Set up OAuth 2.0 Client Credentials authentication for Salesforce

The Salesforce connector authenticates with OAuth 2.0 Client Credentials (2LO), which Salesforce calls the Client Credentials Flow. You register an External Client App and assign a dedicated Run-As integration user. The connector authenticates as the app and acts as that user, with no interactive sign-in; no Salesforce username, password, or security token is stored. Complete all the following steps in Salesforce before you configure the data source in Amazon Bedrock.

Note

Newer Salesforce orgs create these credentials under External Client App Manager, the successor to the classic Connected App. The steps below use that framework. The OAuth mechanics (the client_credentials grant, scopes, Run-As user, and Consumer Key and Secret) are the same either way.

Prerequisites

Before you begin, make sure that you have the following in Salesforce:

• Administrator access to the Salesforce org, with permission to create and manage External Client Apps.

• My Domain enabled, which is required for the Client Credentials Flow. Your instance URL looks like https://your-domain.my.salesforce.com.

• A dedicated integration user to assign as the Run-As user (least-privilege, non-interactive).

Step 1: Create the External Client App

1. In Setup, search for External Client App Manager (under Apps > External Client Apps), and then choose New External Client App.

2. Enter an External Client App Name, API Name, and Contact Email. Leave Distribution State as Local.

Step 2: Enable OAuth and add scopes

1. Expand API (Enable OAuth Settings) and select Enable OAuth.

2. Set a Callback URL. The Client Credentials Flow doesn't redirect, but the field is required. Enter any HTTPS URL that you control (for example, https://login.salesforce.com/services/oauth2/callback).

3. Under OAuth Scopes, add Manage user data via APIs (api). This is the scope the Knowledge article crawl uses.

Step 3: Enable the Client Credentials Flow

1. Under Flow Enablement, select Enable Client Credentials Flow and accept the confirmation dialog.

2. Choose Save and Continue.

Step 4: Assign the Run-As user

The Client Credentials Flow runs as a specific user, and that user's permissions govern what the connector can read.

1. On the app's Policies tab, choose Edit.

2. Expand OAuth Policies > OAuth Flows and External Client App Enhancements, and ensure that Enable Client Credentials Flow is selected.

3. Set the Run As lookup to your integration user, and then choose Save.

Note

Least privilege: The Run-As user needs read access to the Knowledge articles (and their data categories) that you intend to crawl. Use a dedicated integration user for this connector only, never for interactive UI logins.

Step 5: Retrieve the Consumer Key and Secret

1. On the app's Settings tab, expand OAuth Settings and open Consumer Key and Secret (identity verification may be prompted).

2. These values become the clientId (Consumer Key) and clientSecret (Consumer Secret) in your secret.

Step 6: Create the Secrets Manager secret

Store the credentials in an AWS Secrets Manager secret in the same AWS Region as your knowledge base with the following key-value pairs:

{
    "clientId": "your-consumer-key",
    "clientSecret": "your-consumer-secret",
    "instanceUrl": "https://your-domain.my.salesforce.com"
}

Secret fields

Field	Description
clientId	The External Client App's Consumer Key, used to request the OAuth token.
clientSecret	The External Client App's Consumer Secret.
instanceUrl	Your org's My Domain base URL (include https://, no trailing slash). The token endpoint is {instanceUrl}/services/oauth2/token, and it is also the API base for the crawl. This value must match the connection hostUrl.

Create the secret with the AWS Command Line Interface:

aws secretsmanager create-secret \
  --name bedrock-salesforce-creds \
  --secret-string file://secret.json

Record the secret ARN from the response. You use it as the data source secretArn. The knowledge base execution role must have secretsmanager:GetSecretValue permission on the secret.

Next steps

After you store the secret, create the data source. See Connect a Salesforce data source.