Amazon Bedrock AgentCore Integration

The Ledger Amazon Bedrock AgentCore integration lets you scan and manage AI agent resources and secrets in Amazon Bedrock AgentCore. The integration discovers:

• AgentCore agent runtimes
• Secrets bound to agent runtimes
• Token-vault credential providers that hold third-party credentials
• Model Context Protocol (MCP) gateways that connect agents to external tools

The integration also inventories IAM access keys in the account and flags keys whose owning principal can invoke Bedrock.

Setup is a one-time configuration using a Terraform template provided during the setup process. This integration is separate from the AWS integration and is scoped to a single AWS account and region. Discovered agents appear on the "Applications" page in the Defakto Console.

What Data is Collected?

1. Applications - AgentCore agent runtimes, including their execution role, artifact, protocol, network mode, and inbound authorizer.
2. Identities - AgentCore workload identities, token-vault OAuth2 and API-key credential providers, AgentCore gateways and their targets, and AWS IAM users that own access keys.
3. Secrets - Inline environment-variable secrets on agent runtimes (recorded by variable name only), environment variables that reference AWS Secrets Manager secrets (recorded by ARN), OAuth2 client secrets and API keys stored in the AgentCore token vault (recorded by their Secrets Manager ARN), and IAM access keys.

Supported Remediations

• Migrations: Eligible inline Anthropic API keys can be replaced with a Defakto-issued workload identity through Anthropic Workload Identity Federation when an Anthropic integration is configured and the agent is enrolled in a Defakto trust domain with a matching serverless SVID issuance policy. See the Anthropic federation tutorial.

All other discovered credentials are discovery-only at this time. Anthropic API keys referenced through AWS Secrets Manager cannot be correlated or migrated because their values are never read.

Integration Permissions

The integration requires the following read-only permissions in your account. The role explicitly denies the AgentCore secret-retrieval actions and secretsmanager:GetSecretValue, so the scanner can never read secret values.

AWS Bedrock AgentCore Integration IAM Policy

PolicyDocument:
Version: '2012-10-17'
Statement:
    - Effect: Allow
    Action:
        # STS permissions
        - sts:GetCallerIdentity
        # Bedrock AgentCore read-only discovery
        - bedrock-agentcore:ListAgentRuntimes
        - bedrock-agentcore:GetAgentRuntime
        - bedrock-agentcore:ListWorkloadIdentities
        - bedrock-agentcore:ListOauth2CredentialProviders
        - bedrock-agentcore:GetOauth2CredentialProvider
        - bedrock-agentcore:ListApiKeyCredentialProviders
        - bedrock-agentcore:GetApiKeyCredentialProvider
        - bedrock-agentcore:ListGateways
        - bedrock-agentcore:GetGateway
        - bedrock-agentcore:ListGatewayTargets
        - bedrock-agentcore:GetGatewayTarget
        # IAM read-only inventory (principals and access keys)
        - iam:GetAccountAuthorizationDetails
        - iam:ListAccessKeys
        - iam:GetAccessKeyLastUsed
    Resource: '*'
    - Effect: Deny
    Action:
        # Secret-retrieval actions are never granted, even if a broader
        # managed policy is attached to the role out of band
        - bedrock-agentcore:GetResourceOauth2Token
        - bedrock-agentcore:GetResourceApiKey
        - bedrock-agentcore:GetResourcePaymentToken
        - bedrock-agentcore:GetWorkloadAccessToken
        - bedrock-agentcore:GetWorkloadAccessTokenForJWT
        - bedrock-agentcore:GetWorkloadAccessTokenForUserId
        - secretsmanager:GetSecretValue
    Resource: '*'
    - Effect: Allow
    Action:
        # Integration self-access check
        - iam:SimulatePrincipalPolicy
    Resource: !Sub "arn:aws:iam::$${AWS::AccountId}:role/ledger-integration-$${IntegrationName}"

Installation

No applications are required to be installed on the target environment. You configure permissions in IAM, and Defakto will use those to scan for resources remotely.

Prerequisites

An operator should be able to create the following resources in the target AWS account:

1. CloudFormation Stack
2. IAM OIDC Provider
3. IAM Role

Configuration of these resources is automated through Terraform provided during the setup process. You should have a recent version (>1.0) of Terraform or OpenTofu installed. For production environments, we recommend a shared or managed Terraform state backend.

Steps

1. Visit the "Integrations" page in the Defakto Console. Click "Create Integration".
2. Select "Amazon Bedrock AgentCore" from the list of available integrations under "Mind". Continue configuring the following fields, then click "Next Step" to continue.
   • AWS Region: The region to scan. AgentCore is a regional service, so the integration collects resources from this region only. The CloudFormation stack is also deployed to this region. (default: us-east-1)
   • Integration Name: A unique name for this integration. This will be used to identify the integration in the Console and CLI. (required)
3. Follow the on-screen instructions to download the Terraform template for the integration configuration. Inspect the template and ensure you understand the resources that will be created. Then execute the commands to apply the template and output the Role ARN. Enter the Role ARN in the Console and click "Save and Continue". This step also verifies the connectivity between Defakto and AWS, so if there are any issues, you will be notified before moving on.
4. If the creation was successful, you'll be directed to the integration details page. The integration will automatically start scanning for resources in the connected account. Use the "Run Now" button to trigger an immediate scan and refresh the inventory from this integration at any time.

Caveats

• This integration scans a single AWS account and region; configure one integration per account and region pair.
• Whether an IAM access key can invoke Bedrock is determined by static analysis of the account's IAM policies. The analysis ignores Service Control Policies (SCPs), permission boundaries, and condition-based denies, so a flagged key means an Allow for a Bedrock invoke action exists on an attached policy, not that a full authorization decision was evaluated.
• The Authorization Scope risk factor for token-vault credentials is derived from the OAuth2 grant type configured on gateway targets and is capped at Medium; deeper policy inspection is not yet performed.
• Inline environment-variable values on agent runtimes are never collected; only the variable name is recorded. For values that look like Anthropic API keys, a redacted hint and fingerprint are recorded so the secret can be correlated with credentials discovered by other integrations.