Create a consent portal with the console

You can create a consent portal from the AgentCore console. Before you begin, complete the steps in Consent portal prerequisites. In particular, you need the following:

• An Amazon Bedrock AgentCore Gateway configured with the Use JSON Web Tokens (JWT) inbound authentication type.

• An OAuth2 credential provider for your OpenID Connect (OIDC) identity provider. For more information, see Manage credential providers with AgentCore Identity.

• An execution role, unless you let the console create one for you. For more information, see Consent portal execution role.

To create a consent portal

1. Open the AgentCore console.

2. From the left navigation pane, choose Gateways.

3. Choose the gateway that you configured as a prerequisite.

4. On the gateway details page, choose Create Consent Portal.

5. In the Consent portal details section, do the following:

   1. Select the Gateway to attach to the consent portal.

   2. (Optional) Change the generated consent portal name.

   3. (Optional) For Description, add a description for your consent portal.

6. In the IdP credential configurations section, do the following:

   1. Select the IdP credential provider that you created as a prerequisite.

   2. (Optional) Add additional Scopes.

   3. (Optional) Add additional Audiences.

7. In the Permissions section, choose one of the following options under IAM Permissions:

   1. To create a default role with the necessary permissions to access your consent portal, choose Create default role and, optionally, change the generated Role name.

   2. To use an existing service role, choose Use another service role and then select a role from the dropdown menu. Make sure that the service role that you choose has the necessary permissions. For more information, see Consent portal execution role.

      1. (Optional) Choose Edit role to add the necessary permissions to the selected role.

   3. To create a new role yourself, choose Use another service role and then choose Create new role.

8. Choose Create Portal.

9. Wait until the consent portal’s status is ACTIVE. When the portal becomes ACTIVE, the Consent portal URL appears on the consent portal details page. Note this URL, referred to as <portalUrl> in the following step.

10. On the IdP application that backs the credential provider you selected, register <portalUrl>/callback as an authorized callback (redirect) URL. Enter the value exactly, with no trailing slash — a trailing slash causes the IdP to reject the callback as unregistered during authentication. Different IdPs label this setting differently; for example, Amazon Cognito calls it Allowed callback URLs and Okta calls it Sign-in redirect URIs.

11. Confirm that the primary IdP has at least one active user that you can sign in as. For some IdPs the user must also be assigned to the application; for example, in Okta the user must be assigned under the application’s Assignments.

12. Open <portalUrl> in a browser and sign in with an existing IdP user’s credentials. A successful sign-in takes you to the consent portal page.

If the portal’s gateway has no targets configured, the consent portal page appears empty because there are no resources to grant consent to. To add a target so that a connection appears on the page, see Configure a consent portal target.