View a markdown version of this page

使用带有策略的 AgentCore 网关 AgentCore - Amazon Bedrock AgentCore
列出包含策略的 AgentCore Gateway 工具 AgentCore带有策略的呼叫网关工具政策对策

使用带有策略的 AgentCore 网关 AgentCore

按照网关授权和身份验证指南获取网关访问所需的凭证。

仅限 MCP 工具

策略评估仅适用于 MCP 工具。无论策略评估模式如何，网关始终允许 MCP 提示 (prompts/list、prompts/get) 和资源 (resources/list、resources/read、resources/templates/list)。

列出包含策略的 AgentCore Gateway 工具 AgentCore

工具列表被视为元操作。当委托人列出可用工具时，策略引擎不会评估特定工具调用的完整上下文（例如，输入参数）。

委托人只能在列表中查看政策允许他们调用的工具。由于工具调用的完整上下文在列表期间不可用，这意味着如果存在允许调用该工具的任何情况，则允许委托人发布该工具。

因此，列表中出现的工具并不能保证对该工具的后续调用会获得授权。实际工具调用的授权决策是使用完整的请求上下文（包括输入参数）单独评估的。

选择以下方法之一：

例
curl

  1. curl -X POST \
  https://mygateway-abcdefghij.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -d '{
    "jsonrpc": "2.0",
    "id": "list-tools-request",
    "method": "tools/list"
  }'
Python requests package

  1. import requests
import json

def list_tools(gateway_url, access_token):
    headers = {
        "Content-Type": "application/json",
        "Authorization": f"Bearer {access_token}"
    }

    payload = {
        "jsonrpc": "2.0",
        "id": "list-tools-request",
        "method": "tools/list"
    }

    response = requests.post(gateway_url, headers=headers, json=payload)
    return response.json()

# Example usage
gateway_url = "https://mygateway-abcdefghij.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp"
access_token = "YOUR_ACCESS_TOKEN"
tools = list_tools(gateway_url, access_token)
print(json.dumps(tools, indent=2))

    响应仅返回您的政策允许您查看的工具。被策略拒绝的工具不会出现在列表中。

带有策略的呼叫网关工具

对您的网关进行工具调用。策略评估决定是允许还是拒绝呼叫。

选择以下方法之一：

例
curl

  1. # Call a tool to test policy enforcement
curl -X POST \
  https://mygateway-abcdefghij.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -d '{
    "jsonrpc": "2.0",
    "id": "test-policy",
    "method": "tools/call",
    "params": {
      "name": "tool_name",
      "arguments": {arguments}
    }
  }'
Python requests package

  1. import requests
import json

def call_gateway_tool(gateway_url, access_token, tool_name, arguments):
    headers = {
        "Content-Type": "application/json",
        "Authorization": f"Bearer {access_token}"
    }

    payload = {
        "jsonrpc": "2.0",
        "id": "test-policy",
        "method": "tools/call",
        "params": {
            "name": tool_name,
            "arguments": arguments
        }
    }

    response = requests.post(gateway_url, headers=headers, json=payload)
    return response.json()

# Example usage
gateway_url = "https://mygateway-abcdefghij.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp"
access_token = "YOUR_ACCESS_TOKEN"
result = call_gateway_tool(
    gateway_url,
    access_token,
    "RefundTool___process_refund",
    {
        "orderId": "12345",
        "amount": 450,
        "reason": "Defective product"
    }
)
print(json.dumps(result, indent=2))

政策对策

当策略允许请求时：

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "isError": false,
    "content": [
      {
        "type": "text",
        "text": "ToolResult"
      }
    ]
  }
}

当策略拒绝请求时：

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [
      {
        "type": "text",
        "text": "AuthorizeActionException - Tool Execution Denied: Tool call not allowed due to policy enforcement [No policy applies to the request (denied by default).]"
      }
    ],
    "isError": true
  }
}