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateCodeInterpreter	Grants permission to create a new custom code interpreter		aws:RequestTag/${TagKey} aws:TagKeys bedrock-agentcore:securityGroups bedrock-agentcore:subnets	Write
CreateConfigurationBundle	Grants permission to create a new configuration bundle			Write
CreateEvaluator	Grants permission to create a new evaluator		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateEvent	Grants permission to create an Event	memory*	aws:ResourceTag/${TagKey} bedrock-agentcore:actorId bedrock-agentcore:sessionId	Write
CreateGateway	Grants permission to create a new gateway		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateGatewayRule	Grants permission to create a new rule in an existing gateway	gateway*	aws:ResourceTag/${TagKey}	Write
CreateGatewayTarget	Grants permission to create a new target in an existing gateway	gateway*	aws:ResourceTag/${TagKey}	Write
CreateHarness	Grants permission to create a new harness		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateHarnessEndpoint	Grants permission to create a new harness endpoint	harness*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateMemory	Grants permission to create a Memory resource		aws:RequestTag/${TagKey} aws:TagKeys bedrock-agentcore:KmsKeyArn	Write
CreateOauth2CredentialProvider	Grants permission to create a new Credential Provider to access external resources with OAuth2 protocol	oauth2credentialprovider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateOauth2CredentialProvider		token-vault*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateOnlineEvaluationConfig	Grants permission to create a new online evaluation configuration		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePaymentConnector	Grants permission to create a new payment connector under a payment manager	payment-manager*	aws:ResourceTag/${TagKey}	Write
CreatePaymentCredentialProvider	Grants permission to create a new Payment Credential Provider	paymentcredentialprovider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePaymentCredentialProvider		token-vault*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePaymentInstrument	Grants permission to create a new payment instrument	payment-manager*	aws:ResourceTag/${TagKey}	Write
CreatePaymentManager	Grants permission to create a new payment manager		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreatePaymentSession	Grants permission to create a new payment session	payment-manager*	aws:ResourceTag/${TagKey}	Write
CreatePolicy	Grants permission to create a new policy within a policy engine	policy-engine*	aws:ResourceTag/${TagKey}	Write
CreatePolicyEngine	Grants permission to create a new policy engine		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateRegistry	Grants permission to create a new registry			Write
CreateRegistryRecord	Grants permission to create a new registry record	registry*		Write
CreateWorkloadIdentity	Grants permission to create a new Workload Identity	workload-identity*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateWorkloadIdentity	Grants permission to create a new Workload Identity	workload-identity-directory*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteABTest	Grants permission to delete an A/B test	ab-test*	aws:ResourceTag/${TagKey}	Write
DeleteAgentRuntime	Grants permission to delete an agent runtime	runtime*	aws:ResourceTag/${TagKey}	Write
DeleteAgentRuntimeEndpoint	Grants permission to delete an agent runtime endpoint	runtime*	aws:ResourceTag/${TagKey}	Write
DeleteAgentRuntimeEndpoint	Grants permission to delete an agent runtime endpoint	runtime-endpoint*	aws:ResourceTag/${TagKey}	Write
DeleteApiKeyCredentialProvider	Grants permission to delete a registered API Key Credential Provider	apikeycredentialprovider*	aws:ResourceTag/${TagKey}	Write
DeleteApiKeyCredentialProvider		token-vault*	aws:ResourceTag/${TagKey}	Write
DeleteBatchEvaluation	Grants permission to delete a batch evaluation	batch-evaluate*	aws:ResourceTag/${TagKey}	Write
DeleteBrowser	Grants permission to delete a custom browser	browser-custom*	aws:ResourceTag/${TagKey}	Write
DeleteBrowserProfile	Grants permission to delete a browser profile	browser-profile*	aws:ResourceTag/${TagKey}	Write
DeleteCodeInterpreter	Grants permission to delete a custom code interpreter	code-interpreter-custom*	aws:ResourceTag/${TagKey}	Write
DeleteConfigurationBundle	Grants permission to delete a configuration bundle	configuration-bundle*	aws:ResourceTag/${TagKey}	Write
DeleteEvaluator	Grants permission to delete an evaluator	evaluator*	aws:ResourceTag/${TagKey}	Write
DeleteEvent	Grants permission to delete an Event	memory*	aws:ResourceTag/${TagKey} bedrock-agentcore:actorId bedrock-agentcore:sessionId	Write
DeleteGateway	Grants permission to delete an existing gateway	gateway*	aws:ResourceTag/${TagKey}	Write
DeleteGatewayRule	Grants permission to delete an existing gateway rule	gateway*	aws:ResourceTag/${TagKey}	Write
DeleteGatewayTarget	Grants permission to delete an existing gateway target	gateway*	aws:ResourceTag/${TagKey}	Write
DeleteHarness	Grants permission to delete a harness	harness*	aws:ResourceTag/${TagKey}	Write
DeleteHarnessEndpoint	Grants permission to delete a harness endpoint	harness*	aws:ResourceTag/${TagKey}	Write
DeleteHarnessEndpoint	Grants permission to delete a harness endpoint	harness-endpoint*	aws:ResourceTag/${TagKey}	Write
DeleteMemory	Grants permission to delete a Memory resource	memory*	aws:ResourceTag/${TagKey}	Write
DeleteMemoryRecord	Grants permission to delete a Memory Record	memory*	aws:ResourceTag/${TagKey}	Write
DeleteOauth2CredentialProvider	Grants permission to delete a registered OAuth2 Credential Provider	oauth2credentialprovider*	aws:ResourceTag/${TagKey}	Write
DeleteOauth2CredentialProvider		token-vault*	aws:ResourceTag/${TagKey}	Write
DeleteOnlineEvaluationConfig	Grants permission to delete an online evaluation configuration	online-evaluation-config*	aws:ResourceTag/${TagKey}	Write
DeletePaymentConnector	Grants permission to delete a payment connector	payment-manager*	aws:ResourceTag/${TagKey}	Write
DeletePaymentCredentialProvider	Grants permission to delete a registered Payment Credential Provider	paymentcredentialprovider*	aws:ResourceTag/${TagKey}	Write
DeletePaymentCredentialProvider		token-vault*	aws:ResourceTag/${TagKey}	Write
DeletePaymentInstrument	Grants permission to delete a payment instrument	payment-manager*	aws:ResourceTag/${TagKey}	Write
DeletePaymentManager	Grants permission to delete a payment manager	payment-manager*	aws:ResourceTag/${TagKey}	Write
DeletePaymentSession	Grants permission to delete a payment session	payment-manager*	aws:ResourceTag/${TagKey}	Write
DeletePolicy	Grants permission to delete a policy	policy*		Write
DeletePolicy	Grants permission to delete a policy	policy-engine*	aws:ResourceTag/${TagKey}	Write
DeletePolicyEngine	Grants permission to delete a policy engine	policy-engine*	aws:ResourceTag/${TagKey}	Write
DeleteRecommendation	Grants permission to delete a recommendation	recommendation*	aws:ResourceTag/${TagKey}	Write
DeleteRegistry	Grants permission to delete an existing registry	registry*		Write
DeleteRegistryRecord	Grants permission to delete an existing registry record	registry-record*		Write
DeleteResourcePolicy	Grants permission to delete the resource-based policy for a Bedrock resource	gateway	aws:ResourceTag/${TagKey}	Write
		runtime	aws:ResourceTag/${TagKey}
		runtime-endpoint	aws:ResourceTag/${TagKey}
DeleteWorkloadIdentity	Grants permission to delete a registered Workload Identity	workload-identity*	aws:ResourceTag/${TagKey}	Write
DeleteWorkloadIdentity	Grants permission to delete a registered Workload Identity	workload-identity-directory*	aws:ResourceTag/${TagKey}	Write
Evaluate	Grants permission to run an evaluation using an evaluator	evaluator*	aws:ResourceTag/${TagKey}	Write
GetABTest	Grants permission to get details of an A/B test	ab-test*	aws:ResourceTag/${TagKey}	Read
GetAgentCard	Grants permission to retrieve an agent card for A2A	runtime*	aws:ResourceTag/${TagKey}	Read
GetAgentCard	Grants permission to retrieve an agent card for A2A	runtime-endpoint*	aws:ResourceTag/${TagKey}	Read
GetAgentRuntime	Grants permission to get details of an agent runtime	runtime*	aws:ResourceTag/${TagKey}	Read
GetAgentRuntimeEndpoint	Grants permission to get details of an agent runtime endpoint	runtime*	aws:ResourceTag/${TagKey}	Read
GetAgentRuntimeEndpoint		runtime-endpoint*	aws:ResourceTag/${TagKey}	Read
GetApiKeyCredentialProvider	Grants permission to fetch a registered API Key Credential Provider by its name	apikeycredentialprovider*	aws:ResourceTag/${TagKey}	Read
GetApiKeyCredentialProvider		token-vault*	aws:ResourceTag/${TagKey}	Read
GetBatchEvaluation	Grants permission to get details of a batch evaluation	batch-evaluate*	aws:ResourceTag/${TagKey}	Read
GetBrowser	Grants permission to get details of a browser	browser-custom*	aws:ResourceTag/${TagKey}	Read
GetBrowserProfile	Grants permission to get details of a browser profile	browser-profile*	aws:ResourceTag/${TagKey}	Read
GetBrowserSession	Grants permission to get details of a browser session	browser*		Read
GetBrowserSession	Grants permission to get details of a browser session	browser-custom*	aws:ResourceTag/${TagKey}	Read
GetCodeInterpreter	Grants permission to get details of a code interpreter	code-interpreter-custom*	aws:ResourceTag/${TagKey}	Read
GetCodeInterpreterSession	Grants permission to get details of a code interpreter session	code-interpreter*		Read
GetCodeInterpreterSession		code-interpreter-custom*	aws:ResourceTag/${TagKey}	Read
GetConfigurationBundle	Grants permission to get details of a configuration bundle	configuration-bundle*	aws:ResourceTag/${TagKey}	Read
GetConfigurationBundleVersion	Grants permission to get a specific version of a configuration bundle	configuration-bundle*	aws:ResourceTag/${TagKey}	Read
GetEvaluator	Grants permission to get details of an evaluator	evaluator*	aws:ResourceTag/${TagKey}	Read
GetEvent	Grants permission to fetch an Event	memory*	aws:ResourceTag/${TagKey} bedrock-agentcore:actorId bedrock-agentcore:sessionId	Read
GetGateway	Grants permission to retrieve an existing gateway	gateway*	aws:ResourceTag/${TagKey}	Read
GetGatewayRule	Grants permission to retrieve an existing gateway rule	gateway*	aws:ResourceTag/${TagKey}	Read
GetGatewayTarget	Grants permission to retrieve an existing gateway target	gateway*	aws:ResourceTag/${TagKey}	Read
GetHarness	Grants permission to get details of a harness	harness*	aws:ResourceTag/${TagKey}	Read
GetHarnessEndpoint	Grants permission to get details of a harness endpoint	harness*	aws:ResourceTag/${TagKey}	Read
GetHarnessEndpoint	Grants permission to get details of a harness endpoint	harness-endpoint*	aws:ResourceTag/${TagKey}	Read
GetMemory	Grants permission to fetch details for a Memory resource	memory*	aws:ResourceTag/${TagKey}	Read
GetMemoryRecord	Grants permission to fetch a Memory Record	memory*	aws:ResourceTag/${TagKey}	Read
GetOauth2CredentialProvider	Grants permission to fetch a registered OAuth2 Credential Provider by its name	oauth2credentialprovider*	aws:ResourceTag/${TagKey}	Read
GetOauth2CredentialProvider		token-vault*	aws:ResourceTag/${TagKey}	Read
GetOnlineEvaluationConfig	Grants permission to get details of an online evaluation configuration	online-evaluation-config*	aws:ResourceTag/${TagKey}	Read
GetPaymentConnector	Grants permission to retrieve details of a payment connector	payment-manager*	aws:ResourceTag/${TagKey}	Read
GetPaymentCredentialProvider	Grants permission to fetch a registered Payment Credential Provider by its name	paymentcredentialprovider*	aws:ResourceTag/${TagKey}	Read
GetPaymentCredentialProvider		token-vault*	aws:ResourceTag/${TagKey}	Read
GetPaymentInstrument	Grants permission to retrieve details of a payment instrument	payment-manager*	aws:ResourceTag/${TagKey}	Read
GetPaymentInstrumentBalance	Grants permission to retrieve the balance of a payment instrument	payment-manager*	aws:ResourceTag/${TagKey}	Read
GetPaymentManager	Grants permission to retrieve details of a payment manager	payment-manager*	aws:ResourceTag/${TagKey}	Read
GetPaymentSession	Grants permission to retrieve details of a payment session	payment-manager*	aws:ResourceTag/${TagKey}	Read
GetPolicy	Grants permission to retrieve a policy	policy*		Read
GetPolicy	Grants permission to retrieve a policy	policy-engine*	aws:ResourceTag/${TagKey}	Read
GetPolicyEngine	Grants permission to retrieve a policy engine	policy-engine*	aws:ResourceTag/${TagKey}	Read
GetPolicyEngineSummary	Grants permission to retrieve a summary of a policy engine	policy-engine*	aws:ResourceTag/${TagKey}	Read
GetPolicyGeneration	Grants permission to retrieve status and results of a policy generation request	policy-engine*	aws:ResourceTag/${TagKey}	Read
GetPolicyGeneration		policy-generation*		Read
GetPolicyGenerationSummary	Grants permission to retrieve a summary of a policy generation request	policy-engine*	aws:ResourceTag/${TagKey}	Read
GetPolicyGenerationSummary		policy-generation*		Read
GetPolicySummary	Grants permission to retrieve a summary of a policy	policy*		Read
GetPolicySummary	Grants permission to retrieve a summary of a policy	policy-engine*	aws:ResourceTag/${TagKey}	Read
GetRecommendation	Grants permission to get details of a recommendation	recommendation*	aws:ResourceTag/${TagKey}	Read
GetRegistry	Grants permission to retrieve an existing registry	registry*		Read
GetRegistryRecord	Grants permission to retrieve an existing registry record	registry-record*		Read
GetResourceApiKey	Grants permission to retrieve an API Key associated with an Api Key Credential Provider	apikeycredentialprovider*	aws:ResourceTag/${TagKey}	Read
		token-vault*	aws:ResourceTag/${TagKey}
		workload-identity*	aws:ResourceTag/${TagKey}
		workload-identity-directory*	aws:ResourceTag/${TagKey}
GetResourceOauth2Token	Grants permission to retrieve access token with OAuth2 2LO or 3LO flow to access external resource	oauth2credentialprovider*	aws:ResourceTag/${TagKey}	Read
		token-vault*	aws:ResourceTag/${TagKey}
		workload-identity*	aws:ResourceTag/${TagKey}
		workload-identity-directory*	aws:ResourceTag/${TagKey}
GetResourcePaymentToken	Grants permission to retrieve a payment authentication token associated with a Payment Credential Provider	paymentcredentialprovider*	aws:ResourceTag/${TagKey}	Read
		token-vault*	aws:ResourceTag/${TagKey}
		workload-identity*	aws:ResourceTag/${TagKey}
		workload-identity-directory*	aws:ResourceTag/${TagKey}
GetResourcePolicy	Grants permission to retrieve the resource-based policy for a Bedrock resource	gateway	aws:ResourceTag/${TagKey}	Read
		runtime	aws:ResourceTag/${TagKey}
		runtime-endpoint	aws:ResourceTag/${TagKey}
GetTokenVault	Grants permission to fetch the current configuration of the TokenVault, including encryption settings	token-vault*	aws:ResourceTag/${TagKey}	Read
GetWorkloadAccessToken	Grants permission to retrieve an Workload access token for agentic workloads not acting on behalf of a user	workload-identity*	aws:ResourceTag/${TagKey}	Write
GetWorkloadAccessToken		workload-identity-directory*	aws:ResourceTag/${TagKey}	Write
GetWorkloadAccessTokenForJWT	Grants permission to retrieve an Workload access token for agentic workloads acting on behalf of user with JWT token	workload-identity*	aws:ResourceTag/${TagKey} bedrock-agentcore:InboundJwtClaim/aud bedrock-agentcore:InboundJwtClaim/client_id bedrock-agentcore:InboundJwtClaim/iss bedrock-agentcore:InboundJwtClaim/scope bedrock-agentcore:InboundJwtClaim/sub	Write
GetWorkloadAccessTokenForJWT		workload-identity-directory*	aws:ResourceTag/${TagKey} bedrock-agentcore:InboundJwtClaim/aud bedrock-agentcore:InboundJwtClaim/client_id bedrock-agentcore:InboundJwtClaim/iss bedrock-agentcore:InboundJwtClaim/scope bedrock-agentcore:InboundJwtClaim/sub	Write
GetWorkloadAccessTokenForUserId	Grants permission to retrieve an Workload access token for agentic workloads acting on behalf of user with User Id	workload-identity*	aws:ResourceTag/${TagKey} bedrock-agentcore:userid	Write
GetWorkloadAccessTokenForUserId		workload-identity-directory*	aws:ResourceTag/${TagKey} bedrock-agentcore:userid	Write
GetWorkloadIdentity	Grants permission to fetch details for a specific Workload identity, including its name and allowed OAuth2 return URLs	workload-identity*	aws:ResourceTag/${TagKey}	Read
GetWorkloadIdentity		workload-identity-directory*	aws:ResourceTag/${TagKey}	Read
InvokeAgentRuntime	Grants permission to invoke an agent runtime endpoint	runtime*	aws:ResourceTag/${TagKey}	Write
InvokeAgentRuntime	Grants permission to invoke an agent runtime endpoint	runtime-endpoint*	aws:ResourceTag/${TagKey}	Write
InvokeAgentRuntimeCommand	Grants permission to invoke commands on an agent runtime endpoint	runtime*	aws:ResourceTag/${TagKey}	Write
InvokeAgentRuntimeCommand		runtime-endpoint*	aws:ResourceTag/${TagKey}	Write
InvokeAgentRuntimeCommandShell	Grants permission to invoke a command shell on an agent runtime endpoint over a web socket stream	runtime*	aws:ResourceTag/${TagKey}	Write
InvokeAgentRuntimeCommandShell		runtime-endpoint*	aws:ResourceTag/${TagKey}	Write
InvokeAgentRuntimeForUser	Grants permission to invoke an agent runtime endpoint with X-Amzn-Bedrock-AgentCore-Runtime-User-Id header	runtime*	aws:ResourceTag/${TagKey}	Write
InvokeAgentRuntimeForUser		runtime-endpoint*	aws:ResourceTag/${TagKey}	Write
InvokeAgentRuntimeWithWebSocketStream	Grants permission to invoke an agent runtime endpoint with WebSocket stream	runtime*	aws:ResourceTag/${TagKey}	Write
InvokeAgentRuntimeWithWebSocketStream		runtime-endpoint*	aws:ResourceTag/${TagKey}	Write
InvokeAgentRuntimeWithWebSocketStreamForUser	Grants permission to invoke an agent runtime endpoint with WebSocket stream and with X-Amzn-Bedrock-AgentCore-Runtime-User-Id header	runtime*	aws:ResourceTag/${TagKey}	Write
InvokeAgentRuntimeWithWebSocketStreamForUser		runtime-endpoint*	aws:ResourceTag/${TagKey}	Write
InvokeCodeInterpreter	Grants permission to invoke a code interpreter session	code-interpreter*		Write
InvokeCodeInterpreter	Grants permission to invoke a code interpreter session	code-interpreter-custom*	aws:ResourceTag/${TagKey}	Write
InvokeHarness	Grants permission to invoke a harness	harness*	aws:ResourceTag/${TagKey}	Write
InvokeHarness	Grants permission to invoke a harness	harness-endpoint*	aws:ResourceTag/${TagKey}	Write
InvokeRegistryMcp	Grants permission to invoke an MCP operation against an existing registry	registry*		Read
ListABTests	Grants permission to list A/B tests			List
ListActors	Grants permission to list Actors	memory*	aws:ResourceTag/${TagKey}	List
ListAgentRuntimeEndpoints	Grants permission to list agent runtime endpoints			List
ListAgentRuntimeVersions	Grants permission to list agent runtime versions			List
ListAgentRuntimes	Grants permission to list agent runtimes			List
ListApiKeyCredentialProviders	Grants permission to list all API Key Credential Providers in the Token Vault	apikeycredentialprovider*	aws:ResourceTag/${TagKey}	Read
ListApiKeyCredentialProviders		token-vault*	aws:ResourceTag/${TagKey}	Read
ListBatchEvaluations	Grants permission to list batch evaluations			List
ListBrowserProfiles	Grants permission to list browser profiles			List
ListBrowserSessions	Grants permission to list browser sessions			List
ListBrowsers	Grants permission to list browsers			List
ListCodeInterpreterSessions	Grants permission to list code interpreter sessions	code-interpreter*		List
ListCodeInterpreterSessions	Grants permission to list code interpreter sessions	code-interpreter-custom*	aws:ResourceTag/${TagKey}	List
ListCodeInterpreters	Grants permission to list code interpreters			List
ListConfigurationBundleVersions	Grants permission to list versions of a configuration bundle	configuration-bundle*	aws:ResourceTag/${TagKey}	List
ListConfigurationBundles	Grants permission to list configuration bundles			List
ListEvaluators	Grants permission to list evaluators			List
ListEvents	Grants permission to list events	memory*	aws:ResourceTag/${TagKey} bedrock-agentcore:actorId bedrock-agentcore:sessionId	List
ListGatewayRules	Grants permission to list existing gateway rules	gateway*	aws:ResourceTag/${TagKey}	List
ListGatewayTargets	Grants permission to list existing gateway targets	gateway*	aws:ResourceTag/${TagKey}	List
ListGateways	Grants permission to list existing gateways			List
ListHarnessEndpoints	Grants permission to list harness endpoints			List
ListHarnesses	Grants permission to list harnesses			List
ListMemories	Grants permission to list memory resources			List
ListMemoryExtractionJobs	Grants permission to list extraction jobs for this memory	memory*	aws:ResourceTag/${TagKey}	List
ListMemoryRecords	Grants permission to list memory records	memory*	aws:ResourceTag/${TagKey} bedrock-agentcore:namespace bedrock-agentcore:strategyId	List
ListOauth2CredentialProviders	Grants permission to list all OAuth2 Credential Providers in the Token Vault	oauth2credentialprovider*	aws:ResourceTag/${TagKey}	Read
ListOauth2CredentialProviders		token-vault*	aws:ResourceTag/${TagKey}	Read
ListOnlineEvaluationConfigs	Grants permission to list online evaluation configurations			List
ListPaymentConnectors	Grants permission to list payment connectors under a payment manager	payment-manager*	aws:ResourceTag/${TagKey}	List
ListPaymentCredentialProviders	Grants permission to list all Payment Credential Providers in the Token Vault	paymentcredentialprovider*	aws:ResourceTag/${TagKey}	List
ListPaymentCredentialProviders		token-vault*	aws:ResourceTag/${TagKey}	List
ListPaymentInstruments	Grants permission to list payment instruments	payment-manager*	aws:ResourceTag/${TagKey}	List
ListPaymentManagers	Grants permission to list payment managers			List
ListPaymentSessions	Grants permission to list payment sessions	payment-manager*	aws:ResourceTag/${TagKey}	List
ListPolicies	Grants permission to list policies within a policy engine	policy-engine*	aws:ResourceTag/${TagKey}	List
ListPolicyEngineSummaries	Grants permission to list policy engine summaries			List
ListPolicyEngines	Grants permission to list policy engines			List
ListPolicyGenerationAssets	Grants permission to list generated policy assets from a generation request	policy-engine*	aws:ResourceTag/${TagKey}	List
ListPolicyGenerationAssets		policy-generation*		List
ListPolicyGenerationSummaries	Grants permission to list policy generation summaries	policy-engine*	aws:ResourceTag/${TagKey}	List
ListPolicyGenerations	Grants permission to list policy generation requests	policy-engine*	aws:ResourceTag/${TagKey}	List
ListPolicySummaries	Grants permission to list policy summaries within a policy engine	policy-engine*	aws:ResourceTag/${TagKey}	List
ListRecommendations	Grants permission to list recommendations			List
ListRegistries	Grants permission to list existing registries			List
ListRegistryRecords	Grants permission to list existing registry records in a registry	registry*		List
ListSessions	Grants permission to list sessions	memory*	aws:ResourceTag/${TagKey} bedrock-agentcore:actorId	List
ListTagsForResource	Grants permission to list tags for a Bedrock-AgentCore resource	apikeycredentialprovider	aws:ResourceTag/${TagKey}	List
		browser-custom	aws:ResourceTag/${TagKey}
		browser-profile	aws:ResourceTag/${TagKey}
		code-interpreter-custom	aws:ResourceTag/${TagKey}
		evaluator	aws:ResourceTag/${TagKey}
		gateway	aws:ResourceTag/${TagKey}
		harness	aws:ResourceTag/${TagKey}
		memory	aws:ResourceTag/${TagKey}
		oauth2credentialprovider	aws:ResourceTag/${TagKey}
		online-evaluation-config	aws:ResourceTag/${TagKey}
		payment-manager	aws:ResourceTag/${TagKey}
		paymentcredentialprovider	aws:ResourceTag/${TagKey}
		policy-engine	aws:ResourceTag/${TagKey}
		runtime	aws:ResourceTag/${TagKey}
		runtime-endpoint	aws:ResourceTag/${TagKey}
		token-vault	aws:ResourceTag/${TagKey}
		workload-identity	aws:ResourceTag/${TagKey}
		workload-identity-directory	aws:ResourceTag/${TagKey}
ListWorkloadIdentities	Grants permission to list all Workload Identities in the caller's AWS account	workload-identity*	aws:ResourceTag/${TagKey}	Read
ListWorkloadIdentities		workload-identity-directory*	aws:ResourceTag/${TagKey}	Read
ProcessPayment	Grants permission to process a payment transaction	payment-manager*	aws:ResourceTag/${TagKey}	Write
PutResourcePolicy	Grants permission to create or update the resource-based policy for a Bedrock resource	gateway	aws:ResourceTag/${TagKey}	Write
		runtime	aws:ResourceTag/${TagKey}
		runtime-endpoint	aws:ResourceTag/${TagKey}
RetrieveMemoryRecords	Grants permission to retrieve memory records through sematic query	memory*	aws:ResourceTag/${TagKey} bedrock-agentcore:namespace bedrock-agentcore:strategyId	List
SaveBrowserSessionProfile	Grants permission to save a browser session profile	browser*		Write
		browser-custom*	aws:ResourceTag/${TagKey}
		browser-profile*	aws:ResourceTag/${TagKey}
SearchRegistryRecords	Grants permission to search for registry records	registry*		Read
SetTokenVaultCMK	Grants permission to associate a Customer Managed Key (CMK) or a Service Managed Key with a specific TokenVault	token-vault*	aws:ResourceTag/${TagKey}	Write
StartBatchEvaluation	Grants permission to start a batch evaluation			Write
StartBrowserSession	Grants permission to start a new browser session	browser*		Write
		browser-custom*	aws:ResourceTag/${TagKey}
		browser-profile	aws:ResourceTag/${TagKey}
StartCodeInterpreterSession	Grants permission to start a new code interpreter session	code-interpreter*		Write
StartCodeInterpreterSession	Grants permission to start a new code interpreter session	code-interpreter-custom*	aws:ResourceTag/${TagKey}	Write
StartMemoryExtractionJob	Grants permission to start memory extraction job	memory*	aws:ResourceTag/${TagKey} bedrock-agentcore:actorId bedrock-agentcore:sessionId bedrock-agentcore:strategyId	Write
StartPolicyGeneration	Grants permission to start an AI-powered policy generation request	policy-engine*	aws:ResourceTag/${TagKey}	Write
StartRecommendation	Grants permission to start a recommendation			Write
StopBatchEvaluation	Grants permission to stop a batch evaluation	batch-evaluate*	aws:ResourceTag/${TagKey}	Write
StopBrowserSession	Grants permission to stop a browser session	browser*		Write
StopBrowserSession	Grants permission to stop a browser session	browser-custom*	aws:ResourceTag/${TagKey}	Write
StopCodeInterpreterSession	Grants permission to stop a code interpreter session	code-interpreter*		Write
StopCodeInterpreterSession	Grants permission to stop a code interpreter session	code-interpreter-custom*	aws:ResourceTag/${TagKey}	Write
StopRuntimeSession	Grants permission to stop a runtime session	runtime*	aws:ResourceTag/${TagKey}	Write
StopRuntimeSession	Grants permission to stop a runtime session	runtime-endpoint*	aws:ResourceTag/${TagKey}	Write
SubmitRegistryRecordForApproval	Grants permission to submit a registry record for approval	registry-record*		Write
TagResource	Grants permission to Tag a Bedrock-AgentCore resource	apikeycredentialprovider	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		browser-custom	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		browser-profile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		code-interpreter-custom	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		evaluator	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		gateway	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		harness	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		memory	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		oauth2credentialprovider	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		online-evaluation-config	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		payment-manager	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		paymentcredentialprovider	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		policy-engine	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		runtime	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		runtime-endpoint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		token-vault	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workload-identity	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workload-identity-directory	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to Untag a Bedrock-AgentCore resource	apikeycredentialprovider	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		browser-custom	aws:ResourceTag/${TagKey} aws:TagKeys
		browser-profile	aws:ResourceTag/${TagKey} aws:TagKeys
		code-interpreter-custom	aws:ResourceTag/${TagKey} aws:TagKeys
		evaluator	aws:ResourceTag/${TagKey} aws:TagKeys
		gateway	aws:ResourceTag/${TagKey} aws:TagKeys
		harness	aws:ResourceTag/${TagKey} aws:TagKeys
		memory	aws:ResourceTag/${TagKey} aws:TagKeys
		oauth2credentialprovider	aws:ResourceTag/${TagKey} aws:TagKeys
		online-evaluation-config	aws:ResourceTag/${TagKey} aws:TagKeys
		payment-manager	aws:ResourceTag/${TagKey} aws:TagKeys
		paymentcredentialprovider	aws:ResourceTag/${TagKey} aws:TagKeys
		policy-engine	aws:ResourceTag/${TagKey} aws:TagKeys
		runtime	aws:ResourceTag/${TagKey} aws:TagKeys
		runtime-endpoint	aws:ResourceTag/${TagKey} aws:TagKeys
		token-vault	aws:ResourceTag/${TagKey} aws:TagKeys
		workload-identity	aws:ResourceTag/${TagKey} aws:TagKeys
		workload-identity-directory	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateABTest	Grants permission to update an A/B test	ab-test*	aws:ResourceTag/${TagKey}	Write
UpdateAgentRuntime	Grants permission to update an agent runtime	runtime*	aws:ResourceTag/${TagKey} bedrock-agentcore:RuntimeAuthorizerType bedrock-agentcore:securityGroups bedrock-agentcore:subnets	Write
UpdateAgentRuntimeEndpoint	Grants permission to update an agent runtime endpoint	runtime*	aws:ResourceTag/${TagKey}	Write
UpdateAgentRuntimeEndpoint	Grants permission to update an agent runtime endpoint	runtime-endpoint*	aws:ResourceTag/${TagKey}	Write
UpdateApiKeyCredentialProvider	Grants permission to update an existing API Key Credential Provider	apikeycredentialprovider*	aws:ResourceTag/${TagKey}	Write
UpdateApiKeyCredentialProvider		token-vault*	aws:ResourceTag/${TagKey}	Write
UpdateBrowserStream	Grants permission to update the status of browser session stream	browser*		Write
UpdateBrowserStream		browser-custom*	aws:ResourceTag/${TagKey}	Write
UpdateConfigurationBundle	Grants permission to update a configuration bundle	configuration-bundle*	aws:ResourceTag/${TagKey}	Write
UpdateEvaluator	Grants permission to update an evaluator	evaluator*	aws:ResourceTag/${TagKey}	Write
UpdateGateway	Grants permission to update an existing gateway	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateGatewayRule	Grants permission to update an existing gateway rule	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateGatewayTarget	Grants permission to update an existing gateway target	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateHarness	Grants permission to update a harness	harness*	aws:ResourceTag/${TagKey}	Write
UpdateHarnessEndpoint	Grants permission to update harness endpoint	harness*	aws:ResourceTag/${TagKey}	Write
UpdateHarnessEndpoint	Grants permission to update harness endpoint	harness-endpoint*	aws:ResourceTag/${TagKey}	Write
UpdateMemory	Grants permission to update a Memory resource	memory*	aws:ResourceTag/${TagKey}	Write
UpdateOauth2CredentialProvider	Grants permission to update an existing OAuth2 Credential Provider	oauth2credentialprovider*	aws:ResourceTag/${TagKey}	Write
UpdateOauth2CredentialProvider		token-vault*	aws:ResourceTag/${TagKey}	Write
UpdateOnlineEvaluationConfig	Grants permission to update an online evaluation configuration	online-evaluation-config*	aws:ResourceTag/${TagKey}	Write
UpdatePaymentConnector	Grants permission to update an existing payment connector	payment-manager*	aws:ResourceTag/${TagKey}	Write
UpdatePaymentCredentialProvider	Grants permission to update an existing Payment Credential Provider	paymentcredentialprovider*	aws:ResourceTag/${TagKey}	Write
UpdatePaymentCredentialProvider		token-vault*	aws:ResourceTag/${TagKey}	Write
UpdatePaymentManager	Grants permission to update an existing payment manager	payment-manager*	aws:ResourceTag/${TagKey}	Write
UpdatePolicy	Grants permission to update an existing policy	policy*		Write
UpdatePolicy	Grants permission to update an existing policy	policy-engine*	aws:ResourceTag/${TagKey}	Write
UpdatePolicyEngine	Grants permission to update a policy engine	policy-engine*	aws:ResourceTag/${TagKey}	Write
UpdateRegistry	Grants permission to update an existing registry	registry*		Write
UpdateRegistryRecord	Grants permission to update an existing registry record	registry-record*		Write
UpdateRegistryRecordStatus	Grants permission to update the status of a registry record	registry-record*		Write
UpdateWorkloadIdentity	Grants permission to update the metadata of an existing Workload Identity	workload-identity*	aws:ResourceTag/${TagKey}	Write
UpdateWorkloadIdentity		workload-identity-directory*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Bedrock Agentcore

The following actions are defined by Amazon Bedrock Agentcore but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AllowVendedLogDeliveryForResource	Grants permission to configure vended telemetry for a resource	memory*	aws:ResourceTag/${TagKey}	Permissions management, Write
AllowVendedLogDeliveryForResource		payment-manager	aws:ResourceTag/${TagKey}	Permissions management, Write
AuthorizeAction	Grants permission to evaluate Cedar policies for authorization requests	gateway*	aws:ResourceTag/${TagKey}	Permissions management, Write
AuthorizeAction		policy-engine*	aws:ResourceTag/${TagKey}	Permissions management, Write
GatewayAssociateWebACL	Grants permission to associate an AWS WAF Web ACL with an AgentCore Gateway	gateway*	aws:ResourceTag/${TagKey}	Write
GatewayDisassociateWebACL	Grants permission to remove the AWS WAF Web ACL association from an AgentCore Gateway	gateway*	aws:ResourceTag/${TagKey}	Write
GatewayGetWebACLForResource	Grants permission to retrieve the AWS WAF Web ACL ARN currently associated with an AgentCore Gateway	gateway*	aws:ResourceTag/${TagKey}	Read
GatewayListResourcesForWebACL	Grants permission to list AgentCore Gateways associated with an AWS WAF Web ACL			List
InvokeGateway	Grants permission to invoke a gateway	gateway*	aws:ResourceTag/${TagKey}	Permissions management, Write
InvokeWebSearch	Grants permission to invoke a web search target	web-search*		Permissions management, Write
ManageAdminPolicy	Grants permission to create or modify wildcard policies that apply to gateway resources			Permissions management, Write
ManageResourceScopedPolicy	Grants permission to create or modify policies that apply to specific gateway resources	gateway*	aws:ResourceTag/${TagKey}	Permissions management, Write
PartiallyAuthorizeActions	Grants permission to perform partial evaluation of Cedar policies to authorize a caller to list tools they are allowed to call	gateway*	aws:ResourceTag/${TagKey}	Permissions management, Write
PartiallyAuthorizeActions		policy-engine*	aws:ResourceTag/${TagKey}	Permissions management, Write
SynchronizeGatewayTargets	Grants permission to enable search on gateways	gateway*	aws:ResourceTag/${TagKey}	Permissions management, Write

Resource types defined by Amazon Bedrock Agentcore

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
ab-test	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:ab-test/${ABTestId}	aws:ResourceTag/${TagKey}
apikeycredentialprovider	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:token-vault/${TokenVaultId}/apikeycredentialprovider/${Name}	aws:ResourceTag/${TagKey}
batch-evaluate	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:batch-evaluate/${BatchEvaluationId}	aws:ResourceTag/${TagKey}
browser	arn:${Partition}:bedrock-agentcore:${Region}:aws:browser/${BrowserId}
browser-custom	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:browser-custom/${BrowserId}	aws:ResourceTag/${TagKey}
browser-profile	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:browser-profile/${BrowserProfileId}	aws:ResourceTag/${TagKey}
code-interpreter	arn:${Partition}:bedrock-agentcore:${Region}:aws:code-interpreter/${CodeInterpreterId}
code-interpreter-custom	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:code-interpreter-custom/${CodeInterpreterId}	aws:ResourceTag/${TagKey}
configuration-bundle	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:configuration-bundle/${ConfigurationBundleId}	aws:ResourceTag/${TagKey}
evaluator	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:evaluator/${EvaluatorId}	aws:ResourceTag/${TagKey}
gateway	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:gateway/${GatewayId}	aws:ResourceTag/${TagKey}
harness	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:harness/${HarnessId}	aws:ResourceTag/${TagKey}
harness-endpoint	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:harness/${HarnessId}/harness-endpoint/${Name}	aws:ResourceTag/${TagKey}
memory	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:memory/${MemoryId}	aws:ResourceTag/${TagKey}
oauth2credentialprovider	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:token-vault/${TokenVaultId}/oauth2credentialprovider/${Name}	aws:ResourceTag/${TagKey}
online-evaluation-config	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:online-evaluation-config/${OnlineEvaluationConfigId}	aws:ResourceTag/${TagKey}
payment-manager	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:payment-manager/${PaymentManagerId}	aws:ResourceTag/${TagKey}
paymentcredentialprovider	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:token-vault/${TokenVaultId}/paymentcredentialprovider/${Name}	aws:ResourceTag/${TagKey}
policy	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:policy-engine/${PolicyEngineId}/policy/${PolicyId}
policy-engine	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:policy-engine/${PolicyEngineId}	aws:ResourceTag/${TagKey}
policy-generation	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:policy-engine/${PolicyEngineId}/policy-generation/${PolicyGenerationId}
recommendation	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:recommendation/${RecommendationId}	aws:ResourceTag/${TagKey}
registry	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:registry/${RegistryId}
registry-record	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:registry/${RegistryId}/record/${RecordId}
runtime	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:runtime/${RuntimeId}	aws:ResourceTag/${TagKey}
runtime-endpoint	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:runtime/${RuntimeId}/runtime-endpoint/${Name}	aws:ResourceTag/${TagKey}
token-vault	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:token-vault/${TokenVaultId}	aws:ResourceTag/${TagKey}
web-search	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:tool/web-search.v1
workload-identity	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:workload-identity-directory/${DirectoryId}/workload-identity/${WorkloadIdentityName}	aws:ResourceTag/${TagKey}
workload-identity-directory	arn:${Partition}:bedrock-agentcore:${Region}:${Account}:workload-identity-directory/${DirectoryId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Bedrock Agentcore

Amazon Bedrock Agentcore defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by creating requests based on the allowed set of values for each of the mandatory tags	String
aws:ResourceTag/${TagKey}	Filters access by having actions based on the tag value associated with the resource	String
aws:TagKeys	Filters access by creating requests based on the presence of mandatory tags in the request	ArrayOfString
bedrock-agentcore:AllowedQueryParameters	Filters access by the metadataConfiguration.allowedQueryParameters attribute of a gateway target	ArrayOfString
bedrock-agentcore:AllowedRequestHeaders	Filters access by the metadataConfiguration.allowedRequestHeaders attribute of a gateway target	ArrayOfString
bedrock-agentcore:AllowedResponseHeaders	Filters access by the metadataConfiguration.allowedResponseHeaders attribute of a gateway target	ArrayOfString
bedrock-agentcore:CredentialProviderScope	Filters access by the scopes attribute of an OAuth credential provider on a gateway target	ArrayOfString
bedrock-agentcore:CredentialProviderType	Filters access by the credentialProviderConfigurations.credentialProviderType attribute of a gateway target	String
bedrock-agentcore:DiscoveryUrl	Filters access by the authorizerConfiguration.customJWTAuthorizer.discoveryUrl attribute of a Gateway	String
bedrock-agentcore:GatewayAuthorizerType	Filters access by the authorizerType attribute on a Gateway	String
bedrock-agentcore:HttpTargetConfigurationType	Filters access by the HTTP target configuration type of a gateway target	String
bedrock-agentcore:InboundJwtClaim/aud	Filters access by the audience claim (aud) in the JWT passed in the request	ArrayOfString
bedrock-agentcore:InboundJwtClaim/client_id	Filters access by the client_id claim in the JWT passed in the request	String
bedrock-agentcore:InboundJwtClaim/iss	Filters access by the issuer (iss) claim present in the JWT passed in the request	String
bedrock-agentcore:InboundJwtClaim/scope	Filters access by the scope claim in the JWT passed in the request	ArrayOfString
bedrock-agentcore:InboundJwtClaim/sub	Filters access by the subject claim (sub) in the JWT passed in the request	String
bedrock-agentcore:InferenceTargetConfigurationType	Filters access by the inference target configuration type of a gateway target	String
bedrock-agentcore:KmsKeyArn	Filters access by KMS Key arn provided	String
bedrock-agentcore:McpTargetConfigurationType	Filters access by the MCP target configuration type of a gateway target	String
bedrock-agentcore:PolicyEngineArn	Filters access by the policyEngineConfiguration.arn attribute of a Gateway	String
bedrock-agentcore:PolicyEngineMode	Filters access by the policyEngineConfiguration.mode attribute of a Gateway	String
bedrock-agentcore:PrivateEndpointType	Filters access by the private endpoint type of a gateway target	String
bedrock-agentcore:ProtocolType	Filters access by the protocolType attribute of a Gateway	String
bedrock-agentcore:ResourceConfigurationIdentifier	Filters access by the resource configuration identifier of a gateway target private endpoint	String
bedrock-agentcore:RuntimeAuthorizerType	Filters access by the authorizer type configured for the AgentCore runtime	String
bedrock-agentcore:actorId	Filters access by Actor Id	String
bedrock-agentcore:namespace	Filters access by namespace	String
bedrock-agentcore:securityGroups	Filters access by the ID of security groups configured for an AgentCore resource	ArrayOfString
bedrock-agentcore:sessionId	Filters access by Session Id	String
bedrock-agentcore:strategyId	Filters access by Memory Strategy Id	String
bedrock-agentcore:subnets	Filters access by the ID of subnets configured for an AgentCore resource	ArrayOfString
bedrock-agentcore:userid	Filters access by the static user ID value passed in the request	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Bedrock (bedrock)