Bedrock AgentCore

23 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

BedrockAgentCoreApiKeyCredentialProvider # CLOUD CONTROL · AWS::BedrockAgentCore::ApiKeyCredentialProvider ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: spec must contain an API key in plain text. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. BedrockAgentCoreApiKeyCredentialProvider manages AWS::BedrockAgentCore::ApiKeyCredentialProvider through the AWS Cloud Control API.

kubectl get bedrockagentcoreapikeycredentialproviders · example on GitHub

Example

# BedrockAgentCoreApiKeyCredentialProvider — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoreapikeycredentialprovider
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreApiKeyCredentialProvider
metadata:
  name: example-bedrockagentcoreapikeycredentialprovider
  namespace: default
spec:
  apiKey: example
  apiKeySecretConfig:
    jsonKey: example
    secretId: example-id
  apiKeySecretSource: MANAGED
  name: example-bedrockagentcoreapikeycredentialprovider
  providerRef:
    name: example-bedrockagentcoreapikeycredentialprovider
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`apiKey`	string	—	The API key to use for authentication
`apiKeySecretConfig`	object	—	Configuration for a customer-provided secret containing the API key
`apiKeySecretConfig.jsonKey`	string	yes	The JSON key within the secret that contains the credential value
`apiKeySecretConfig.secretId`	string	yes	The ID or ARN of the secret in AWS Secrets Manager
`apiKeySecretSource`	enum	—	The source of the API key secret. Allowed: `MANAGED, EXTERNAL`
`name`	string	yes	The name of the API key credential provider Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Tags to assign to the API key credential provider
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`apiKeySecretArn`	object	—	The ARN of the API key secret in AWS Secrets Manager Read-only: reported by AWS after creation.
`apiKeySecretArn.secretArn`	string	yes	The ARN of the secret in AWS Secrets Manager
`apiKeySecretJsonKey`	string	—	The JSON key within the secret that contains the API key value Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdTime`	string	—	The timestamp when the credential provider was created Read-only: reported by AWS after creation.
`credentialProviderArn`	string	—	The Amazon Resource Name (ARN) of the API key credential provider Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedTime`	string	—	The timestamp when the credential provider was last updated Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

BedrockAgentCoreBrowserCustom # CLOUD CONTROL · AWS::BedrockAgentCore::BrowserCustom

BedrockAgentCoreBrowserCustom manages AWS::BedrockAgentCore::BrowserCustom through the AWS Cloud Control API.

kubectl get bedrockagentcorebrowsercustoms · example on GitHub

Example

# BedrockAgentCoreBrowserCustom — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcorebrowsercustom
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreBrowserCustom
metadata:
  name: example-bedrockagentcorebrowsercustom
  namespace: default
spec:
  browserSigning:
    enabled: true
  certificates:
  - certificateLocation:
      secretArn: arn:aws:iam::123456789012:role/example-role
  description: Managed by konfig-konector
  enterprisePolicies:
  - location:
      bucket: example
      prefix: example
    type: MANAGED
  executionRoleArn: arn:aws:iam::123456789012:role/example-role
  name: example-bedrockagentcorebrowsercustom
  networkConfiguration:
    networkMode: PUBLIC
    vpcConfig:
      securityGroups:
      - example
      subnets:
      - example
  providerRef:
    name: example-bedrockagentcorebrowsercustom
    region: us-east-1
  recordingConfig:
    enabled: true
    s3Location:
      bucket: example
      prefix: example
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`browserSigning`	object	—	Browser signing configuration.
`browserSigning.enabled`	boolean	—
`certificates`	array<object>	—	List of root CA certificates in PEM format.
`certificates[].certificateLocation`	object	yes	Certificate location in Secrets Manager.
`certificates[].certificateLocation.secretArn`	string	yes	Secrets Manager secret ARN.
`description`	string	—	The description of the browser.
`enterprisePolicies`	array<object>	—	A list of enterprise policy files for the browser.
`enterprisePolicies[].location`	object	yes	The S3 location of the enterprise policy file.
`enterprisePolicies[].location.bucket`	string	yes
`enterprisePolicies[].location.prefix`	string	yes
`enterprisePolicies[].type`	enum	yes	The type of browser enterprise policy. Allowed: `MANAGED, RECOMMENDED`
`executionRoleArn`	string	—	The Amazon Resource Name (ARN) of the IAM role that the browser uses to access resources.
`name`	string	yes	The name of the browser.
`networkConfiguration`	object	yes	Network configuration for browser.
`networkConfiguration.networkMode`	enum	yes	Allowed: `PUBLIC, VPC`
`networkConfiguration.vpcConfig`	object	—	BedrockAgentCoreBrowserCustomVpcConfig is a nested property type of AWS::BedrockAgentCore::BrowserCustom.
`networkConfiguration.vpcConfig.securityGroups`	array<string>	yes
`networkConfiguration.vpcConfig.subnets`	array<string>	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`recordingConfig`	object	—	Recording configuration for browser.
`recordingConfig.enabled`	boolean	—
`recordingConfig.s3Location`	object	—	BedrockAgentCoreBrowserCustomS3Location is a nested property type of AWS::BedrockAgentCore::BrowserCustom.
`recordingConfig.s3Location.bucket`	string	yes
`recordingConfig.s3Location.prefix`	string	yes
`tags`	map<string>	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`browserArn`	string	—	The ARN of a Browser resource.
`browserId`	string	—	The id of the browser.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Timestamp when the browser was created.
`failureReason`	string	—	The reason for failure if the browser creation or operation failed.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedAt`	string	—	Timestamp when the browser was last updated.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Status of browser. Allowed: `CREATING, CREATE_FAILED, READY, DELETING, DELETE_FAILED, DELETED`

BedrockAgentCoreBrowserProfile # CLOUD CONTROL · AWS::BedrockAgentCore::BrowserProfile

BedrockAgentCoreBrowserProfile manages AWS::BedrockAgentCore::BrowserProfile through the AWS Cloud Control API.

kubectl get bedrockagentcorebrowserprofiles · example on GitHub

Example

# BedrockAgentCoreBrowserProfile — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcorebrowserprofile
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreBrowserProfile
metadata:
  name: example-bedrockagentcorebrowserprofile
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-bedrockagentcorebrowserprofile
  providerRef:
    name: example-bedrockagentcorebrowserprofile
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`description`	string	—	Create-only in AWS: changing it requires replacing the resource.
`name`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	A map of tag keys and values.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSavedAt`	string	—	Read-only: reported by AWS after creation.
`lastSavedBrowserId`	string	—	Read-only: reported by AWS after creation.
`lastSavedBrowserSessionId`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`lastUpdatedAt`	string	—	Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`profileArn`	string	—	Read-only: reported by AWS after creation.
`profileId`	string	—	Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `READY, DELETING, DELETED, SAVING`

BedrockAgentCoreCapacityProvider # CLOUD CONTROL · AWS::BedrockAgentCore::CapacityProvider

BedrockAgentCoreCapacityProvider manages AWS::BedrockAgentCore::CapacityProvider through the AWS Cloud Control API.

kubectl get bedrockagentcorecapacityproviders · example on GitHub

Example

# BedrockAgentCoreCapacityProvider — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcorecapacityprovider
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreCapacityProvider
metadata:
  name: example-bedrockagentcorecapacityprovider
  namespace: default
spec:
  computeConfiguration:
    ec2Configuration:
      launchTemplateSource:
        launchParameters:
          ephemeralVolumes:
          - deviceName: example-bedrockagentcorecapacityprovider
            virtualName: example-bedrockagentcorecapacityprovider
          instanceProfileArn: arn:aws:iam::123456789012:role/example-role
          instanceRequirements:
            allowedInstanceTypes:
            - example
          licenseSpecifications:
          - licenseConfigurationArn: arn:aws:iam::123456789012:role/example-role
          monitoring: BASIC
          operatingSystem: LINUX_X86_64
          sshKeyName: example-bedrockagentcorecapacityprovider
      lifecycleConfiguration:
        idleInstanceTimeout: 60
        maxLifetime: 60
      rootVolume:
        encrypted: true
        freeSpaceGiB: 2
        iops: 100
        kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab
        throughput: 125
        volumeType: standard
      volumes:
      - ebsConfiguration:
          encrypted: true
          iops: 100
          kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab
          name: example-bedrockagentcorecapacityprovider
          sizeGiB: 1
          throughput: 125
          volumeType: standard
      vpcConfiguration:
        securityGroups:
        - example
        subnets:
        - example
  description: Managed by konfig-konector
  name: example-bedrockagentcorecapacityprovider
  permissionsConfiguration:
    capacityProviderOperatorRoleArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-bedrockagentcorecapacityprovider
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`computeConfiguration`	object	yes	Create-only in AWS: changing it requires replacing the resource.
`computeConfiguration.ec2Configuration`	object	yes	BedrockAgentCoreCapacityProviderEc2Configuration is a nested property type of AWS::BedrockAgentCore::CapacityProvider.
`computeConfiguration.ec2Configuration.launchTemplateSource`	object	yes	BedrockAgentCoreCapacityProviderLaunchTemplateSource is a nested property type of AWS::BedrockAgentCore::CapacityProvider.
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters`	object	yes	BedrockAgentCoreCapacityProviderLaunchParameters is a nested property type of AWS::BedrockAgentCore::CapacityProvider.
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.capacityReservationSpecification`	object	—	BedrockAgentCoreCapacityProviderCapacityReservationSpecification is a nested property type of AWS::BedrockAgentCore::CapacityProvider.
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.capacityReservationSpecification.capacityReservationPreference`	enum	—	Indicates the instance's Capacity Reservation preferences. Allowed: `capacity-reservations-only, open, none`
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.capacityReservationSpecification.capacityReservationTarget`	object	—	BedrockAgentCoreCapacityProviderCapacityReservationTarget is a nested property type of AWS::BedrockAgentCore::CapacityProvider.
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.ephemeralVolumes`	array<object>	—	The block device mapping for ephemeral (instance store) volumes.
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.ephemeralVolumes[].deviceName`	string	—	The device name (for example, /dev/sdh or xvdh).
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.ephemeralVolumes[].ebs`	object	—	BedrockAgentCoreCapacityProviderEphemeralEBSVolumeConfiguration is a nested property type of AWS::BedrockAgentCore::CapacityProvider.
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.ephemeralVolumes[].virtualName`	string	—	The virtual device name (ephemeralN).
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.instanceProfileArn`	string	—	The ARN of the IAM instance profile to associate with launched instances.
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.instanceRequirements`	object	yes	BedrockAgentCoreCapacityProviderInstanceRequirements is a nested property type of AWS::BedrockAgentCore::CapacityProvider.
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.instanceRequirements.allowedInstanceTypes`	array<string>	yes	List of allowed instance types.
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.licenseSpecifications`	array<object>	—	The license configurations.
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.licenseSpecifications[].licenseConfigurationArn`	string	yes	The ARN of the license configuration.
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.monitoring`	enum	—	The monitoring level for the instance. Allowed: `BASIC, DETAILED`
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.operatingSystem`	enum	yes	The operating system and CPU architecture for the instances. Allowed: `LINUX_X86_64, LINUX_ARM64`
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.propagatedTags`	map<string>	—	Tags to apply to all EC2 resources (instances, volumes, and network interfaces) created by this capacity provider.
`computeConfiguration.ec2Configuration.launchTemplateSource.launchParameters.sshKeyName`	string	—	The name of the SSH key pair to configure on instances for SSH connectivity.
`computeConfiguration.ec2Configuration.lifecycleConfiguration`	object	—	BedrockAgentCoreCapacityProviderInstanceLifecycleConfiguration is a nested property type of AWS::BedrockAgentCore::CapacityProvider.
`computeConfiguration.ec2Configuration.lifecycleConfiguration.idleInstanceTimeout`	integer	—	The number of seconds an instance can remain idle before it is stopped.
`computeConfiguration.ec2Configuration.lifecycleConfiguration.maxLifetime`	integer	—	Maximum lifetime for the instance in seconds.
`computeConfiguration.ec2Configuration.rootVolume`	object	—	BedrockAgentCoreCapacityProviderRootVolumeConfiguration is a nested property type of AWS::BedrockAgentCore::CapacityProvider.
`computeConfiguration.ec2Configuration.rootVolume.encrypted`	boolean	—	Indicates whether the EBS volume is encrypted.
`computeConfiguration.ec2Configuration.rootVolume.freeSpaceGiB`	integer	—	The free space guaranteed on the root volume, in GiB.
`computeConfiguration.ec2Configuration.rootVolume.iops`	integer	—	The number of IOPS to provision.
`computeConfiguration.ec2Configuration.rootVolume.kmsKeyId`	string	—	Identifier of the customer managed KMS key to use for EBS encryption.
`computeConfiguration.ec2Configuration.rootVolume.throughput`	integer	—	The throughput to provision for a gp3 volume, in MiB/s.
`computeConfiguration.ec2Configuration.rootVolume.volumeType`	enum	—	The EBS volume type. Allowed: `standard, io1, io2, gp2, sc1, st1, gp3`
`computeConfiguration.ec2Configuration.volumes`	array<object>	—	Named persistent EBS volumes for this capacity provider.
`computeConfiguration.ec2Configuration.volumes[].ebsConfiguration`	object	yes	BedrockAgentCoreCapacityProviderEbsVolumeConfiguration is a nested property type of AWS::BedrockAgentCore::CapacityProvider.
`computeConfiguration.ec2Configuration.volumes[].ebsConfiguration.encrypted`	boolean	—	Whether to encrypt the volume.
`computeConfiguration.ec2Configuration.volumes[].ebsConfiguration.iops`	integer	—	The number of IOPS to provision.
`computeConfiguration.ec2Configuration.volumes[].ebsConfiguration.kmsKeyId`	string	—	Identifier of the KMS key to use for encryption.
`computeConfiguration.ec2Configuration.volumes[].ebsConfiguration.name`	string	yes	The logical name of the volume, used to reference it when mounting.
`computeConfiguration.ec2Configuration.volumes[].ebsConfiguration.sizeGiB`	integer	yes	The size of the volume in GiB.
`computeConfiguration.ec2Configuration.volumes[].ebsConfiguration.snapshotId`	string	—	Optional EBS snapshot ID to initialize the volume from.
`computeConfiguration.ec2Configuration.volumes[].ebsConfiguration.throughput`	integer	—	The throughput in MiB/s.
`computeConfiguration.ec2Configuration.volumes[].ebsConfiguration.volumeType`	enum	—	The EBS volume type. Allowed: `standard, io1, io2, gp2, sc1, st1, gp3`
`computeConfiguration.ec2Configuration.vpcConfiguration`	object	yes	BedrockAgentCoreCapacityProviderVpcConfiguration is a nested property type of AWS::BedrockAgentCore::CapacityProvider.
`computeConfiguration.ec2Configuration.vpcConfiguration.securityGroups`	array<string>	yes	The IDs of the security groups to associate with the instances.
`computeConfiguration.ec2Configuration.vpcConfiguration.subnets`	array<string>	yes	The IDs of the subnets in which to launch instances.
`description`	string	—	An optional description of the capacity provider.
`name`	string	yes	The name of the capacity provider.
`permissionsConfiguration`	object	yes	Create-only in AWS: changing it requires replacing the resource.
`permissionsConfiguration.capacityProviderOperatorRoleArn`	string	yes	The ARN of the IAM role that operators use to manage the capacity provider.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to the capacity provider.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	The ARN of the capacity provider.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`capacityProviderId`	string	—	The unique identifier of the capacity provider.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the capacity provider was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedAt`	string	—	The timestamp when the capacity provider was last updated.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The current status of the capacity provider. Allowed: `CREATING, CREATE_FAILED, UPDATING, UPDATE_FAILED, READY, DELETING`

BedrockAgentCoreCodeInterpreterCustom # CLOUD CONTROL · AWS::BedrockAgentCore::CodeInterpreterCustom

BedrockAgentCoreCodeInterpreterCustom manages AWS::BedrockAgentCore::CodeInterpreterCustom through the AWS Cloud Control API.

kubectl get bedrockagentcorecodeinterpretercustoms · example on GitHub

Example

# BedrockAgentCoreCodeInterpreterCustom — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcorecodeinterpretercustom
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreCodeInterpreterCustom
metadata:
  name: example-bedrockagentcorecodeinterpretercustom
  namespace: default
spec:
  certificates:
  - certificateLocation:
      secretArn: arn:aws:iam::123456789012:role/example-role
  description: Managed by konfig-konector
  executionRoleArn: arn:aws:iam::123456789012:role/example-role
  name: example-bedrockagentcorecodeinterpretercustom
  networkConfiguration:
    networkMode: PUBLIC
    vpcConfig:
      securityGroups:
      - example
      subnets:
      - example
  providerRef:
    name: example-bedrockagentcorecodeinterpretercustom
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`certificates`	array<object>	—	List of root CA certificates in PEM format.
`certificates[].certificateLocation`	object	yes	Certificate location in Secrets Manager.
`certificates[].certificateLocation.secretArn`	string	yes	Secrets Manager secret ARN.
`description`	string	—	The description of the code interpreter.
`executionRoleArn`	string	—	The ARN of the IAM role that the code interpreter uses to access resources.
`name`	string	yes	The name of the code interpreter.
`networkConfiguration`	object	yes	Network configuration for code interpreter.
`networkConfiguration.networkMode`	enum	yes	Allowed: `PUBLIC, SANDBOX, VPC`
`networkConfiguration.vpcConfig`	object	—	BedrockAgentCoreCodeInterpreterCustomVpcConfig is a nested property type of AWS::BedrockAgentCore::CodeInterpreterCustom.
`networkConfiguration.vpcConfig.securityGroups`	array<string>	yes
`networkConfiguration.vpcConfig.subnets`	array<string>	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`codeInterpreterArn`	string	—	The ARN of a CodeInterpreter resource.
`codeInterpreterId`	string	—	The id of the code interpreter.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Timestamp when the code interpreter was created.
`failureReason`	string	—	The reason for failure if the code interpreter creation or operation failed.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedAt`	string	—	Timestamp when the code interpreter was last updated.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Status of code interpreter. Allowed: `CREATING, CREATE_FAILED, READY, DELETING, DELETE_FAILED, DELETED`

BedrockAgentCoreConfigurationBundle # CLOUD CONTROL · AWS::BedrockAgentCore::ConfigurationBundle

BedrockAgentCoreConfigurationBundle manages AWS::BedrockAgentCore::ConfigurationBundle through the AWS Cloud Control API.

kubectl get bedrockagentcoreconfigurationbundles · example on GitHub

Example

# BedrockAgentCoreConfigurationBundle — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoreconfigurationbundle
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreConfigurationBundle
metadata:
  name: example-bedrockagentcoreconfigurationbundle
  namespace: default
spec:
  branchName: example-bedrockagentcoreconfigurationbundle
  bundleName: example-bedrockagentcoreconfigurationbundle
  commitMessage: example
  components: {}
  createdBy:
    name: example-createdby
  description: Managed by konfig-konector
  kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-bedrockagentcoreconfigurationbundle
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`branchName`	string	—	The branch name for version tracking.
`bundleName`	string	yes	The name for the configuration bundle.
`commitMessage`	string	—	A commit message describing the version of the configuration bundle.
`components`	map<string>	yes	A map of component identifiers to their configurations.
`createdBy`	object	—	BedrockAgentCoreConfigurationBundleVersionCreatedBySource is a nested property type of AWS::BedrockAgentCore::ConfigurationBundle.
`createdBy.arn`	string	—	The Amazon Resource Name (ARN) of the source, if applicable.
`createdBy.name`	string	yes	The name of the source (for example, user, optimization-job, or system).
`description`	string	—	The description for the configuration bundle.
`kmsKeyArn`	string	—	The ARN of the KMS key used to encrypt component configurations.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Tags to assign to the configuration bundle.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`bundleArn`	string	—	The Amazon Resource Name (ARN) of the configuration bundle.
`bundleId`	string	—	The unique identifier of the configuration bundle.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the configuration bundle was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lineageMetadata`	object	—	Read-only: reported by AWS after creation.
`lineageMetadata.branchName`	string	—	The branch name for this version.
`lineageMetadata.commitMessage`	string	—	A commit message describing the changes in this version.
`lineageMetadata.createdBy`	object	—	BedrockAgentCoreConfigurationBundleVersionCreatedBySource is a nested property type of AWS::BedrockAgentCore::ConfigurationBundle.
`lineageMetadata.createdBy.arn`	string	—	The Amazon Resource Name (ARN) of the source, if applicable.
`lineageMetadata.createdBy.name`	string	yes	The name of the source (for example, user, optimization-job, or system).
`lineageMetadata.parentVersionIds`	array<string>	—	A list of parent version identifiers.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`updatedAt`	string	—	The timestamp when the configuration bundle was last updated.
`versionId`	string	—	The version identifier of the configuration bundle.

BedrockAgentCoreDataset # CLOUD CONTROL · AWS::BedrockAgentCore::Dataset

BedrockAgentCoreDataset manages AWS::BedrockAgentCore::Dataset through the AWS Cloud Control API.

kubectl get bedrockagentcoredatasets · example on GitHub

Example

# BedrockAgentCoreDataset — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoredataset
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreDataset
metadata:
  name: example-bedrockagentcoredataset
  namespace: default
spec:
  datasetName: example-bedrockagentcoredataset
  description: Managed by konfig-konector
  kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-bedrockagentcoredataset
    region: us-east-1
  schemaType: AGENTCORE_EVALUATION_PREDEFINED_V1
  source:
    s3Source:
      s3Uri: example
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`datasetName`	string	yes	Human-readable name for the dataset.
`description`	string	—	A description of the dataset.
`kmsKeyArn`	string	—	Optional AWS KMS key ARN for SSE-KMS on service S3 writes.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`schemaType`	enum	yes	Versioned schema type governing the structure of examples. Allowed: `AGENTCORE_EVALUATION_PREDEFINED_V1, AGENTCORE_EVALUATION_SIMULATED_V1`
`source`	object	—	Create-only in AWS: changing it requires replacing the resource.
`source.inlineExamples`	object	—	BedrockAgentCoreDatasetInlineExamplesSource is a nested property type of AWS::BedrockAgentCore::Dataset.
`source.inlineExamples.examples`	array<object>	yes	Examples to add.
`source.s3Source`	object	—	BedrockAgentCoreDatasetS3Source is a nested property type of AWS::BedrockAgentCore::Dataset.
`source.s3Source.s3Uri`	string	yes	S3 URI of the JSONL file (e.g.
`tags`	array<object>	—	A list of tags to assign to the dataset.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the dataset was created.
`datasetArn`	string	—	The Amazon Resource Name (ARN) of the dataset.
`datasetId`	string	—	The unique identifier of the dataset.
`exampleCount`	integer	—	The number of examples in the dataset DRAFT.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The current status of the dataset. Allowed: `CREATING, UPDATING, DELETING, ACTIVE, CREATE_FAILED, UPDATE_FAILED, DELETE_FAILED`
`updatedAt`	string	—	The timestamp when the dataset was last updated.

BedrockAgentCoreEvaluator # CLOUD CONTROL · AWS::BedrockAgentCore::Evaluator

BedrockAgentCoreEvaluator manages AWS::BedrockAgentCore::Evaluator through the AWS Cloud Control API.

kubectl get bedrockagentcoreevaluators · example on GitHub

Example

# BedrockAgentCoreEvaluator — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoreevaluator
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreEvaluator
metadata:
  name: example-bedrockagentcoreevaluator
  namespace: default
spec:
  description: Managed by konfig-konector
  evaluatorConfig:
    codeBased:
      lambdaConfig:
        lambdaArn: arn:aws:iam::123456789012:role/example-role
        lambdaTimeoutInSeconds: 1
    llmAsAJudge:
      instructions: example
      ratingScale:
        categorical:
        - definition: example
          label: example
        numerical:
        - definition: example
          label: example
          value: 1
  evaluatorName: example-bedrockagentcoreevaluator
  kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  level: TOOL_CALL
  providerRef:
    name: example-bedrockagentcoreevaluator
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`description`	string	—	The description of the evaluator.
`evaluatorConfig`	object	yes	The configuration for the evaluator.
`evaluatorConfig.codeBased`	object	—	BedrockAgentCoreEvaluatorCodeBasedEvaluatorConfig is a nested property type of AWS::BedrockAgentCore::Evaluator.
`evaluatorConfig.codeBased.lambdaConfig`	object	yes	BedrockAgentCoreEvaluatorLambdaEvaluatorConfig is a nested property type of AWS::BedrockAgentCore::Evaluator.
`evaluatorConfig.codeBased.lambdaConfig.lambdaArn`	string	yes	The ARN of the Lambda function used for evaluation.
`evaluatorConfig.codeBased.lambdaConfig.lambdaTimeoutInSeconds`	integer	—	The timeout in seconds for the Lambda function invocation.
`evaluatorConfig.llmAsAJudge`	object	—	BedrockAgentCoreEvaluatorLlmAsAJudgeEvaluatorConfig is a nested property type of AWS::BedrockAgentCore::Evaluator.
`evaluatorConfig.llmAsAJudge.instructions`	string	yes	The evaluation instructions that guide the language model in assessing agent performance.
`evaluatorConfig.llmAsAJudge.modelConfig`	object	yes	BedrockAgentCoreEvaluatorEvaluatorModelConfig is a nested property type of AWS::BedrockAgentCore::Evaluator.
`evaluatorConfig.llmAsAJudge.modelConfig.bedrockEvaluatorModelConfig`	object	—	BedrockAgentCoreEvaluatorBedrockEvaluatorModelConfig is a nested property type of AWS::BedrockAgentCore::Evaluator.
`evaluatorConfig.llmAsAJudge.modelConfig.bedrockEvaluatorModelConfig.additionalModelRequestFields`	object	—	Additional model-specific request fields.
`evaluatorConfig.llmAsAJudge.modelConfig.bedrockEvaluatorModelConfig.inferenceConfig`	object	—	BedrockAgentCoreEvaluatorInferenceConfiguration is a nested property type of AWS::BedrockAgentCore::Evaluator.
`evaluatorConfig.llmAsAJudge.modelConfig.bedrockEvaluatorModelConfig.inferenceConfig.maxTokens`	integer	—	The maximum number of tokens to generate in the model response.
`evaluatorConfig.llmAsAJudge.modelConfig.bedrockEvaluatorModelConfig.inferenceConfig.temperature`	number	—	The temperature value that controls randomness in the model's responses.
`evaluatorConfig.llmAsAJudge.modelConfig.bedrockEvaluatorModelConfig.inferenceConfig.topP`	number	—	The top-p sampling parameter that controls the diversity of the model's responses.
`evaluatorConfig.llmAsAJudge.modelConfig.bedrockEvaluatorModelConfig.modelId`	string	yes	The identifier of the Amazon Bedrock model to use for evaluation.
`evaluatorConfig.llmAsAJudge.modelConfig.responsesEvaluatorModelConfig`	object	—	BedrockAgentCoreEvaluatorOpenResponsesEvaluatorModelConfig is a nested property type of AWS::BedrockAgentCore::Evaluator.
`evaluatorConfig.llmAsAJudge.modelConfig.responsesEvaluatorModelConfig.maxOutputTokens`	integer	—	The maximum number of output tokens to generate, including visible output and reasoning tokens.
`evaluatorConfig.llmAsAJudge.modelConfig.responsesEvaluatorModelConfig.modelId`	string	yes	The identifier of the model to use for evaluation.
`evaluatorConfig.llmAsAJudge.modelConfig.responsesEvaluatorModelConfig.reasoning`	object	—	BedrockAgentCoreEvaluatorReasoningConfiguration is a nested property type of AWS::BedrockAgentCore::Evaluator.
`evaluatorConfig.llmAsAJudge.modelConfig.responsesEvaluatorModelConfig.reasoning.effort`	string	—	The level of reasoning effort the model applies.
`evaluatorConfig.llmAsAJudge.modelConfig.responsesEvaluatorModelConfig.temperature`	number	—	The sampling temperature between 0 and 2.
`evaluatorConfig.llmAsAJudge.modelConfig.responsesEvaluatorModelConfig.topP`	number	—	The nucleus sampling probability mass between 0 and 1.
`evaluatorConfig.llmAsAJudge.ratingScale`	object	yes	BedrockAgentCoreEvaluatorRatingScale is a nested property type of AWS::BedrockAgentCore::Evaluator.
`evaluatorConfig.llmAsAJudge.ratingScale.categorical`	array<object>	—
`evaluatorConfig.llmAsAJudge.ratingScale.categorical[].definition`	string	yes	The description that explains what this categorical rating represents.
`evaluatorConfig.llmAsAJudge.ratingScale.categorical[].label`	string	yes	The label of this categorical rating option.
`evaluatorConfig.llmAsAJudge.ratingScale.numerical`	array<object>	—
`evaluatorConfig.llmAsAJudge.ratingScale.numerical[].definition`	string	yes	The description that explains what this numerical rating represents.
`evaluatorConfig.llmAsAJudge.ratingScale.numerical[].label`	string	yes	The label that describes this numerical rating option.
`evaluatorConfig.llmAsAJudge.ratingScale.numerical[].value`	number	yes	The numerical value for this rating scale option.
`evaluatorName`	string	yes	The name of the evaluator.
`kmsKeyArn`	string	—	The ARN of the KMS key used to encrypt evaluator data.
`level`	enum	yes	The evaluation level that determines the scope of evaluation. Allowed: `TOOL_CALL, TRACE, SESSION`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A list of tags to assign to the evaluator.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the evaluator was created.
`evaluatorArn`	string	—	The Amazon Resource Name (ARN) of the evaluator.
`evaluatorId`	string	—	The unique identifier of the evaluator.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The current status of the evaluator. Allowed: `ACTIVE, CREATING, CREATE_FAILED, UPDATING, UPDATE_FAILED, DELETING`
`updatedAt`	string	—	The timestamp when the evaluator was last updated.

BedrockAgentCoreGateway # CLOUD CONTROL · AWS::BedrockAgentCore::Gateway

BedrockAgentCoreGateway manages AWS::BedrockAgentCore::Gateway through the AWS Cloud Control API.

kubectl get bedrockagentcoregateways · example on GitHub

Example

# BedrockAgentCoreGateway — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoregateway
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreGateway
metadata:
  name: example-bedrockagentcoregateway
  namespace: default
spec:
  authorizerType: CUSTOM_JWT
  description: Managed by konfig-konector
  exceptionLevel: DEBUG
  interceptorConfigurations:
  - inputConfiguration:
      passRequestHeaders: false
    interceptionPoints:
    - example
  kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  name: example-bedrockagentcoregateway
  policyEngineConfiguration:
    arn: arn:aws:iam::123456789012:role/example-role
    mode: LOG_ONLY
  providerRef:
    name: example-bedrockagentcoregateway
    region: us-east-1
  roleArn: arn:aws:iam::123456789012:role/example-role
  tags:
    environment: dev
    team: platform
  wafConfiguration:
    failureMode: FAIL_CLOSE

Spec

Field	Type	Required	Description
`authorizerConfiguration`	object	—
`authorizerType`	enum	yes	Allowed: `CUSTOM_JWT, AWS_IAM, NONE, AUTHENTICATE_ONLY`
`description`	string	—
`exceptionLevel`	enum	—	Allowed: `DEBUG`
`interceptorConfigurations`	array<object>	—
`interceptorConfigurations[].inputConfiguration`	object	—	BedrockAgentCoreGatewayInterceptorInputConfiguration is a nested property type of AWS::BedrockAgentCore::Gateway.
`interceptorConfigurations[].inputConfiguration.passRequestHeaders`	boolean	yes
`interceptorConfigurations[].inputConfiguration.payloadFilter`	object	—	BedrockAgentCoreGatewayInterceptorPayloadFilter is a nested property type of AWS::BedrockAgentCore::Gateway.
`interceptorConfigurations[].inputConfiguration.payloadFilter.exclude`	array<object>	yes
`interceptorConfigurations[].interceptionPoints`	array<string>	yes
`interceptorConfigurations[].interceptor`	object	yes
`kmsKeyArn`	string	—
`name`	string	yes
`policyEngineConfiguration`	object	—	BedrockAgentCoreGatewayGatewayPolicyEngineConfiguration is a nested property type of AWS::BedrockAgentCore::Gateway.
`policyEngineConfiguration.arn`	string	yes
`policyEngineConfiguration.mode`	enum	yes	Allowed: `LOG_ONLY, ENFORCE`
`protocolConfiguration`	object	—
`protocolType`	object	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`roleArn`	string	yes
`tags`	map<string>	—
`wafConfiguration`	object	—	BedrockAgentCoreGatewayWafConfiguration is a nested property type of AWS::BedrockAgentCore::Gateway.
`wafConfiguration.failureMode`	enum	—	Allowed: `FAIL_CLOSE, FAIL_OPEN`

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Read-only: reported by AWS after creation.
`gatewayArn`	string	—	Read-only: reported by AWS after creation.
`gatewayIdentifier`	string	—	Read-only: reported by AWS after creation.
`gatewayUrl`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `CREATING, UPDATING, UPDATE_UNSUCCESSFUL, DELETING, READY, FAILED`
`statusReasons`	array<string>	—	Read-only: reported by AWS after creation.
`updatedAt`	string	—	Read-only: reported by AWS after creation.
`webAclArn`	string	—	Read-only: reported by AWS after creation.
`workloadIdentityDetails`	object	—	Read-only: reported by AWS after creation.
`workloadIdentityDetails.workloadIdentityArn`	string	yes

BedrockAgentCoreGatewayRateLimit # CLOUD CONTROL · AWS::BedrockAgentCore::GatewayRateLimit

BedrockAgentCoreGatewayRateLimit manages AWS::BedrockAgentCore::GatewayRateLimit through the AWS Cloud Control API.

kubectl get bedrockagentcoregatewayratelimits · example on GitHub

Example

# BedrockAgentCoreGatewayRateLimit — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoregatewayratelimit
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreGatewayRateLimit
metadata:
  name: example-bedrockagentcoregatewayratelimit
  namespace: default
spec:
  description: Managed by konfig-konector
  dimensionKeys:
  - example
  entries:
  - connections:
    - period: second
      rate: 1
    dimensions:
      key: value
    requests:
    - period: second
      rate: 1
    tokens:
    - period: second
      rate: 1
  gatewayIdentifier: example
  providerRef:
    name: example-bedrockagentcoregatewayratelimit
    region: us-east-1

Spec

Field	Type	Required	Description
`description`	string	—	Optional human-readable description for this limit.
`dimensionKeys`	array<string>	yes	Ordered list of dimension names defining the scope of this limit.
`entries`	array<object>	yes	Rule entries mapping dimension values to rate configurations.
`entries[].connections`	array<object>	—	Connection rate limits (per second only).
`entries[].connections[].period`	enum	yes	Allowed: `second, minute`
`entries[].connections[].rate`	number	yes
`entries[].dimensions`	map<string>	yes
`entries[].requests`	array<object>	—	Request rate limits (RPS or RPM).
`entries[].requests[].period`	enum	yes	Allowed: `second, minute`
`entries[].requests[].rate`	number	yes
`entries[].tokens`	array<object>	—	Token rate limits (TPM).
`entries[].tokens[].period`	enum	yes	Allowed: `second, minute`
`entries[].tokens[].rate`	number	yes
`gatewayIdentifier`	string	—	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`rateLimitId`	string	—	Limit identifier.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `CREATING, ACTIVE, UPDATING, DELETING`
`updatedAt`	string	—	Read-only: reported by AWS after creation.

BedrockAgentCoreGatewayRule # CLOUD CONTROL · AWS::BedrockAgentCore::GatewayRule

BedrockAgentCoreGatewayRule manages AWS::BedrockAgentCore::GatewayRule through the AWS Cloud Control API.

kubectl get bedrockagentcoregatewayrules · example on GitHub

Example

# BedrockAgentCoreGatewayRule — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoregatewayrule
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreGatewayRule
metadata:
  name: example-bedrockagentcoregatewayrule
  namespace: default
spec:
  description: Managed by konfig-konector
  gatewayIdentifier: example
  priority: 1
  providerRef:
    name: example-bedrockagentcoregatewayrule
    region: us-east-1

Spec

Field	Type	Required	Description
`actions`	array<object>	yes
`conditions`	array<object>	—
`description`	string	—
`gatewayIdentifier`	string	—	Create-only in AWS: changing it requires replacing the resource.
`priority`	number	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Read-only: reported by AWS after creation.
`gatewayArn`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`ruleId`	string	—	Read-only: reported by AWS after creation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `CREATING, ACTIVE, UPDATING, DELETING`
`system`	object	—	Read-only: reported by AWS after creation.
`system.managedBy`	string	yes
`updatedAt`	string	—	Read-only: reported by AWS after creation.

BedrockAgentCoreGatewayTarget # CLOUD CONTROL · AWS::BedrockAgentCore::GatewayTarget

BedrockAgentCoreGatewayTarget manages AWS::BedrockAgentCore::GatewayTarget through the AWS Cloud Control API.

kubectl get bedrockagentcoregatewaytargets · example on GitHub

Example

# BedrockAgentCoreGatewayTarget — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoregatewaytarget
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreGatewayTarget
metadata:
  name: example-bedrockagentcoregatewaytarget
  namespace: default
spec:
  credentialProviderConfigurations:
  - credentialProviderType: GATEWAY_IAM_ROLE
  description: Managed by konfig-konector
  gatewayIdentifier: example
  metadataConfiguration:
    allowedQueryParameters:
    - example
    allowedRequestHeaders:
    - example
    allowedResponseHeaders:
    - example
  name: example-bedrockagentcoregatewaytarget
  providerRef:
    name: example-bedrockagentcoregatewaytarget
    region: us-east-1

Spec

Field	Type	Required	Description
`credentialProviderConfigurations`	array<object>	—
`credentialProviderConfigurations[].credentialProvider`	object	—
`credentialProviderConfigurations[].credentialProviderType`	enum	yes	Allowed: `GATEWAY_IAM_ROLE, OAUTH, API_KEY, CALLER_IAM_CREDENTIALS, JWT_PASSTHROUGH`
`description`	string	—
`gatewayIdentifier`	string	—	Create-only in AWS: changing it requires replacing the resource.
`metadataConfiguration`	object	—	BedrockAgentCoreGatewayTargetMetadataConfiguration is a nested property type of AWS::BedrockAgentCore::GatewayTarget.
`metadataConfiguration.allowedQueryParameters`	array<string>	—
`metadataConfiguration.allowedRequestHeaders`	array<string>	—
`metadataConfiguration.allowedResponseHeaders`	array<string>	—
`name`	string	—
`privateEndpoint`	object	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`targetConfiguration`	object	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`authorizationData`	object	—	Read-only: reported by AWS after creation.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Read-only: reported by AWS after creation.
`gatewayArn`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastSynchronizedAt`	string	—	Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`privateEndpointManagedResources`	array<object>	—	Read-only: reported by AWS after creation.
`privateEndpointManagedResources[].domain`	string	—
`privateEndpointManagedResources[].resourceAssociationArn`	string	—
`privateEndpointManagedResources[].resourceGatewayArn`	string	—
`protocolType`	enum	—	Read-only: reported by AWS after creation. Allowed: `MCP, HTTP`
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `CREATING, UPDATING, UPDATE_UNSUCCESSFUL, DELETING, READY, FAILED, SYNCHRONIZING, SYNCHRONIZE_UNSUCCESSFUL…`
`statusReasons`	array<string>	—	Read-only: reported by AWS after creation.
`targetId`	string	—	Read-only: reported by AWS after creation.
`updatedAt`	string	—	Read-only: reported by AWS after creation.

BedrockAgentCoreHarness # CLOUD CONTROL · AWS::BedrockAgentCore::Harness

BedrockAgentCoreHarness manages AWS::BedrockAgentCore::Harness through the AWS Cloud Control API.

kubectl get bedrockagentcoreharnesses · example on GitHub

Example

# BedrockAgentCoreHarness — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoreharness
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreHarness
metadata:
  name: example-bedrockagentcoreharness
  namespace: default
spec:
  allowedTools:
  - example
  authorizerConfiguration:
    customJWTAuthorizer:
      allowedAudience:
      - example
      allowedClients:
      - example
      allowedScopes:
      - example
      customClaims:
      - authorizingClaimMatchValue:
          claimMatchOperator: EQUALS
          claimMatchValue:
            matchValueString: example
            matchValueStringList:
            - example
        inboundTokenClaimName: example-bedrockagentcoreharness
        inboundTokenClaimValueType: STRING
      discoveryUrl: example
      privateEndpointOverrides:
      - domain: example
  environment:
    agentCoreRuntimeEnvironment:
      agentRuntimeArn: arn:aws:iam::123456789012:role/example-role
      agentRuntimeName: example-bedrockagentcoreharness
      lifecycleConfiguration:
        idleRuntimeSessionTimeout: 60
        maxLifetime: 60
      networkConfiguration:
        networkMode: PUBLIC
  environmentArtifact:
    containerConfiguration:
      containerUri: example
  environmentVariables:
    key: value
  executionRoleArn: arn:aws:iam::123456789012:role/example-role
  harnessName: example-bedrockagentcoreharness
  maxIterations: 1
  maxTokens: 1
  memory:
    agentCoreMemoryConfiguration:
      arn: arn:aws:iam::123456789012:role/example-role
      messagesCount: 2
      retrievalConfig: {}
    managedMemoryConfiguration:
      arn: arn:aws:iam::123456789012:role/example-role
      encryptionKeyArn: arn:aws:iam::123456789012:role/example-role
      eventExpiryDuration: 3
      strategies:
      - example
  model:
    bedrockModelConfig:
      additionalParams: {}
      apiFormat: converse_stream
      maxTokens: 1
      modelId: example-id
      temperature: 1
      topP: 1
    geminiModelConfig:
      apiKeyArn: arn:aws:iam::123456789012:role/example-role
      maxTokens: 1
      modelId: example-id
      temperature: 1
      topK: 1
      topP: 1
    liteLlmModelConfig:
      additionalParams: {}
      apiBase: example
      apiKeyArn: arn:aws:iam::123456789012:role/example-role
      maxTokens: 1
      modelId: example-id
      temperature: 1
      topP: 1
    openAiModelConfig:
      additionalParams: {}
      apiFormat: chat_completions
      apiKeyArn: arn:aws:iam::123456789012:role/example-role
      maxTokens: 1
      modelId: example-id
      temperature: 1
      topP: 1
  providerRef:
    name: example-bedrockagentcoreharness
    region: us-east-1
  skills:
  - awsSkills:
      paths:
      - example
    git:
      path: example
      url: example-
    path: example
    s3:
      uri: example
  systemPrompt:
  - text: example
  tags:
  - key: example
    value: example
  timeoutSeconds: 300
  tools:
  - name: example-bedrockagentcoreharness
    type: remote_mcp
  truncation:
    config:
      slidingWindow:
        messagesCount: 2
      summarization:
        preserveRecentMessages: 1
        summarizationSystemPrompt: example
        summaryRatio: 1
    strategy: sliding_window

Spec

Field	Type	Required	Description
`allowedTools`	array<string>	—	The tools that the agent is allowed to use.
`authorizerConfiguration`	object	—	The inbound authorization configuration for authenticating incoming requests.
`authorizerConfiguration.customJWTAuthorizer`	object	—	BedrockAgentCoreHarnessCustomJWTAuthorizerConfiguration is a nested property type of AWS::BedrockAgentCore::Harness.
`authorizerConfiguration.customJWTAuthorizer.allowedAudience`	array<string>	—
`authorizerConfiguration.customJWTAuthorizer.allowedClients`	array<string>	—
`authorizerConfiguration.customJWTAuthorizer.allowedScopes`	array<string>	—
`authorizerConfiguration.customJWTAuthorizer.customClaims`	array<object>	—
`authorizerConfiguration.customJWTAuthorizer.customClaims[].authorizingClaimMatchValue`	object	yes	BedrockAgentCoreHarnessAuthorizingClaimMatchValueType is a nested property type of AWS::BedrockAgentCore::Harness.
`authorizerConfiguration.customJWTAuthorizer.customClaims[].authorizingClaimMatchValue.claimMatchOperator`	enum	yes	Allowed: `EQUALS, CONTAINS, CONTAINS_ANY`
`authorizerConfiguration.customJWTAuthorizer.customClaims[].authorizingClaimMatchValue.claimMatchValue`	object	yes	BedrockAgentCoreHarnessClaimMatchValueType is a nested property type of AWS::BedrockAgentCore::Harness.
`authorizerConfiguration.customJWTAuthorizer.customClaims[].authorizingClaimMatchValue.claimMatchValue.matchValueString`	string	—
`authorizerConfiguration.customJWTAuthorizer.customClaims[].authorizingClaimMatchValue.claimMatchValue.matchValueStringList`	array<string>	—
`authorizerConfiguration.customJWTAuthorizer.customClaims[].inboundTokenClaimName`	string	yes
`authorizerConfiguration.customJWTAuthorizer.customClaims[].inboundTokenClaimValueType`	enum	yes	Allowed: `STRING, STRING_ARRAY`
`authorizerConfiguration.customJWTAuthorizer.discoveryUrl`	string	yes
`authorizerConfiguration.customJWTAuthorizer.privateEndpoint`	object	—	BedrockAgentCoreHarnessPrivateEndpoint is a nested property type of AWS::BedrockAgentCore::Harness.
`authorizerConfiguration.customJWTAuthorizer.privateEndpoint.managedVpcResource`	object	—	BedrockAgentCoreHarnessManagedVpcResource is a nested property type of AWS::BedrockAgentCore::Harness.
`authorizerConfiguration.customJWTAuthorizer.privateEndpoint.managedVpcResource.endpointIpAddressType`	enum	yes	Allowed: `IPV4, IPV6`
`authorizerConfiguration.customJWTAuthorizer.privateEndpoint.managedVpcResource.routingDomain`	string	—
`authorizerConfiguration.customJWTAuthorizer.privateEndpoint.managedVpcResource.securityGroupIds`	array<string>	—
`authorizerConfiguration.customJWTAuthorizer.privateEndpoint.managedVpcResource.subnetIds`	array<string>	yes
`authorizerConfiguration.customJWTAuthorizer.privateEndpoint.managedVpcResource.tags`	map<string>	—
`authorizerConfiguration.customJWTAuthorizer.privateEndpoint.managedVpcResource.vpcIdentifier`	string	yes
`authorizerConfiguration.customJWTAuthorizer.privateEndpoint.selfManagedLatticeResource`	object	—	BedrockAgentCoreHarnessSelfManagedLatticeResource is a nested property type of AWS::BedrockAgentCore::Harness.
`authorizerConfiguration.customJWTAuthorizer.privateEndpoint.selfManagedLatticeResource.resourceConfigurationIdentifier`	string	yes
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides`	array<object>	—
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides[].domain`	string	yes
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides[].privateEndpoint`	object	yes	BedrockAgentCoreHarnessPrivateEndpoint is a nested property type of AWS::BedrockAgentCore::Harness.
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides[].privateEndpoint.managedVpcResource`	object	—	BedrockAgentCoreHarnessManagedVpcResource is a nested property type of AWS::BedrockAgentCore::Harness.
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides[].privateEndpoint.managedVpcResource.endpointIpAddressType`	enum	yes	Allowed: `IPV4, IPV6`
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides[].privateEndpoint.managedVpcResource.routingDomain`	string	—
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides[].privateEndpoint.managedVpcResource.securityGroupIds`	array<string>	—
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides[].privateEndpoint.managedVpcResource.subnetIds`	array<string>	yes
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides[].privateEndpoint.managedVpcResource.tags`	map<string>	—
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides[].privateEndpoint.managedVpcResource.vpcIdentifier`	string	yes
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides[].privateEndpoint.selfManagedLatticeResource`	object	—	BedrockAgentCoreHarnessSelfManagedLatticeResource is a nested property type of AWS::BedrockAgentCore::Harness.
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides[].privateEndpoint.selfManagedLatticeResource.resourceConfigurationIdentifier`	string	yes
`environment`	object	—	The compute environment configuration for the harness, including underlying runtime information.
`environment.agentCoreRuntimeEnvironment`	object	—	BedrockAgentCoreHarnessHarnessAgentCoreRuntimeEnvironment is a nested property type of AWS::BedrockAgentCore::Harness.
`environment.agentCoreRuntimeEnvironment.agentRuntimeArn`	string	—	The ARN of the underlying AgentCore Runtime.
`environment.agentCoreRuntimeEnvironment.agentRuntimeId`	string	—	The ID of the underlying AgentCore Runtime.
`environment.agentCoreRuntimeEnvironment.agentRuntimeName`	string	—	The name of the underlying AgentCore Runtime.
`environment.agentCoreRuntimeEnvironment.filesystemConfigurations`	array<object>	—
`environment.agentCoreRuntimeEnvironment.filesystemConfigurations[].efsAccessPoint`	object	—	BedrockAgentCoreHarnessEfsAccessPointConfiguration is a nested property type of AWS::BedrockAgentCore::Harness.
`environment.agentCoreRuntimeEnvironment.filesystemConfigurations[].efsAccessPoint.accessPointArn`	string	yes
`environment.agentCoreRuntimeEnvironment.filesystemConfigurations[].efsAccessPoint.mountPath`	string	yes
`environment.agentCoreRuntimeEnvironment.filesystemConfigurations[].s3FilesAccessPoint`	object	—	BedrockAgentCoreHarnessS3FilesAccessPointConfiguration is a nested property type of AWS::BedrockAgentCore::Harness.
`environment.agentCoreRuntimeEnvironment.filesystemConfigurations[].s3FilesAccessPoint.accessPointArn`	string	yes
`environment.agentCoreRuntimeEnvironment.filesystemConfigurations[].s3FilesAccessPoint.mountPath`	string	yes
`environment.agentCoreRuntimeEnvironment.filesystemConfigurations[].sessionStorage`	object	—	BedrockAgentCoreHarnessSessionStorageConfiguration is a nested property type of AWS::BedrockAgentCore::Harness.
`environment.agentCoreRuntimeEnvironment.filesystemConfigurations[].sessionStorage.mountPath`	string	yes
`environment.agentCoreRuntimeEnvironment.lifecycleConfiguration`	object	—	BedrockAgentCoreHarnessLifecycleConfiguration is a nested property type of AWS::BedrockAgentCore::Harness.
`environment.agentCoreRuntimeEnvironment.lifecycleConfiguration.idleRuntimeSessionTimeout`	integer	—
`environment.agentCoreRuntimeEnvironment.lifecycleConfiguration.maxLifetime`	integer	—
`environment.agentCoreRuntimeEnvironment.networkConfiguration`	object	—	BedrockAgentCoreHarnessNetworkConfiguration is a nested property type of AWS::BedrockAgentCore::Harness.
`environment.agentCoreRuntimeEnvironment.networkConfiguration.networkMode`	enum	yes	Allowed: `PUBLIC, VPC`
`environment.agentCoreRuntimeEnvironment.networkConfiguration.networkModeConfig`	object	—	BedrockAgentCoreHarnessVpcConfig is a nested property type of AWS::BedrockAgentCore::Harness.
`environment.agentCoreRuntimeEnvironment.networkConfiguration.networkModeConfig.securityGroups`	array<string>	yes
`environment.agentCoreRuntimeEnvironment.networkConfiguration.networkModeConfig.subnets`	array<string>	yes
`environmentArtifact`	object	—	The environment artifact for the harness, such as a custom container image.
`environmentArtifact.containerConfiguration`	object	—	BedrockAgentCoreHarnessContainerConfiguration is a nested property type of AWS::BedrockAgentCore::Harness.
`environmentArtifact.containerConfiguration.containerUri`	string	yes	The ECR URI of the container.
`environmentVariables`	map<string>	—	Environment variables to set in the harness runtime environment.
`executionRoleArn`	string	yes	The ARN of the IAM role that the harness assumes when running.
`harnessName`	string	yes	The name of the harness.
`maxIterations`	integer	—	The maximum number of iterations the agent loop can execute per invocation.
`maxTokens`	integer	—	The maximum number of tokens the agent can generate per iteration.
`memory`	object	—	The AgentCore Memory configuration for persisting conversation context.
`memory.agentCoreMemoryConfiguration`	object	—	BedrockAgentCoreHarnessHarnessAgentCoreMemoryConfiguration is a nested property type of AWS::BedrockAgentCore::Harness.
`memory.agentCoreMemoryConfiguration.actorId`	string	—
`memory.agentCoreMemoryConfiguration.arn`	string	yes
`memory.agentCoreMemoryConfiguration.messagesCount`	integer	—
`memory.agentCoreMemoryConfiguration.retrievalConfig`	map<string>	—
`memory.disabled`	object	—
`memory.managedMemoryConfiguration`	object	—	BedrockAgentCoreHarnessHarnessManagedMemoryConfiguration is a nested property type of AWS::BedrockAgentCore::Harness.
`memory.managedMemoryConfiguration.arn`	string	—	The ARN of the managed memory resource.
`memory.managedMemoryConfiguration.encryptionKeyArn`	string	—	Customer-managed KMS key ARN.
`memory.managedMemoryConfiguration.eventExpiryDuration`	integer	—	Event retention in days.
`memory.managedMemoryConfiguration.strategies`	array<string>	—	Strategy types to enable.
`model`	object	yes	The model configuration for the harness.
`model.bedrockModelConfig`	object	—	BedrockAgentCoreHarnessHarnessBedrockModelConfig is a nested property type of AWS::BedrockAgentCore::Harness.
`model.bedrockModelConfig.additionalParams`	map<string>	—	Provider-specific parameters passed through to the model provider unchanged.
`model.bedrockModelConfig.apiFormat`	enum	—	Allowed: `converse_stream, responses, chat_completions`
`model.bedrockModelConfig.maxTokens`	integer	—
`model.bedrockModelConfig.modelId`	string	yes
`model.bedrockModelConfig.temperature`	number	—
`model.bedrockModelConfig.topP`	number	—
`model.geminiModelConfig`	object	—	BedrockAgentCoreHarnessHarnessGeminiModelConfig is a nested property type of AWS::BedrockAgentCore::Harness.
`model.geminiModelConfig.apiKeyArn`	string	yes
`model.geminiModelConfig.maxTokens`	integer	—
`model.geminiModelConfig.modelId`	string	yes
`model.geminiModelConfig.temperature`	number	—
`model.geminiModelConfig.topK`	integer	—
`model.geminiModelConfig.topP`	number	—
`model.liteLlmModelConfig`	object	—	BedrockAgentCoreHarnessHarnessLiteLlmModelConfig is a nested property type of AWS::BedrockAgentCore::Harness.
`model.liteLlmModelConfig.additionalParams`	map<string>	—	Provider-specific parameters passed through to LiteLLM unchanged.
`model.liteLlmModelConfig.apiBase`	string	—
`model.liteLlmModelConfig.apiKeyArn`	string	—
`model.liteLlmModelConfig.maxTokens`	integer	—
`model.liteLlmModelConfig.modelId`	string	yes
`model.liteLlmModelConfig.temperature`	number	—
`model.liteLlmModelConfig.topP`	number	—
`model.openAiModelConfig`	object	—	BedrockAgentCoreHarnessHarnessOpenAiModelConfig is a nested property type of AWS::BedrockAgentCore::Harness.
`model.openAiModelConfig.additionalParams`	map<string>	—	Provider-specific parameters passed through to the model provider unchanged.
`model.openAiModelConfig.apiFormat`	enum	—	Allowed: `chat_completions, responses`
`model.openAiModelConfig.apiKeyArn`	string	yes
`model.openAiModelConfig.maxTokens`	integer	—
`model.openAiModelConfig.modelId`	string	yes
`model.openAiModelConfig.temperature`	number	—
`model.openAiModelConfig.topP`	number	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`skills`	array<object>	—	The skills available to the agent.
`skills[].awsSkills`	object	—	BedrockAgentCoreHarnessHarnessSkillAwsSkillsSource is a nested property type of AWS::BedrockAgentCore::Harness.
`skills[].awsSkills.paths`	array<string>	—	Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
`skills[].git`	object	—	BedrockAgentCoreHarnessHarnessSkillGitSource is a nested property type of AWS::BedrockAgentCore::Harness.
`skills[].git.auth`	object	—	BedrockAgentCoreHarnessHarnessSkillGitAuth is a nested property type of AWS::BedrockAgentCore::Harness.
`skills[].git.auth.credentialArn`	string	yes	The ARN of the credential in AgentCore Identity containing the password or personal access token.
`skills[].git.auth.username`	string	—	Username for authentication.
`skills[].git.path`	string	—	Subdirectory within the repository containing the skill.
`skills[].git.url`	string	yes	The HTTPS URL of the git repository.
`skills[].path`	string	—	The filesystem path to the skill definition.
`skills[].s3`	object	—	BedrockAgentCoreHarnessHarnessSkillS3Source is a nested property type of AWS::BedrockAgentCore::Harness.
`skills[].s3.uri`	string	yes	The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
`systemPrompt`	array<object>	—	The system prompt that defines the agent's behavior.
`systemPrompt[].text`	string	yes	The text content of the system prompt block.
`tags`	array<object>	—	Tags to apply to the harness resource.
`tags[].key`	string	yes
`tags[].value`	string	yes
`timeoutSeconds`	integer	—	The maximum duration in seconds for the agent loop execution per invocation.
`tools`	array<object>	—	The tools available to the agent.
`tools[].config`	object	—	BedrockAgentCoreHarnessHarnessToolConfiguration is a nested property type of AWS::BedrockAgentCore::Harness.
`tools[].config.agentCoreBrowser`	object	—	BedrockAgentCoreHarnessHarnessAgentCoreBrowserConfig is a nested property type of AWS::BedrockAgentCore::Harness.
`tools[].config.agentCoreBrowser.browserArn`	string	—
`tools[].config.agentCoreCodeInterpreter`	object	—	BedrockAgentCoreHarnessHarnessAgentCoreCodeInterpreterConfig is a nested property type of AWS::BedrockAgentCore::Harness.
`tools[].config.agentCoreCodeInterpreter.codeInterpreterArn`	string	—
`tools[].config.agentCoreGateway`	object	—	BedrockAgentCoreHarnessHarnessAgentCoreGatewayConfig is a nested property type of AWS::BedrockAgentCore::Harness.
`tools[].config.agentCoreGateway.gatewayArn`	string	yes
`tools[].config.agentCoreGateway.outboundAuth`	object	—	BedrockAgentCoreHarnessHarnessGatewayOutboundAuth is a nested property type of AWS::BedrockAgentCore::Harness.
`tools[].config.agentCoreGateway.outboundAuth.awsIam`	object	—
`tools[].config.agentCoreGateway.outboundAuth.none`	object	—
`tools[].config.agentCoreGateway.outboundAuth.oauth`	object	—	BedrockAgentCoreHarnessOAuthCredentialProvider is a nested property type of AWS::BedrockAgentCore::Harness.
`tools[].config.agentCoreGateway.outboundAuth.oauth.customParameters`	map<string>	—
`tools[].config.agentCoreGateway.outboundAuth.oauth.defaultReturnUrl`	string	—
`tools[].config.agentCoreGateway.outboundAuth.oauth.grantType`	enum	—	Allowed: `CLIENT_CREDENTIALS, AUTHORIZATION_CODE`
`tools[].config.agentCoreGateway.outboundAuth.oauth.providerArn`	string	yes
`tools[].config.agentCoreGateway.outboundAuth.oauth.scopes`	array<string>	yes
`tools[].config.inlineFunction`	object	—	BedrockAgentCoreHarnessHarnessInlineFunctionConfig is a nested property type of AWS::BedrockAgentCore::Harness.
`tools[].config.inlineFunction.description`	string	yes
`tools[].config.inlineFunction.inputSchema`	object	yes	JSON Schema describing the tool's input parameters.
`tools[].config.remoteMcp`	object	—	BedrockAgentCoreHarnessHarnessRemoteMcpConfig is a nested property type of AWS::BedrockAgentCore::Harness.
`tools[].config.remoteMcp.headers`	map<string>	—
`tools[].config.remoteMcp.url`	string	yes
`tools[].name`	string	—
`tools[].type`	enum	yes	Allowed: `remote_mcp, agentcore_browser, agentcore_gateway, inline_function, agentcore_code_interpreter`
`truncation`	object	—	The truncation configuration for managing conversation context.
`truncation.config`	object	—	BedrockAgentCoreHarnessHarnessTruncationStrategyConfiguration is a nested property type of AWS::BedrockAgentCore::Harness.
`truncation.config.slidingWindow`	object	—	BedrockAgentCoreHarnessHarnessSlidingWindowConfiguration is a nested property type of AWS::BedrockAgentCore::Harness.
`truncation.config.slidingWindow.messagesCount`	integer	—
`truncation.config.summarization`	object	—	BedrockAgentCoreHarnessHarnessSummarizationConfiguration is a nested property type of AWS::BedrockAgentCore::Harness.
`truncation.config.summarization.preserveRecentMessages`	integer	—
`truncation.config.summarization.summarizationSystemPrompt`	string	—
`truncation.config.summarization.summaryRatio`	number	—
`truncation.strategy`	enum	yes	Allowed: `sliding_window, summarization, none`

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the harness.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the harness was created.
`harnessId`	string	—	The unique identifier of the harness.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The current status of the harness. Allowed: `CREATING, CREATE_FAILED, UPDATING, UPDATE_FAILED, READY, DELETING, DELETE_FAILED`
`updatedAt`	string	—	The timestamp when the harness was last updated.
`version`	string	—	The version of the harness.

BedrockAgentCoreHarnessEndpoint # CLOUD CONTROL · AWS::BedrockAgentCore::HarnessEndpoint

BedrockAgentCoreHarnessEndpoint manages AWS::BedrockAgentCore::HarnessEndpoint through the AWS Cloud Control API.

kubectl get bedrockagentcoreharnessendpoints · example on GitHub

Example

# BedrockAgentCoreHarnessEndpoint — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoreharnessendpoint
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreHarnessEndpoint
metadata:
  name: example-bedrockagentcoreharnessendpoint
  namespace: default
spec:
  description: Managed by konfig-konector
  endpointName: example-bedrockagentcoreharnessendpoint
  harnessId: example-id
  providerRef:
    name: example-bedrockagentcoreharnessendpoint
    region: us-east-1
  tags:
  - key: example
    value: example
  targetVersion: '1.0'

Spec

Field	Type	Required	Description
`description`	string	—	The description of the endpoint.
`endpointName`	string	yes	The name of the endpoint.
`harnessId`	string	yes	The ID of the harness that the endpoint belongs to.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Tags to apply to the harness endpoint resource.
`tags[].key`	string	yes
`tags[].value`	string	yes
`targetVersion`	string	—	The harness version that the endpoint points to and serves invocations from.

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the endpoint.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the endpoint was created.
`harnessName`	string	—	The name of the harness that the endpoint belongs to.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`liveVersion`	string	—	The harness version that the endpoint is currently serving.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `CREATING, CREATE_FAILED, UPDATING, UPDATE_FAILED, READY, DELETING, DELETE_FAILED`
`updatedAt`	string	—	The timestamp when the endpoint was last updated.

BedrockAgentCoreMemory # CLOUD CONTROL · AWS::BedrockAgentCore::Memory

BedrockAgentCoreMemory manages AWS::BedrockAgentCore::Memory through the AWS Cloud Control API.

kubectl get bedrockagentcorememories · example on GitHub

Example

# BedrockAgentCoreMemory — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcorememory
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreMemory
metadata:
  name: example-bedrockagentcorememory
  namespace: default
spec:
  description: Managed by konfig-konector
  encryptionKeyArn: arn:aws:iam::123456789012:role/example-role
  eventExpiryDuration: 3
  indexedKeys:
  - key: example
    type: STRING
  memoryExecutionRoleArn: arn:aws:iam::123456789012:role/example-role
  memoryStrategies:
  - customMemoryStrategy:
      createdAt: example
      description: Managed by konfig-konector
      name: example-bedrockagentcorememory
      namespaceTemplates:
      - example
      namespaces:
      - example
      status: CREATING
      type: SEMANTIC
      updatedAt: example
    episodicMemoryStrategy:
      createdAt: example
      description: Managed by konfig-konector
      name: example-bedrockagentcorememory
      namespaceTemplates:
      - example
      namespaces:
      - example
      status: CREATING
      type: SEMANTIC
      updatedAt: example
    semanticMemoryStrategy:
      createdAt: example
      description: Managed by konfig-konector
      name: example-bedrockagentcorememory
      namespaceTemplates:
      - example
      namespaces:
      - example
      status: CREATING
      type: SEMANTIC
      updatedAt: example
    summaryMemoryStrategy:
      createdAt: example
      description: Managed by konfig-konector
      name: example-bedrockagentcorememory
      namespaceTemplates:
      - example
      namespaces:
      - example
      status: CREATING
      type: SEMANTIC
      updatedAt: example
    userPreferenceMemoryStrategy:
      createdAt: example
      description: Managed by konfig-konector
      name: example-bedrockagentcorememory
      namespaceTemplates:
      - example
      namespaces:
      - example
      status: CREATING
      type: SEMANTIC
      updatedAt: example
  name: example-bedrockagentcorememory
  providerRef:
    name: example-bedrockagentcorememory
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`description`	string	—
`encryptionKeyArn`	string	—	Create-only in AWS: changing it requires replacing the resource.
`eventExpiryDuration`	integer	yes	Duration in days until memory events expire
`indexedKeys`	array<object>	—
`indexedKeys[].key`	string	yes
`indexedKeys[].type`	enum	yes	Allowed: `STRING, STRINGLIST, NUMBER`
`memoryExecutionRoleArn`	string	—
`memoryStrategies`	array<object>	—
`memoryStrategies[].customMemoryStrategy`	object	—	BedrockAgentCoreMemoryCustomMemoryStrategy is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration`	object	—	BedrockAgentCoreMemoryCustomConfigurationInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.episodicOverride`	object	—	BedrockAgentCoreMemoryEpisodicOverride is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.episodicOverride.consolidation`	object	—	BedrockAgentCoreMemoryEpisodicOverrideConsolidationConfigurationInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.episodicOverride.consolidation.appendToPrompt`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.episodicOverride.consolidation.modelId`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.episodicOverride.extraction`	object	—	BedrockAgentCoreMemoryEpisodicOverrideExtractionConfigurationInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.episodicOverride.extraction.appendToPrompt`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.episodicOverride.extraction.modelId`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.episodicOverride.reflection`	object	—	BedrockAgentCoreMemoryEpisodicOverrideReflectionConfigurationInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.episodicOverride.reflection.appendToPrompt`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.episodicOverride.reflection.memoryRecordSchema`	object	—	BedrockAgentCoreMemoryMemoryRecordSchema is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.episodicOverride.reflection.modelId`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.episodicOverride.reflection.namespaceTemplates`	array<string>	—
`memoryStrategies[].customMemoryStrategy.configuration.episodicOverride.reflection.namespaces`	array<string>	—
`memoryStrategies[].customMemoryStrategy.configuration.selfManagedConfiguration`	object	—	BedrockAgentCoreMemorySelfManagedConfiguration is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.selfManagedConfiguration.historicalContextWindowSize`	integer	—
`memoryStrategies[].customMemoryStrategy.configuration.selfManagedConfiguration.invocationConfiguration`	object	—	BedrockAgentCoreMemoryInvocationConfigurationInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.selfManagedConfiguration.invocationConfiguration.payloadDeliveryBucketName`	string	—
`memoryStrategies[].customMemoryStrategy.configuration.selfManagedConfiguration.invocationConfiguration.topicArn`	string	—
`memoryStrategies[].customMemoryStrategy.configuration.selfManagedConfiguration.triggerConditions`	array<object>	—
`memoryStrategies[].customMemoryStrategy.configuration.selfManagedConfiguration.triggerConditions[].messageBasedTrigger`	object	—	BedrockAgentCoreMemoryMessageBasedTriggerInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.selfManagedConfiguration.triggerConditions[].timeBasedTrigger`	object	—	BedrockAgentCoreMemoryTimeBasedTriggerInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.selfManagedConfiguration.triggerConditions[].tokenBasedTrigger`	object	—	BedrockAgentCoreMemoryTokenBasedTriggerInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.semanticOverride`	object	—	BedrockAgentCoreMemorySemanticOverride is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.semanticOverride.consolidation`	object	—	BedrockAgentCoreMemorySemanticOverrideConsolidationConfigurationInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.semanticOverride.consolidation.appendToPrompt`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.semanticOverride.consolidation.modelId`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.semanticOverride.extraction`	object	—	BedrockAgentCoreMemorySemanticOverrideExtractionConfigurationInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.semanticOverride.extraction.appendToPrompt`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.semanticOverride.extraction.modelId`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.summaryOverride`	object	—	BedrockAgentCoreMemorySummaryOverride is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.summaryOverride.consolidation`	object	—	BedrockAgentCoreMemorySummaryOverrideConsolidationConfigurationInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.summaryOverride.consolidation.appendToPrompt`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.summaryOverride.consolidation.modelId`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.userPreferenceOverride`	object	—	BedrockAgentCoreMemoryUserPreferenceOverride is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.userPreferenceOverride.consolidation`	object	—	BedrockAgentCoreMemoryUserPreferenceOverrideConsolidationConfigurationInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.userPreferenceOverride.consolidation.appendToPrompt`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.userPreferenceOverride.consolidation.modelId`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.userPreferenceOverride.extraction`	object	—	BedrockAgentCoreMemoryUserPreferenceOverrideExtractionConfigurationInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.configuration.userPreferenceOverride.extraction.appendToPrompt`	string	yes
`memoryStrategies[].customMemoryStrategy.configuration.userPreferenceOverride.extraction.modelId`	string	yes
`memoryStrategies[].customMemoryStrategy.createdAt`	string	—	Creation timestamp of the memory strategy
`memoryStrategies[].customMemoryStrategy.description`	string	—
`memoryStrategies[].customMemoryStrategy.memoryRecordSchema`	object	—	BedrockAgentCoreMemoryMemoryRecordSchema is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.memoryRecordSchema.metadataSchema`	array<object>	—
`memoryStrategies[].customMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionConfig`	object	—	BedrockAgentCoreMemoryExtractionConfig is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionConfig.llmExtractionConfig`	object	—	BedrockAgentCoreMemoryLlmExtractionConfig is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].customMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionType`	enum	—	Allowed: `LLM_INFERRED, STRICTLY_CONSISTENT`
`memoryStrategies[].customMemoryStrategy.memoryRecordSchema.metadataSchema[].key`	string	yes
`memoryStrategies[].customMemoryStrategy.memoryRecordSchema.metadataSchema[].type`	enum	—	Allowed: `STRING, STRINGLIST, NUMBER`
`memoryStrategies[].customMemoryStrategy.name`	string	yes
`memoryStrategies[].customMemoryStrategy.namespaceTemplates`	array<string>	—
`memoryStrategies[].customMemoryStrategy.namespaces`	array<string>	—
`memoryStrategies[].customMemoryStrategy.status`	enum	—	Status of the memory strategy Allowed: `CREATING, ACTIVE, DELETING, FAILED`
`memoryStrategies[].customMemoryStrategy.strategyId`	string	—	Unique identifier for the memory strategy
`memoryStrategies[].customMemoryStrategy.type`	enum	—	Type of memory strategy Allowed: `SEMANTIC, SUMMARIZATION, USER_PREFERENCE, CUSTOM, EPISODIC`
`memoryStrategies[].customMemoryStrategy.updatedAt`	string	—	Last update timestamp of the memory strategy
`memoryStrategies[].episodicMemoryStrategy`	object	—	BedrockAgentCoreMemoryEpisodicMemoryStrategy is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].episodicMemoryStrategy.createdAt`	string	—	Creation timestamp of the memory strategy
`memoryStrategies[].episodicMemoryStrategy.description`	string	—
`memoryStrategies[].episodicMemoryStrategy.memoryRecordSchema`	object	—	BedrockAgentCoreMemoryMemoryRecordSchema is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].episodicMemoryStrategy.memoryRecordSchema.metadataSchema`	array<object>	—
`memoryStrategies[].episodicMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionConfig`	object	—	BedrockAgentCoreMemoryExtractionConfig is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].episodicMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionConfig.llmExtractionConfig`	object	—	BedrockAgentCoreMemoryLlmExtractionConfig is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].episodicMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionType`	enum	—	Allowed: `LLM_INFERRED, STRICTLY_CONSISTENT`
`memoryStrategies[].episodicMemoryStrategy.memoryRecordSchema.metadataSchema[].key`	string	yes
`memoryStrategies[].episodicMemoryStrategy.memoryRecordSchema.metadataSchema[].type`	enum	—	Allowed: `STRING, STRINGLIST, NUMBER`
`memoryStrategies[].episodicMemoryStrategy.name`	string	yes
`memoryStrategies[].episodicMemoryStrategy.namespaceTemplates`	array<string>	—
`memoryStrategies[].episodicMemoryStrategy.namespaces`	array<string>	—
`memoryStrategies[].episodicMemoryStrategy.reflectionConfiguration`	object	—	BedrockAgentCoreMemoryEpisodicReflectionConfigurationInput is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].episodicMemoryStrategy.reflectionConfiguration.memoryRecordSchema`	object	—	BedrockAgentCoreMemoryMemoryRecordSchema is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].episodicMemoryStrategy.reflectionConfiguration.memoryRecordSchema.metadataSchema`	array<object>	—
`memoryStrategies[].episodicMemoryStrategy.reflectionConfiguration.memoryRecordSchema.metadataSchema[].extractionConfig`	object	—	BedrockAgentCoreMemoryExtractionConfig is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].episodicMemoryStrategy.reflectionConfiguration.memoryRecordSchema.metadataSchema[].extractionType`	enum	—	Allowed: `LLM_INFERRED, STRICTLY_CONSISTENT`
`memoryStrategies[].episodicMemoryStrategy.reflectionConfiguration.memoryRecordSchema.metadataSchema[].key`	string	yes
`memoryStrategies[].episodicMemoryStrategy.reflectionConfiguration.memoryRecordSchema.metadataSchema[].type`	enum	—	Allowed: `STRING, STRINGLIST, NUMBER`
`memoryStrategies[].episodicMemoryStrategy.reflectionConfiguration.namespaceTemplates`	array<string>	—
`memoryStrategies[].episodicMemoryStrategy.reflectionConfiguration.namespaces`	array<string>	—
`memoryStrategies[].episodicMemoryStrategy.status`	enum	—	Status of the memory strategy Allowed: `CREATING, ACTIVE, DELETING, FAILED`
`memoryStrategies[].episodicMemoryStrategy.strategyId`	string	—	Unique identifier for the memory strategy
`memoryStrategies[].episodicMemoryStrategy.type`	enum	—	Type of memory strategy Allowed: `SEMANTIC, SUMMARIZATION, USER_PREFERENCE, CUSTOM, EPISODIC`
`memoryStrategies[].episodicMemoryStrategy.updatedAt`	string	—	Last update timestamp of the memory strategy
`memoryStrategies[].semanticMemoryStrategy`	object	—	BedrockAgentCoreMemorySemanticMemoryStrategy is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].semanticMemoryStrategy.createdAt`	string	—	Creation timestamp of the memory strategy
`memoryStrategies[].semanticMemoryStrategy.description`	string	—
`memoryStrategies[].semanticMemoryStrategy.memoryRecordSchema`	object	—	BedrockAgentCoreMemoryMemoryRecordSchema is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].semanticMemoryStrategy.memoryRecordSchema.metadataSchema`	array<object>	—
`memoryStrategies[].semanticMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionConfig`	object	—	BedrockAgentCoreMemoryExtractionConfig is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].semanticMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionConfig.llmExtractionConfig`	object	—	BedrockAgentCoreMemoryLlmExtractionConfig is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].semanticMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionType`	enum	—	Allowed: `LLM_INFERRED, STRICTLY_CONSISTENT`
`memoryStrategies[].semanticMemoryStrategy.memoryRecordSchema.metadataSchema[].key`	string	yes
`memoryStrategies[].semanticMemoryStrategy.memoryRecordSchema.metadataSchema[].type`	enum	—	Allowed: `STRING, STRINGLIST, NUMBER`
`memoryStrategies[].semanticMemoryStrategy.name`	string	yes
`memoryStrategies[].semanticMemoryStrategy.namespaceTemplates`	array<string>	—
`memoryStrategies[].semanticMemoryStrategy.namespaces`	array<string>	—
`memoryStrategies[].semanticMemoryStrategy.status`	enum	—	Status of the memory strategy Allowed: `CREATING, ACTIVE, DELETING, FAILED`
`memoryStrategies[].semanticMemoryStrategy.strategyId`	string	—	Unique identifier for the memory strategy
`memoryStrategies[].semanticMemoryStrategy.type`	enum	—	Type of memory strategy Allowed: `SEMANTIC, SUMMARIZATION, USER_PREFERENCE, CUSTOM, EPISODIC`
`memoryStrategies[].semanticMemoryStrategy.updatedAt`	string	—	Last update timestamp of the memory strategy
`memoryStrategies[].summaryMemoryStrategy`	object	—	BedrockAgentCoreMemorySummaryMemoryStrategy is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].summaryMemoryStrategy.createdAt`	string	—	Creation timestamp of the memory strategy
`memoryStrategies[].summaryMemoryStrategy.description`	string	—
`memoryStrategies[].summaryMemoryStrategy.memoryRecordSchema`	object	—	BedrockAgentCoreMemoryMemoryRecordSchema is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].summaryMemoryStrategy.memoryRecordSchema.metadataSchema`	array<object>	—
`memoryStrategies[].summaryMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionConfig`	object	—	BedrockAgentCoreMemoryExtractionConfig is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].summaryMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionConfig.llmExtractionConfig`	object	—	BedrockAgentCoreMemoryLlmExtractionConfig is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].summaryMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionType`	enum	—	Allowed: `LLM_INFERRED, STRICTLY_CONSISTENT`
`memoryStrategies[].summaryMemoryStrategy.memoryRecordSchema.metadataSchema[].key`	string	yes
`memoryStrategies[].summaryMemoryStrategy.memoryRecordSchema.metadataSchema[].type`	enum	—	Allowed: `STRING, STRINGLIST, NUMBER`
`memoryStrategies[].summaryMemoryStrategy.name`	string	yes
`memoryStrategies[].summaryMemoryStrategy.namespaceTemplates`	array<string>	—
`memoryStrategies[].summaryMemoryStrategy.namespaces`	array<string>	—
`memoryStrategies[].summaryMemoryStrategy.status`	enum	—	Status of the memory strategy Allowed: `CREATING, ACTIVE, DELETING, FAILED`
`memoryStrategies[].summaryMemoryStrategy.strategyId`	string	—	Unique identifier for the memory strategy
`memoryStrategies[].summaryMemoryStrategy.type`	enum	—	Type of memory strategy Allowed: `SEMANTIC, SUMMARIZATION, USER_PREFERENCE, CUSTOM, EPISODIC`
`memoryStrategies[].summaryMemoryStrategy.updatedAt`	string	—	Last update timestamp of the memory strategy
`memoryStrategies[].userPreferenceMemoryStrategy`	object	—	BedrockAgentCoreMemoryUserPreferenceMemoryStrategy is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].userPreferenceMemoryStrategy.createdAt`	string	—	Creation timestamp of the memory strategy
`memoryStrategies[].userPreferenceMemoryStrategy.description`	string	—
`memoryStrategies[].userPreferenceMemoryStrategy.memoryRecordSchema`	object	—	BedrockAgentCoreMemoryMemoryRecordSchema is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].userPreferenceMemoryStrategy.memoryRecordSchema.metadataSchema`	array<object>	—
`memoryStrategies[].userPreferenceMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionConfig`	object	—	BedrockAgentCoreMemoryExtractionConfig is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].userPreferenceMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionConfig.llmExtractionConfig`	object	—	BedrockAgentCoreMemoryLlmExtractionConfig is a nested property type of AWS::BedrockAgentCore::Memory.
`memoryStrategies[].userPreferenceMemoryStrategy.memoryRecordSchema.metadataSchema[].extractionType`	enum	—	Allowed: `LLM_INFERRED, STRICTLY_CONSISTENT`
`memoryStrategies[].userPreferenceMemoryStrategy.memoryRecordSchema.metadataSchema[].key`	string	yes
`memoryStrategies[].userPreferenceMemoryStrategy.memoryRecordSchema.metadataSchema[].type`	enum	—	Allowed: `STRING, STRINGLIST, NUMBER`
`memoryStrategies[].userPreferenceMemoryStrategy.name`	string	yes
`memoryStrategies[].userPreferenceMemoryStrategy.namespaceTemplates`	array<string>	—
`memoryStrategies[].userPreferenceMemoryStrategy.namespaces`	array<string>	—
`memoryStrategies[].userPreferenceMemoryStrategy.status`	enum	—	Status of the memory strategy Allowed: `CREATING, ACTIVE, DELETING, FAILED`
`memoryStrategies[].userPreferenceMemoryStrategy.strategyId`	string	—	Unique identifier for the memory strategy
`memoryStrategies[].userPreferenceMemoryStrategy.type`	enum	—	Type of memory strategy Allowed: `SEMANTIC, SUMMARIZATION, USER_PREFERENCE, CUSTOM, EPISODIC`
`memoryStrategies[].userPreferenceMemoryStrategy.updatedAt`	string	—	Last update timestamp of the memory strategy
`name`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`streamDeliveryResources`	object	—	BedrockAgentCoreMemoryStreamDeliveryResources is a nested property type of AWS::BedrockAgentCore::Memory.
`streamDeliveryResources.resources`	array<object>	yes
`streamDeliveryResources.resources[].kinesis`	object	—	BedrockAgentCoreMemoryKinesisResource is a nested property type of AWS::BedrockAgentCore::Memory.
`streamDeliveryResources.resources[].kinesis.contentConfigurations`	array<object>	yes
`streamDeliveryResources.resources[].kinesis.contentConfigurations[].level`	enum	—	The level of content detail to deliver Allowed: `METADATA_ONLY, FULL_CONTENT`
`streamDeliveryResources.resources[].kinesis.contentConfigurations[].type`	enum	yes	The type of content to deliver Allowed: `MEMORY_RECORDS`
`streamDeliveryResources.resources[].kinesis.dataStreamArn`	string	yes
`tags`	map<string>	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Read-only: reported by AWS after creation.
`failureReason`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`memoryArn`	string	—	Read-only: reported by AWS after creation.
`memoryId`	string	—	Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `CREATING, ACTIVE, FAILED, DELETING`
`updatedAt`	string	—	Read-only: reported by AWS after creation.

BedrockAgentCoreOAuth2CredentialProvider # CLOUD CONTROL · AWS::BedrockAgentCore::OAuth2CredentialProvider ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: spec must contain an OAuth client secret in plain text. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. BedrockAgentCoreOAuth2CredentialProvider manages AWS::BedrockAgentCore::OAuth2CredentialProvider through the AWS Cloud Control API.

kubectl get bedrockagentcoreoauth2credentialproviders · example on GitHub

Example

# BedrockAgentCoreOAuth2CredentialProvider — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoreoauth2credentialprovider
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreOAuth2CredentialProvider
metadata:
  name: example-bedrockagentcoreoauth2credentialprovider
  namespace: default
spec:
  credentialProviderVendor: GoogleOauth2
  name: example-bedrockagentcoreoauth2credentialprovider
  oauth2ProviderConfigInput:
    atlassianOauth2ProviderConfig:
      clientId: example-id
      clientSecret: example
      clientSecretConfig:
        jsonKey: example
        secretId: example-id
      clientSecretSource: MANAGED
    customOauth2ProviderConfig:
      clientAuthenticationMethod: CLIENT_SECRET_BASIC
      clientSecret: example
      clientSecretConfig:
        jsonKey: example
        secretId: example-id
      clientSecretSource: MANAGED
      oauthDiscovery:
        discoveryUrl: example
      onBehalfOfTokenExchangeConfig:
        grantType: TOKEN_EXCHANGE
      privateEndpointOverrides:
      - domain: example
      privateKeyJwtConfig:
        signingAlgorithm: RS256
    githubOauth2ProviderConfig:
      clientId: example-id
      clientSecret: example
      clientSecretConfig:
        jsonKey: example
        secretId: example-id
      clientSecretSource: MANAGED
    googleOauth2ProviderConfig:
      clientId: example-id
      clientSecret: example
      clientSecretConfig:
        jsonKey: example
        secretId: example-id
      clientSecretSource: MANAGED
    includedOauth2ProviderConfig:
      authorizationEndpoint: example
      clientId: example-id
      clientSecret: example
      clientSecretConfig:
        jsonKey: example
        secretId: example-id
      clientSecretSource: MANAGED
      issuer: example
      tokenEndpoint: example
    linkedinOauth2ProviderConfig:
      clientId: example-id
      clientSecret: example
      clientSecretConfig:
        jsonKey: example
        secretId: example-id
      clientSecretSource: MANAGED
    microsoftOauth2ProviderConfig:
      clientId: example-id
      clientSecret: example
      clientSecretConfig:
        jsonKey: example
        secretId: example-id
      clientSecretSource: MANAGED
    salesforceOauth2ProviderConfig:
      clientId: example-id
      clientSecret: example
      clientSecretConfig:
        jsonKey: example
        secretId: example-id
      clientSecretSource: MANAGED
    slackOauth2ProviderConfig:
      clientId: example-id
      clientSecret: example
      clientSecretConfig:
        jsonKey: example
        secretId: example-id
      clientSecretSource: MANAGED
  providerRef:
    name: example-bedrockagentcoreoauth2credentialprovider
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`credentialProviderVendor`	enum	yes	The vendor of the OAuth2 credential provider Create-only in AWS: changing it requires replacing the resource. Allowed: `GoogleOauth2, GithubOauth2, SlackOauth2, SalesforceOauth2, MicrosoftOauth2, CustomOauth2, AtlassianOauth2, LinkedinOauth2…`
`name`	string	yes	The name of the OAuth2 credential provider Create-only in AWS: changing it requires replacing the resource.
`oauth2ProviderConfigInput`	object	—	The configuration settings for the OAuth2 provider
`oauth2ProviderConfigInput.atlassianOauth2ProviderConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderAtlassianOauth2ProviderConfigInput is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.atlassianOauth2ProviderConfig.clientId`	string	yes
`oauth2ProviderConfigInput.atlassianOauth2ProviderConfig.clientSecret`	string	—
`oauth2ProviderConfigInput.atlassianOauth2ProviderConfig.clientSecretConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderSecretReference is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.atlassianOauth2ProviderConfig.clientSecretConfig.jsonKey`	string	yes	The JSON key within the secret that contains the credential value
`oauth2ProviderConfigInput.atlassianOauth2ProviderConfig.clientSecretConfig.secretId`	string	yes	The ID or ARN of the secret in AWS Secrets Manager
`oauth2ProviderConfigInput.atlassianOauth2ProviderConfig.clientSecretSource`	enum	—	Allowed: `MANAGED, EXTERNAL`
`oauth2ProviderConfigInput.customOauth2ProviderConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderCustomOauth2ProviderConfigInput is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.clientAuthenticationMethod`	enum	—	The client authentication method to use when authenticating with the token endpoint Allowed: `CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, AWS_IAM_ID_TOKEN_JWT, PRIVATE_KEY_JWT`
`oauth2ProviderConfigInput.customOauth2ProviderConfig.clientId`	string	—	The client ID for the custom OAuth2 provider
`oauth2ProviderConfigInput.customOauth2ProviderConfig.clientSecret`	string	—	The client secret for the custom OAuth2 provider
`oauth2ProviderConfigInput.customOauth2ProviderConfig.clientSecretConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderSecretReference is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.clientSecretConfig.jsonKey`	string	yes	The JSON key within the secret that contains the credential value
`oauth2ProviderConfigInput.customOauth2ProviderConfig.clientSecretConfig.secretId`	string	yes	The ID or ARN of the secret in AWS Secrets Manager
`oauth2ProviderConfigInput.customOauth2ProviderConfig.clientSecretSource`	enum	—	The source of the client secret Allowed: `MANAGED, EXTERNAL`
`oauth2ProviderConfigInput.customOauth2ProviderConfig.oauthDiscovery`	object	yes	BedrockAgentCoreOAuth2CredentialProviderOauth2Discovery is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.oauthDiscovery.authorizationServerMetadata`	object	—	BedrockAgentCoreOAuth2CredentialProviderOauth2AuthorizationServerMetadata is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.oauthDiscovery.authorizationServerMetadata.authorizationEndpoint`	string	yes	The authorization endpoint URL
`oauth2ProviderConfigInput.customOauth2ProviderConfig.oauthDiscovery.authorizationServerMetadata.issuer`	string	yes	The issuer URL for the OAuth2 authorization server
`oauth2ProviderConfigInput.customOauth2ProviderConfig.oauthDiscovery.authorizationServerMetadata.responseTypes`	array<string>	—	The supported response types
`oauth2ProviderConfigInput.customOauth2ProviderConfig.oauthDiscovery.authorizationServerMetadata.tokenEndpoint`	string	yes	The token endpoint URL
`oauth2ProviderConfigInput.customOauth2ProviderConfig.oauthDiscovery.discoveryUrl`	string	—	The discovery URL for the OAuth2 provider
`oauth2ProviderConfigInput.customOauth2ProviderConfig.onBehalfOfTokenExchangeConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderOnBehalfOfTokenExchangeConfig is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.onBehalfOfTokenExchangeConfig.grantType`	enum	yes	The grant type for on-behalf-of token exchange Allowed: `TOKEN_EXCHANGE, JWT_AUTHORIZATION_GRANT`
`oauth2ProviderConfigInput.customOauth2ProviderConfig.onBehalfOfTokenExchangeConfig.tokenExchangeGrantTypeConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderTokenExchangeGrantTypeConfig is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.onBehalfOfTokenExchangeConfig.tokenExchangeGrantTypeConfig.actorTokenContent`	enum	yes	The actor token content type Allowed: `NONE, M2M, AWS_IAM_ID_TOKEN_JWT`
`oauth2ProviderConfigInput.customOauth2ProviderConfig.onBehalfOfTokenExchangeConfig.tokenExchangeGrantTypeConfig.actorTokenScopes`	array<string>	—	The actor token scopes.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpoint`	object	—	BedrockAgentCoreOAuth2CredentialProviderPrivateEndpoint is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpoint.managedVpcResource`	object	—	BedrockAgentCoreOAuth2CredentialProviderManagedVpcResource is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpoint.managedVpcResource.endpointIpAddressType`	enum	yes	The IP address type for the resource configuration endpoint Allowed: `IPV4, IPV6`
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpoint.managedVpcResource.routingDomain`	string	—	An intermediate publicly resolvable domain used as the VPC Lattice resource configuration endpoint
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpoint.managedVpcResource.securityGroupIds`	array<string>	—	The security group IDs to associate with the VPC Lattice resource gateway
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpoint.managedVpcResource.subnetIds`	array<string>	yes	The subnet IDs within the VPC where the VPC Lattice resource gateway is placed
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpoint.managedVpcResource.tags`	map<string>	—	Tags to apply to the managed VPC Lattice resource gateway
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpoint.managedVpcResource.vpcIdentifier`	string	yes	The ID of the VPC that contains your private resource
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpoint.selfManagedLatticeResource`	object	—	BedrockAgentCoreOAuth2CredentialProviderSelfManagedLatticeResource is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpoint.selfManagedLatticeResource.resourceConfigurationIdentifier`	string	yes	The ARN or ID of the VPC Lattice resource configuration
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpointOverrides`	array<object>	—	A list of private endpoint overrides.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpointOverrides[].domain`	string	yes	The domain to override with a private endpoint
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpointOverrides[].privateEndpoint`	object	yes	BedrockAgentCoreOAuth2CredentialProviderPrivateEndpoint is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpointOverrides[].privateEndpoint.managedVpcResource`	object	—	BedrockAgentCoreOAuth2CredentialProviderManagedVpcResource is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpointOverrides[].privateEndpoint.managedVpcResource.endpointIpAddressType`	enum	yes	The IP address type for the resource configuration endpoint Allowed: `IPV4, IPV6`
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpointOverrides[].privateEndpoint.managedVpcResource.routingDomain`	string	—	An intermediate publicly resolvable domain used as the VPC Lattice resource configuration endpoint
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpointOverrides[].privateEndpoint.managedVpcResource.securityGroupIds`	array<string>	—	The security group IDs to associate with the VPC Lattice resource gateway
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpointOverrides[].privateEndpoint.managedVpcResource.subnetIds`	array<string>	yes	The subnet IDs within the VPC where the VPC Lattice resource gateway is placed
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpointOverrides[].privateEndpoint.managedVpcResource.tags`	map<string>	—	Tags to apply to the managed VPC Lattice resource gateway
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpointOverrides[].privateEndpoint.managedVpcResource.vpcIdentifier`	string	yes	The ID of the VPC that contains your private resource
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpointOverrides[].privateEndpoint.selfManagedLatticeResource`	object	—	BedrockAgentCoreOAuth2CredentialProviderSelfManagedLatticeResource is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateEndpointOverrides[].privateEndpoint.selfManagedLatticeResource.resourceConfigurationIdentifier`	string	yes	The ARN or ID of the VPC Lattice resource configuration
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateKeyJwtConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderPrivateKeyJwtConfig is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateKeyJwtConfig.additionalHeaderClaims`	map<string>	—
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateKeyJwtConfig.additionalPayloadClaims`	map<string>	—
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateKeyJwtConfig.privateKeySource`	object	—	BedrockAgentCoreOAuth2CredentialProviderPrivateKeySource is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateKeyJwtConfig.privateKeySource.kmsKeySource`	object	—	BedrockAgentCoreOAuth2CredentialProviderKmsKeySourceType is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateKeyJwtConfig.privateKeySource.kmsKeySource.kmsKeyArn`	string	yes	The Amazon Resource Name (ARN) of the KMS key used to sign the JWT client assertion
`oauth2ProviderConfigInput.customOauth2ProviderConfig.privateKeyJwtConfig.signingAlgorithm`	enum	—	The algorithm used to sign the JWT client assertion Allowed: `RS256, PS256, ES256`
`oauth2ProviderConfigInput.githubOauth2ProviderConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderGithubOauth2ProviderConfigInput is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.githubOauth2ProviderConfig.clientId`	string	yes
`oauth2ProviderConfigInput.githubOauth2ProviderConfig.clientSecret`	string	—
`oauth2ProviderConfigInput.githubOauth2ProviderConfig.clientSecretConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderSecretReference is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.githubOauth2ProviderConfig.clientSecretConfig.jsonKey`	string	yes	The JSON key within the secret that contains the credential value
`oauth2ProviderConfigInput.githubOauth2ProviderConfig.clientSecretConfig.secretId`	string	yes	The ID or ARN of the secret in AWS Secrets Manager
`oauth2ProviderConfigInput.githubOauth2ProviderConfig.clientSecretSource`	enum	—	Allowed: `MANAGED, EXTERNAL`
`oauth2ProviderConfigInput.googleOauth2ProviderConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderGoogleOauth2ProviderConfigInput is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.googleOauth2ProviderConfig.clientId`	string	yes
`oauth2ProviderConfigInput.googleOauth2ProviderConfig.clientSecret`	string	—
`oauth2ProviderConfigInput.googleOauth2ProviderConfig.clientSecretConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderSecretReference is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.googleOauth2ProviderConfig.clientSecretConfig.jsonKey`	string	yes	The JSON key within the secret that contains the credential value
`oauth2ProviderConfigInput.googleOauth2ProviderConfig.clientSecretConfig.secretId`	string	yes	The ID or ARN of the secret in AWS Secrets Manager
`oauth2ProviderConfigInput.googleOauth2ProviderConfig.clientSecretSource`	enum	—	Allowed: `MANAGED, EXTERNAL`
`oauth2ProviderConfigInput.includedOauth2ProviderConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderIncludedOauth2ProviderConfigInput is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.includedOauth2ProviderConfig.authorizationEndpoint`	string	—	OAuth2 authorization endpoint for your isolated OAuth2 application tenant
`oauth2ProviderConfigInput.includedOauth2ProviderConfig.clientId`	string	yes
`oauth2ProviderConfigInput.includedOauth2ProviderConfig.clientSecret`	string	—
`oauth2ProviderConfigInput.includedOauth2ProviderConfig.clientSecretConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderSecretReference is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.includedOauth2ProviderConfig.clientSecretConfig.jsonKey`	string	yes	The JSON key within the secret that contains the credential value
`oauth2ProviderConfigInput.includedOauth2ProviderConfig.clientSecretConfig.secretId`	string	yes	The ID or ARN of the secret in AWS Secrets Manager
`oauth2ProviderConfigInput.includedOauth2ProviderConfig.clientSecretSource`	enum	—	Allowed: `MANAGED, EXTERNAL`
`oauth2ProviderConfigInput.includedOauth2ProviderConfig.issuer`	string	—	Token issuer of your isolated OAuth2 application tenant
`oauth2ProviderConfigInput.includedOauth2ProviderConfig.tokenEndpoint`	string	—	OAuth2 token endpoint for your isolated OAuth2 application tenant
`oauth2ProviderConfigInput.linkedinOauth2ProviderConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderLinkedinOauth2ProviderConfigInput is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.linkedinOauth2ProviderConfig.clientId`	string	yes
`oauth2ProviderConfigInput.linkedinOauth2ProviderConfig.clientSecret`	string	—
`oauth2ProviderConfigInput.linkedinOauth2ProviderConfig.clientSecretConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderSecretReference is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.linkedinOauth2ProviderConfig.clientSecretConfig.jsonKey`	string	yes	The JSON key within the secret that contains the credential value
`oauth2ProviderConfigInput.linkedinOauth2ProviderConfig.clientSecretConfig.secretId`	string	yes	The ID or ARN of the secret in AWS Secrets Manager
`oauth2ProviderConfigInput.linkedinOauth2ProviderConfig.clientSecretSource`	enum	—	Allowed: `MANAGED, EXTERNAL`
`oauth2ProviderConfigInput.microsoftOauth2ProviderConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderMicrosoftOauth2ProviderConfigInput is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.microsoftOauth2ProviderConfig.clientId`	string	yes
`oauth2ProviderConfigInput.microsoftOauth2ProviderConfig.clientSecret`	string	—
`oauth2ProviderConfigInput.microsoftOauth2ProviderConfig.clientSecretConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderSecretReference is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.microsoftOauth2ProviderConfig.clientSecretConfig.jsonKey`	string	yes	The JSON key within the secret that contains the credential value
`oauth2ProviderConfigInput.microsoftOauth2ProviderConfig.clientSecretConfig.secretId`	string	yes	The ID or ARN of the secret in AWS Secrets Manager
`oauth2ProviderConfigInput.microsoftOauth2ProviderConfig.clientSecretSource`	enum	—	Allowed: `MANAGED, EXTERNAL`
`oauth2ProviderConfigInput.microsoftOauth2ProviderConfig.tenantId`	string	—	The Microsoft Entra ID tenant ID
`oauth2ProviderConfigInput.salesforceOauth2ProviderConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderSalesforceOauth2ProviderConfigInput is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.salesforceOauth2ProviderConfig.clientId`	string	yes
`oauth2ProviderConfigInput.salesforceOauth2ProviderConfig.clientSecret`	string	—
`oauth2ProviderConfigInput.salesforceOauth2ProviderConfig.clientSecretConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderSecretReference is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.salesforceOauth2ProviderConfig.clientSecretConfig.jsonKey`	string	yes	The JSON key within the secret that contains the credential value
`oauth2ProviderConfigInput.salesforceOauth2ProviderConfig.clientSecretConfig.secretId`	string	yes	The ID or ARN of the secret in AWS Secrets Manager
`oauth2ProviderConfigInput.salesforceOauth2ProviderConfig.clientSecretSource`	enum	—	Allowed: `MANAGED, EXTERNAL`
`oauth2ProviderConfigInput.slackOauth2ProviderConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderSlackOauth2ProviderConfigInput is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.slackOauth2ProviderConfig.clientId`	string	yes
`oauth2ProviderConfigInput.slackOauth2ProviderConfig.clientSecret`	string	—
`oauth2ProviderConfigInput.slackOauth2ProviderConfig.clientSecretConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderSecretReference is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigInput.slackOauth2ProviderConfig.clientSecretConfig.jsonKey`	string	yes	The JSON key within the secret that contains the credential value
`oauth2ProviderConfigInput.slackOauth2ProviderConfig.clientSecretConfig.secretId`	string	yes	The ID or ARN of the secret in AWS Secrets Manager
`oauth2ProviderConfigInput.slackOauth2ProviderConfig.clientSecretSource`	enum	—	Allowed: `MANAGED, EXTERNAL`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Tags to assign to the OAuth2 credential provider
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`callbackUrl`	string	—	The callback URL for the OAuth2 authorization flow Read-only: reported by AWS after creation.
`clientSecretArn`	object	—	The ARN of the client secret in AWS Secrets Manager Read-only: reported by AWS after creation.
`clientSecretArn.secretArn`	string	yes	The ARN of the secret in AWS Secrets Manager
`clientSecretJsonKey`	string	—	The JSON key within the secret that contains the client secret value Read-only: reported by AWS after creation.
`clientSecretSource`	enum	—	The source of the client secret Read-only: reported by AWS after creation. Allowed: `MANAGED, EXTERNAL`
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdTime`	string	—	The timestamp when the credential provider was created Read-only: reported by AWS after creation.
`credentialProviderArn`	string	—	The Amazon Resource Name (ARN) of the OAuth2 credential provider Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedTime`	string	—	The timestamp when the credential provider was last updated Read-only: reported by AWS after creation.
`oauth2ProviderConfigOutput`	object	—	The output configuration for the OAuth2 provider Read-only: reported by AWS after creation.
`oauth2ProviderConfigOutput.clientAuthenticationMethod`	enum	—	The client authentication method used when authenticating with the token endpoint Allowed: `CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, AWS_IAM_ID_TOKEN_JWT, PRIVATE_KEY_JWT`
`oauth2ProviderConfigOutput.clientId`	string	—
`oauth2ProviderConfigOutput.oauthDiscovery`	object	—	BedrockAgentCoreOAuth2CredentialProviderOauth2Discovery is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigOutput.oauthDiscovery.authorizationServerMetadata`	object	—	BedrockAgentCoreOAuth2CredentialProviderOauth2AuthorizationServerMetadata is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigOutput.oauthDiscovery.authorizationServerMetadata.authorizationEndpoint`	string	yes	The authorization endpoint URL
`oauth2ProviderConfigOutput.oauthDiscovery.authorizationServerMetadata.issuer`	string	yes	The issuer URL for the OAuth2 authorization server
`oauth2ProviderConfigOutput.oauthDiscovery.authorizationServerMetadata.responseTypes`	array<string>	—	The supported response types
`oauth2ProviderConfigOutput.oauthDiscovery.authorizationServerMetadata.tokenEndpoint`	string	yes	The token endpoint URL
`oauth2ProviderConfigOutput.oauthDiscovery.discoveryUrl`	string	—	The discovery URL for the OAuth2 provider
`oauth2ProviderConfigOutput.onBehalfOfTokenExchangeConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderOnBehalfOfTokenExchangeConfig is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigOutput.onBehalfOfTokenExchangeConfig.grantType`	enum	yes	The grant type for on-behalf-of token exchange Allowed: `TOKEN_EXCHANGE, JWT_AUTHORIZATION_GRANT`
`oauth2ProviderConfigOutput.onBehalfOfTokenExchangeConfig.tokenExchangeGrantTypeConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderTokenExchangeGrantTypeConfig is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigOutput.onBehalfOfTokenExchangeConfig.tokenExchangeGrantTypeConfig.actorTokenContent`	enum	yes	The actor token content type Allowed: `NONE, M2M, AWS_IAM_ID_TOKEN_JWT`
`oauth2ProviderConfigOutput.onBehalfOfTokenExchangeConfig.tokenExchangeGrantTypeConfig.actorTokenScopes`	array<string>	—	The actor token scopes.
`oauth2ProviderConfigOutput.privateEndpoint`	object	—	BedrockAgentCoreOAuth2CredentialProviderPrivateEndpoint is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigOutput.privateEndpoint.managedVpcResource`	object	—	BedrockAgentCoreOAuth2CredentialProviderManagedVpcResource is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigOutput.privateEndpoint.managedVpcResource.endpointIpAddressType`	enum	yes	The IP address type for the resource configuration endpoint Allowed: `IPV4, IPV6`
`oauth2ProviderConfigOutput.privateEndpoint.managedVpcResource.routingDomain`	string	—	An intermediate publicly resolvable domain used as the VPC Lattice resource configuration endpoint
`oauth2ProviderConfigOutput.privateEndpoint.managedVpcResource.securityGroupIds`	array<string>	—	The security group IDs to associate with the VPC Lattice resource gateway
`oauth2ProviderConfigOutput.privateEndpoint.managedVpcResource.subnetIds`	array<string>	yes	The subnet IDs within the VPC where the VPC Lattice resource gateway is placed
`oauth2ProviderConfigOutput.privateEndpoint.managedVpcResource.tags`	map<string>	—	Tags to apply to the managed VPC Lattice resource gateway
`oauth2ProviderConfigOutput.privateEndpoint.managedVpcResource.vpcIdentifier`	string	yes	The ID of the VPC that contains your private resource
`oauth2ProviderConfigOutput.privateEndpoint.selfManagedLatticeResource`	object	—	BedrockAgentCoreOAuth2CredentialProviderSelfManagedLatticeResource is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigOutput.privateEndpoint.selfManagedLatticeResource.resourceConfigurationIdentifier`	string	yes	The ARN or ID of the VPC Lattice resource configuration
`oauth2ProviderConfigOutput.privateEndpointOverrides`	array<object>	—	The list of private endpoint overrides for the OAuth2 provider.
`oauth2ProviderConfigOutput.privateEndpointOverrides[].domain`	string	yes	The domain to override with a private endpoint
`oauth2ProviderConfigOutput.privateEndpointOverrides[].privateEndpoint`	object	yes	BedrockAgentCoreOAuth2CredentialProviderPrivateEndpoint is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigOutput.privateEndpointOverrides[].privateEndpoint.managedVpcResource`	object	—	BedrockAgentCoreOAuth2CredentialProviderManagedVpcResource is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigOutput.privateEndpointOverrides[].privateEndpoint.managedVpcResource.endpointIpAddressType`	enum	yes	The IP address type for the resource configuration endpoint Allowed: `IPV4, IPV6`
`oauth2ProviderConfigOutput.privateEndpointOverrides[].privateEndpoint.managedVpcResource.routingDomain`	string	—	An intermediate publicly resolvable domain used as the VPC Lattice resource configuration endpoint
`oauth2ProviderConfigOutput.privateEndpointOverrides[].privateEndpoint.managedVpcResource.securityGroupIds`	array<string>	—	The security group IDs to associate with the VPC Lattice resource gateway
`oauth2ProviderConfigOutput.privateEndpointOverrides[].privateEndpoint.managedVpcResource.subnetIds`	array<string>	yes	The subnet IDs within the VPC where the VPC Lattice resource gateway is placed
`oauth2ProviderConfigOutput.privateEndpointOverrides[].privateEndpoint.managedVpcResource.tags`	map<string>	—	Tags to apply to the managed VPC Lattice resource gateway
`oauth2ProviderConfigOutput.privateEndpointOverrides[].privateEndpoint.managedVpcResource.vpcIdentifier`	string	yes	The ID of the VPC that contains your private resource
`oauth2ProviderConfigOutput.privateEndpointOverrides[].privateEndpoint.selfManagedLatticeResource`	object	—	BedrockAgentCoreOAuth2CredentialProviderSelfManagedLatticeResource is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigOutput.privateEndpointOverrides[].privateEndpoint.selfManagedLatticeResource.resourceConfigurationIdentifier`	string	yes	The ARN or ID of the VPC Lattice resource configuration
`oauth2ProviderConfigOutput.privateKeyJwtConfig`	object	—	BedrockAgentCoreOAuth2CredentialProviderPrivateKeyJwtConfig is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigOutput.privateKeyJwtConfig.additionalHeaderClaims`	map<string>	—
`oauth2ProviderConfigOutput.privateKeyJwtConfig.additionalPayloadClaims`	map<string>	—
`oauth2ProviderConfigOutput.privateKeyJwtConfig.privateKeySource`	object	—	BedrockAgentCoreOAuth2CredentialProviderPrivateKeySource is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigOutput.privateKeyJwtConfig.privateKeySource.kmsKeySource`	object	—	BedrockAgentCoreOAuth2CredentialProviderKmsKeySourceType is a nested property type of AWS::BedrockAgentCore::OAuth2CredentialProvider.
`oauth2ProviderConfigOutput.privateKeyJwtConfig.privateKeySource.kmsKeySource.kmsKeyArn`	string	yes	The Amazon Resource Name (ARN) of the KMS key used to sign the JWT client assertion
`oauth2ProviderConfigOutput.privateKeyJwtConfig.signingAlgorithm`	enum	—	The algorithm used to sign the JWT client assertion Allowed: `RS256, PS256, ES256`
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The current status of the OAuth2 credential provider Read-only: reported by AWS after creation. Allowed: `CREATING, CREATE_FAILED, UPDATING, UPDATE_FAILED, READY, DELETING, DELETE_FAILED`

BedrockAgentCoreOnlineEvaluationConfig # CLOUD CONTROL · AWS::BedrockAgentCore::OnlineEvaluationConfig

BedrockAgentCoreOnlineEvaluationConfig manages AWS::BedrockAgentCore::OnlineEvaluationConfig through the AWS Cloud Control API.

kubectl get bedrockagentcoreonlineevaluationconfigs · example on GitHub

Example

# BedrockAgentCoreOnlineEvaluationConfig — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoreonlineevaluationconfig
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreOnlineEvaluationConfig
metadata:
  name: example-bedrockagentcoreonlineevaluationconfig
  namespace: default
spec:
  clusteringConfig:
    frequencies:
    - example
  dataSourceConfig:
    cloudWatchLogs:
      logGroupNames:
      - example
      serviceNames:
      - example
  description: Managed by konfig-konector
  evaluationExecutionRoleArn: arn:aws:iam::123456789012:role/example-role
  evaluators:
  - evaluatorId: example-id
  executionStatus: ENABLED
  insights:
  - insightId: example-id
  onlineEvaluationConfigName: example-bedrockagentcoreonlineevaluationconfig
  providerRef:
    name: example-bedrockagentcoreonlineevaluationconfig
    region: us-east-1
  rule:
    filters:
    - key: example
      operator: Equals
      value:
        booleanValue: false
        doubleValue: 1
        stringValue: example
    samplingConfig:
      samplingPercentage: 1
    sessionConfig:
      sessionTimeoutMinutes: 1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`clusteringConfig`	object	—	The configuration for clustering analysis of evaluation results.
`clusteringConfig.frequencies`	array<string>	yes	The list of frequencies at which clustering reports are generated.
`dataSourceConfig`	object	yes	The data source configuration that specifies CloudWatch log groups and service names to monitor.
`dataSourceConfig.cloudWatchLogs`	object	yes	BedrockAgentCoreOnlineEvaluationConfigCloudWatchLogsInputConfig is a nested property type of AWS::BedrockAgentCore::OnlineEvaluationConfig.
`dataSourceConfig.cloudWatchLogs.logGroupNames`	array<string>	yes	The list of CloudWatch log group names to monitor for agent traces.
`dataSourceConfig.cloudWatchLogs.serviceNames`	array<string>	yes	The list of service names to filter traces within the specified log groups.
`description`	string	—	The description of the online evaluation configuration.
`evaluationExecutionRoleArn`	string	yes	The Amazon Resource Name (ARN) of the IAM role that grants permissions for evaluation.
`evaluators`	array<object>	—	The list of evaluators to apply during online evaluation.
`evaluators[].evaluatorId`	string	yes	The unique identifier of the evaluator.
`executionStatus`	enum	—	The execution status indicating whether the online evaluation is currently running. Allowed: `ENABLED, DISABLED`
`insights`	array<object>	—	The list of insights to enable for failure analysis.
`insights[].insightId`	string	yes	The unique identifier of the insight.
`onlineEvaluationConfigName`	string	yes	The name of the online evaluation configuration.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`rule`	object	yes	The evaluation rule that defines sampling configuration, filters, and session detection settings.
`rule.filters`	array<object>	—	The list of filters that determine which agent traces should be included in the evaluation.
`rule.filters[].key`	string	yes	The key or field name to filter on within the agent trace data.
`rule.filters[].operator`	enum	yes	The comparison operator to use for filtering. Allowed: `Equals, NotEquals, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, Contains, NotContains`
`rule.filters[].value`	object	yes	BedrockAgentCoreOnlineEvaluationConfigFilterValue is a nested property type of AWS::BedrockAgentCore::OnlineEvaluationConfig.
`rule.filters[].value.booleanValue`	boolean	—	The boolean value for true/false filtering conditions.
`rule.filters[].value.doubleValue`	number	—	The numeric value for numerical filtering.
`rule.filters[].value.stringValue`	string	—	The string value for text-based filtering.
`rule.samplingConfig`	object	yes	BedrockAgentCoreOnlineEvaluationConfigSamplingConfig is a nested property type of AWS::BedrockAgentCore::OnlineEvaluationConfig.
`rule.samplingConfig.samplingPercentage`	number	yes	The percentage of agent traces to sample for evaluation.
`rule.sessionConfig`	object	—	BedrockAgentCoreOnlineEvaluationConfigSessionConfig is a nested property type of AWS::BedrockAgentCore::OnlineEvaluationConfig.
`rule.sessionConfig.sessionTimeoutMinutes`	integer	yes	The number of minutes of inactivity after which an agent session is considered complete.
`tags`	array<object>	—	A list of tags to assign to the online evaluation configuration.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the online evaluation configuration was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`onlineEvaluationConfigArn`	string	—	The Amazon Resource Name (ARN) of the online evaluation configuration.
`onlineEvaluationConfigId`	string	—	The unique identifier of the online evaluation configuration.
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`outputConfig`	object	—	The configuration that specifies where evaluation results should be written.
`outputConfig.cloudWatchConfig`	object	—	BedrockAgentCoreOnlineEvaluationConfigCloudWatchOutputConfig is a nested property type of AWS::BedrockAgentCore::OnlineEvaluationConfig.
`outputConfig.cloudWatchConfig.logGroupName`	string	—	The CloudWatch log group name for evaluation results.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The status of the online evaluation configuration. Allowed: `ACTIVE, CREATING, CREATE_FAILED, UPDATING, UPDATE_FAILED, DELETING`
`updatedAt`	string	—	The timestamp when the online evaluation configuration was last updated.

BedrockAgentCorePolicy # CLOUD CONTROL · AWS::BedrockAgentCore::Policy

BedrockAgentCorePolicy manages AWS::BedrockAgentCore::Policy through the AWS Cloud Control API.

kubectl get bedrockagentcorepolicies · example on GitHub

Example

# BedrockAgentCorePolicy — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcorepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCorePolicy
metadata:
  name: example-bedrockagentcorepolicy
  namespace: default
spec:
  definition:
    cedar:
      statement: example-xxxxxxxxxxxxxxxxxxxxxxxxxxx
    policy:
      statement: example-xxxxxxxxxxxxxxxxxxxxxxxxxxx
  description: Managed by konfig-konector
  enforcementMode: ACTIVE
  name: example-bedrockagentcorepolicy
  policyEngineId: example-id-x
  providerRef:
    name: example-bedrockagentcorepolicy
    region: us-east-1
  validationMode: FAIL_ON_ANY_FINDINGS

Spec

Field	Type	Required	Description
`definition`	object	yes	BedrockAgentCorePolicyPolicyDefinition is a nested property type of AWS::BedrockAgentCore::Policy.
`definition.cedar`	object	—	BedrockAgentCorePolicyCedarPolicy is a nested property type of AWS::BedrockAgentCore::Policy.
`definition.cedar.statement`	string	yes	The Cedar policy statement that defines the authorization logic.
`definition.policy`	object	—	BedrockAgentCorePolicyPolicyStatement is a nested property type of AWS::BedrockAgentCore::Policy.
`definition.policy.statement`	string	yes	The policy statement.
`description`	string	—	A human-readable description of the policy's purpose and functionality.
`enforcementMode`	enum	—	Allowed: `ACTIVE, LOG_ONLY`
`name`	string	yes	The customer-assigned immutable name for the policy.
`policyEngineId`	string	yes	The identifier of the policy engine which contains this policy.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`validationMode`	enum	—	Allowed: `FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS`

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the policy was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`policyArn`	string	—	The Amazon Resource Name (ARN) of the policy.
`policyId`	string	—	The unique identifier for the policy.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The current status of the policy. Allowed: `CREATING, ACTIVE, UPDATING, DELETING, CREATE_FAILED, UPDATE_FAILED, DELETE_FAILED`
`statusReasons`	array<string>	—	Additional information about the policy status.
`updatedAt`	string	—	The timestamp when the policy was last updated.

BedrockAgentCorePolicyEngine # CLOUD CONTROL · AWS::BedrockAgentCore::PolicyEngine

BedrockAgentCorePolicyEngine manages AWS::BedrockAgentCore::PolicyEngine through the AWS Cloud Control API.

kubectl get bedrockagentcorepolicyengines · example on GitHub

Example

# BedrockAgentCorePolicyEngine — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcorepolicyengine
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCorePolicyEngine
metadata:
  name: example-bedrockagentcorepolicyengine
  namespace: default
spec:
  description: Managed by konfig-konector
  encryptionKeyArn: arn:aws:iam::123456789012:role/example-role
  name: example-bedrockagentcorepolicyengine
  providerRef:
    name: example-bedrockagentcorepolicyengine
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`description`	string	—	A human-readable description of the policy engine's purpose and scope
`encryptionKeyArn`	string	—	The ARN of the KMS key used to encrypt the policy engine data Create-only in AWS: changing it requires replacing the resource.
`name`	string	yes	The customer-assigned immutable name for the policy engine Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A list of tags to assign to the policy engine.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the policy engine was created Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`policyEngineArn`	string	—	The Amazon Resource Name (ARN) of the policy engine Read-only: reported by AWS after creation.
`policyEngineId`	string	—	The unique identifier for the policy engine Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The current status of the policy engine Read-only: reported by AWS after creation. Allowed: `CREATING, ACTIVE, UPDATING, DELETING, CREATE_FAILED, UPDATE_FAILED, DELETE_FAILED`
`statusReasons`	array<string>	—	Additional information about the policy engine status Read-only: reported by AWS after creation.
`updatedAt`	string	—	The timestamp when the policy engine was last updated Read-only: reported by AWS after creation.

BedrockAgentCoreResourcePolicy # CLOUD CONTROL · AWS::BedrockAgentCore::ResourcePolicy

BedrockAgentCoreResourcePolicy manages AWS::BedrockAgentCore::ResourcePolicy through the AWS Cloud Control API.

kubectl get bedrockagentcoreresourcepolicies · example on GitHub

Example

# BedrockAgentCoreResourcePolicy — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoreresourcepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreResourcePolicy
metadata:
  name: example-bedrockagentcoreresourcepolicy
  namespace: default
spec:
  policy: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource":
    "*"}]}'
  providerRef:
    name: example-bedrockagentcoreresourcepolicy
    region: us-east-1
  resourceArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`policy`	string	yes	The resource policy to create or update.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceArn`	string	yes	The Amazon Resource Name (ARN) of the resource for which to create or update the resource policy.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

BedrockAgentCoreRuntime # CLOUD CONTROL · AWS::BedrockAgentCore::Runtime

BedrockAgentCoreRuntime manages AWS::BedrockAgentCore::Runtime through the AWS Cloud Control API.

kubectl get bedrockagentcoreruntimes · example on GitHub

Example

# BedrockAgentCoreRuntime — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoreruntime
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreRuntime
metadata:
  name: example-bedrockagentcoreruntime
  namespace: default
spec:
  agentRuntimeArtifact:
    codeConfiguration:
      entryPoint:
      - example
      runtime: PYTHON_3_10
    containerConfiguration:
      containerUri: example
  agentRuntimeName: example-bedrockagentcoreruntime
  authorizerConfiguration:
    customJWTAuthorizer:
      allowedAudience:
      - example
      allowedClients:
      - example
      allowedScopes:
      - example
      allowedWorkloadConfiguration:
        hostingEnvironments:
        - name: example-hostingenvironments
        workloadIdentities:
        - example
      customClaims:
      - authorizingClaimMatchValue:
          claimMatchOperator: EQUALS
          claimMatchValue:
            matchValueString: example
            matchValueStringList:
            - example
        inboundTokenClaimName: example-bedrockagentcoreruntime
        inboundTokenClaimValueType: STRING
      discoveryUrl: example
      privateEndpointOverrides:
      - domain: example
  capacityProviderConfiguration:
    capacityProviderArn: arn:aws:iam::123456789012:role/example-role
  description: Managed by konfig-konector
  environmentVariables:
    key: value
  filesystemConfigurations:
  - capacityProviderVolume:
      mountPath: example
      volumeName: example-bedrockagentcoreruntime
    efsAccessPoint:
      accessPointArn: arn:aws:iam::123456789012:role/example-role
      mountPath: example
    s3FilesAccessPoint:
      accessPointArn: arn:aws:iam::123456789012:role/example-role
      mountPath: example
    sessionStorage:
      mountPath: example
  lifecycleConfiguration:
    idleRuntimeSessionTimeout: 60
    maxLifetime: 60
  networkConfiguration:
    networkMode: PUBLIC
    networkModeConfig:
      securityGroups:
      - example
      subnets:
      - example
  protocolConfiguration: MCP
  providerRef:
    name: example-bedrockagentcoreruntime
    region: us-east-1
  requestHeaderConfiguration:
    requestHeaderAllowlist:
    - example
  roleArn: arn:aws:iam::123456789012:role/example-role
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`agentRuntimeArtifact`	object	yes	The artifact of the agent
`agentRuntimeArtifact.codeConfiguration`	object	—	BedrockAgentCoreRuntimeCodeConfiguration is a nested property type of AWS::BedrockAgentCore::Runtime.
`agentRuntimeArtifact.codeConfiguration.code`	object	yes	BedrockAgentCoreRuntimeCode is a nested property type of AWS::BedrockAgentCore::Runtime.
`agentRuntimeArtifact.codeConfiguration.code.s3`	object	—	BedrockAgentCoreRuntimeS3Location is a nested property type of AWS::BedrockAgentCore::Runtime.
`agentRuntimeArtifact.codeConfiguration.code.s3.bucket`	string	yes	S3 bucket name
`agentRuntimeArtifact.codeConfiguration.code.s3.prefix`	string	yes	S3 object key prefix
`agentRuntimeArtifact.codeConfiguration.code.s3.versionId`	string	—	S3 object version ID
`agentRuntimeArtifact.codeConfiguration.entryPoint`	array<string>	yes
`agentRuntimeArtifact.codeConfiguration.runtime`	enum	yes	Allowed: `PYTHON_3_10, PYTHON_3_11, PYTHON_3_12, PYTHON_3_13, PYTHON_3_14, NODE_22`
`agentRuntimeArtifact.containerConfiguration`	object	—	BedrockAgentCoreRuntimeContainerConfiguration is a nested property type of AWS::BedrockAgentCore::Runtime.
`agentRuntimeArtifact.containerConfiguration.containerUri`	string	yes
`agentRuntimeName`	string	yes	Name for a resource Create-only in AWS: changing it requires replacing the resource.
`authorizerConfiguration`	object	—	Authorizer configuration for the agent runtime
`authorizerConfiguration.customJWTAuthorizer`	object	—	BedrockAgentCoreRuntimeCustomJWTAuthorizerConfiguration is a nested property type of AWS::BedrockAgentCore::Runtime.
`authorizerConfiguration.customJWTAuthorizer.allowedAudience`	array<string>	—
`authorizerConfiguration.customJWTAuthorizer.allowedClients`	array<string>	—
`authorizerConfiguration.customJWTAuthorizer.allowedScopes`	array<string>	—
`authorizerConfiguration.customJWTAuthorizer.allowedWorkloadConfiguration`	object	—	BedrockAgentCoreRuntimeAllowedWorkloadConfiguration is a nested property type of AWS::BedrockAgentCore::Runtime.
`authorizerConfiguration.customJWTAuthorizer.allowedWorkloadConfiguration.hostingEnvironments`	array<object>	—
`authorizerConfiguration.customJWTAuthorizer.allowedWorkloadConfiguration.hostingEnvironments[].arn`	string	yes	The ARN of the bedrock-agentcore hosting environment
`authorizerConfiguration.customJWTAuthorizer.allowedWorkloadConfiguration.workloadIdentities`	array<string>	—
`authorizerConfiguration.customJWTAuthorizer.customClaims`	array<object>	—
`authorizerConfiguration.customJWTAuthorizer.customClaims[].authorizingClaimMatchValue`	object	yes	BedrockAgentCoreRuntimeAuthorizingClaimMatchValueType is a nested property type of AWS::BedrockAgentCore::Runtime.
`authorizerConfiguration.customJWTAuthorizer.customClaims[].authorizingClaimMatchValue.claimMatchOperator`	enum	yes	Allowed: `EQUALS, CONTAINS, CONTAINS_ANY`
`authorizerConfiguration.customJWTAuthorizer.customClaims[].authorizingClaimMatchValue.claimMatchValue`	object	yes	BedrockAgentCoreRuntimeClaimMatchValueType is a nested property type of AWS::BedrockAgentCore::Runtime.
`authorizerConfiguration.customJWTAuthorizer.customClaims[].authorizingClaimMatchValue.claimMatchValue.matchValueString`	string	—
`authorizerConfiguration.customJWTAuthorizer.customClaims[].authorizingClaimMatchValue.claimMatchValue.matchValueStringList`	array<string>	—
`authorizerConfiguration.customJWTAuthorizer.customClaims[].inboundTokenClaimName`	string	yes
`authorizerConfiguration.customJWTAuthorizer.customClaims[].inboundTokenClaimValueType`	enum	yes	Allowed: `STRING, STRING_ARRAY`
`authorizerConfiguration.customJWTAuthorizer.discoveryUrl`	string	yes
`authorizerConfiguration.customJWTAuthorizer.privateEndpoint`	object	—
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides`	array<object>	—
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides[].domain`	string	yes	The domain to override
`authorizerConfiguration.customJWTAuthorizer.privateEndpointOverrides[].privateEndpoint`	object	yes
`capacityProviderConfiguration`	object	—	Capacity provider configuration for the agent runtime
`capacityProviderConfiguration.capacityProviderArn`	string	yes
`description`	string	—	Description of the resource
`environmentVariables`	map<string>	—	Environment variables for the agent runtime
`filesystemConfigurations`	array<object>	—	Filesystem configurations for the agent runtime
`filesystemConfigurations[].capacityProviderVolume`	object	—	BedrockAgentCoreRuntimeCapacityProviderVolumeConfiguration is a nested property type of AWS::BedrockAgentCore::Runtime.
`filesystemConfigurations[].capacityProviderVolume.mountPath`	string	yes
`filesystemConfigurations[].capacityProviderVolume.volumeName`	string	yes
`filesystemConfigurations[].efsAccessPoint`	object	—	BedrockAgentCoreRuntimeEfsAccessPointConfiguration is a nested property type of AWS::BedrockAgentCore::Runtime.
`filesystemConfigurations[].efsAccessPoint.accessPointArn`	string	yes
`filesystemConfigurations[].efsAccessPoint.mountPath`	string	yes
`filesystemConfigurations[].s3FilesAccessPoint`	object	—	BedrockAgentCoreRuntimeS3FilesAccessPointConfiguration is a nested property type of AWS::BedrockAgentCore::Runtime.
`filesystemConfigurations[].s3FilesAccessPoint.accessPointArn`	string	yes
`filesystemConfigurations[].s3FilesAccessPoint.mountPath`	string	yes
`filesystemConfigurations[].sessionStorage`	object	—	BedrockAgentCoreRuntimeSessionStorageConfiguration is a nested property type of AWS::BedrockAgentCore::Runtime.
`filesystemConfigurations[].sessionStorage.mountPath`	string	yes
`lifecycleConfiguration`	object	—	Lifecycle configuration for managing runtime sessions
`lifecycleConfiguration.idleRuntimeSessionTimeout`	integer	—	Timeout in seconds for idle runtime sessions
`lifecycleConfiguration.maxLifetime`	integer	—	Maximum lifetime in seconds for runtime sessions
`networkConfiguration`	object	—	Network access configuration for the Agent
`networkConfiguration.networkMode`	enum	yes	Allowed: `PUBLIC, VPC`
`networkConfiguration.networkModeConfig`	object	—	BedrockAgentCoreRuntimeVpcConfig is a nested property type of AWS::BedrockAgentCore::Runtime.
`networkConfiguration.networkModeConfig.securityGroups`	array<string>	yes
`networkConfiguration.networkModeConfig.subnets`	array<string>	yes
`protocolConfiguration`	enum	—	Protocol configuration for the agent runtime Allowed: `MCP, HTTP, A2A, AGUI`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`requestHeaderConfiguration`	object	—	Configuration for HTTP request headers
`requestHeaderConfiguration.requestHeaderAllowlist`	array<string>	—
`roleArn`	string	yes	Amazon Resource Name (ARN) of an IAM role
`tags`	map<string>	—

Status

Field	Type	Required	Description
`agentRuntimeArn`	string	—	The Amazon Resource Name(ARN) that uniquely identifies the Agent Read-only: reported by AWS after creation.
`agentRuntimeId`	string	—	Identifier for a resource Read-only: reported by AWS after creation.
`agentRuntimeVersion`	string	—	Version of the Agent Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Timestamp when the Agent was created Read-only: reported by AWS after creation.
`failureReason`	string	—	The reason for failure if the agent is in a failed state.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedAt`	string	—	When resource was last updated Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Current status of the agent Read-only: reported by AWS after creation. Allowed: `CREATING, CREATE_FAILED, UPDATING, UPDATE_FAILED, READY, DELETING`
`workloadIdentityDetails`	object	—	Workload identity details for the agent Read-only: reported by AWS after creation.
`workloadIdentityDetails.workloadIdentityArn`	string	yes

BedrockAgentCoreRuntimeEndpoint # CLOUD CONTROL · AWS::BedrockAgentCore::RuntimeEndpoint

BedrockAgentCoreRuntimeEndpoint manages AWS::BedrockAgentCore::RuntimeEndpoint through the AWS Cloud Control API.

kubectl get bedrockagentcoreruntimeendpoints · example on GitHub

Example

# BedrockAgentCoreRuntimeEndpoint — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoreruntimeendpoint
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreRuntimeEndpoint
metadata:
  name: example-bedrockagentcoreruntimeendpoint
  namespace: default
spec:
  agentRuntimeId: example-id
  agentRuntimeVersion: '1.0'
  description: Managed by konfig-konector
  name: example-bedrockagentcoreruntimeendpoint
  providerRef:
    name: example-bedrockagentcoreruntimeendpoint
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`agentRuntimeId`	string	yes	The ID of the parent Agent Runtime (required for creation) Create-only in AWS: changing it requires replacing the resource.
`agentRuntimeVersion`	string	—	The version of the AgentCore Runtime to use for the endpoint.
`description`	string	—	The description of the AgentCore Runtime endpoint.
`name`	string	yes	The name of the Agent Runtime Endpoint Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—

Status

Field	Type	Required	Description
`agentRuntimeArn`	string	—	The ARN of the Agent Runtime Read-only: reported by AWS after creation.
`agentRuntimeEndpointArn`	string	—	The Amazon Resource Name (ARN) of the AgentCore Runtime.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the Agent Runtime Endpoint was created Read-only: reported by AWS after creation.
`failureReason`	string	—	The reason for failure if the endpoint is in a failed state Read-only: reported by AWS after creation.
`id`	string	—	The unique identifier of the AgentCore Runtime endpoint.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedAt`	string	—	The timestamp when the Agent Runtime Endpoint was last updated Read-only: reported by AWS after creation.
`liveVersion`	string	—	The Live version of the Agent Runtime Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The status of the Agent Runtime Endpoint Read-only: reported by AWS after creation. Allowed: `CREATING, CREATE_FAILED, UPDATING, UPDATE_FAILED, READY, DELETING`
`targetVersion`	string	—	The target version of the AgentCore Runtime for the endpoint.

BedrockAgentCoreWorkloadIdentity # CLOUD CONTROL · AWS::BedrockAgentCore::WorkloadIdentity

BedrockAgentCoreWorkloadIdentity manages AWS::BedrockAgentCore::WorkloadIdentity through the AWS Cloud Control API.

kubectl get bedrockagentcoreworkloadidentities · example on GitHub

Example

# BedrockAgentCoreWorkloadIdentity — Bedrock AgentCore
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/bedrockagentcore.html#bedrockagentcoreworkloadidentity
apiVersion: aws.konfig.io/v1alpha1
kind: BedrockAgentCoreWorkloadIdentity
metadata:
  name: example-bedrockagentcoreworkloadidentity
  namespace: default
spec:
  allowedResourceOauth2ReturnUrls:
  - example
  name: example-bedrockagentcoreworkloadidentity
  providerRef:
    name: example-bedrockagentcoreworkloadidentity
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`allowedResourceOauth2ReturnUrls`	array<string>	—	The list of allowed OAuth2 return URLs for resources associated with this workload identity.
`name`	string	yes	The name of the workload identity.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdTime`	number	—	The timestamp when the workload identity was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedTime`	number	—	The timestamp when the workload identity was last updated.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`workloadIdentityArn`	string	—	The Amazon Resource Name (ARN) of the workload identity.