用于 AgentCore 支付的 IAM 角色
角色摘要
AgentCore payments 使用四角色的 IAM 模型，将管理、管理、代理执行和服务操作分开。根据与您的角色相匹配的角色设置 IAM 权限。
| 角色 | 用途 |
|---|---|
|
管理员 (ControlPlaneRole) |
管理支付管理器、连接器和凭证提供商 |
|
代理开发者 (ManagementRole) |
管理支付工具和会话，无法执行付款 |
|
付款执行 (ProcessPaymentRole) |
代表代理执行付款交易 |
|
服务角色 (ResourceRetrievalRole) |
假设在运行时为检索凭证而 AgentCore 付款 |
提示
您可以使用 AWS 代理工具包中的 “ AgentCore 付款” 技能自动执行此页面上的步骤。该技能是 aws- agents 插件的一部分，它允许 AI 编码代理使用 CL agentcore I 创建您的支付管理器、连接器、凭证提供商、支付工具和会话，并向您的代理添加 x402 支付工具。有关详细信息，请参阅上的快速入门和AWS 代理工具包。 GitHub
为什么角色分离很重要
将支付管理与支付执行分开，可以防止单个被泄露的身份既创建预算不受限制的会话，又可以针对这些会话执行付款。管理角色DenyProcessPayment的明确开启和执行角色的狭窄范围强化了这一界限。这也确保了审计追踪可以清楚地区分谁配置了支付资源和谁执行了交易。
管理员权限 (ControlPlaneRole)
对于管理付款管理器、连接器和凭证提供商的管理员：
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPaymentManagerOperations", "Effect": "Allow", "Action": [ "bedrock-agentcore:CreatePaymentManager", "bedrock-agentcore:GetPaymentManager", "bedrock-agentcore:ListPaymentManagers", "bedrock-agentcore:DeletePaymentManager", "bedrock-agentcore:UpdatePaymentManager" ], "Resource": [ "arn:aws:bedrock-agentcore:*:111122223333:payment-manager/*" ] }, { "Sid": "AllowPaymentConnectorOperations", "Effect": "Allow", "Action": [ "bedrock-agentcore:CreatePaymentConnector", "bedrock-agentcore:GetPaymentConnector", "bedrock-agentcore:ListPaymentConnectors", "bedrock-agentcore:DeletePaymentConnector", "bedrock-agentcore:UpdatePaymentConnector" ], "Resource": [ "arn:aws:bedrock-agentcore:*:111122223333:payment-manager/*/connector/*" ] }, { "Sid": "AllowCredentialProviderOperations", "Effect": "Allow", "Action": [ "bedrock-agentcore:CreatePaymentCredentialProvider", "bedrock-agentcore:GetPaymentCredentialProvider", "bedrock-agentcore:ListPaymentCredentialProviders", "bedrock-agentcore:DeletePaymentCredentialProvider", "bedrock-agentcore:UpdatePaymentCredentialProvider" ], "Resource": [ "arn:aws:bedrock-agentcore:*:111122223333:token-vault/*/paymentcredentialprovider/*" ] }, { "Sid": "AllowVendedLogDelivery", "Effect": "Allow", "Action": [ "bedrock-agentcore:AllowVendedLogDeliveryForResource" ], "Resource": [ "arn:aws:bedrock-agentcore:*:111122223333:payment-manager/*" ] }, { "Sid": "AllowPassResourceRetrievalRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::111122223333:role/AgentCorePaymentsResourceRetrievalRole", "Condition": { "StringEquals": { "iam:PassedToService": "bedrock-agentcore.amazonaws.com" } } } ] }
代理开发者权限 (ManagementRole)
对于管理支付工具和会话但不直接执行付款的在 deterministic/human环 (HITL) 代码：
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPaymentManagement", "Effect": "Allow", "Action": [ "bedrock-agentcore:CreatePaymentInstrument", "bedrock-agentcore:GetPaymentInstrument", "bedrock-agentcore:ListPaymentInstruments", "bedrock-agentcore:DeletePaymentInstrument", "bedrock-agentcore:CreatePaymentSession", "bedrock-agentcore:GetPaymentSession", "bedrock-agentcore:ListPaymentSessions", "bedrock-agentcore:DeletePaymentSession" ], "Resource": [ "arn:aws:bedrock-agentcore:*:111122223333:payment-manager/*/instrument/*", "arn:aws:bedrock-agentcore:*:111122223333:payment-manager/*/session/*" ] }, { "Sid": "DenyProcessPayment", "Effect": "Deny", "Action": "bedrock-agentcore:ProcessPayment", "Resource": "*" } ] }
注意
该政策明确ProcessPayment拒绝在管理业务和支付执行之间实行职责分离。这样可以确保只有确定性的代码路径才能设置控制平面操作，而代理执行只能在不覆盖预算或创建支付工具来解决这个问题的情况下处理付款。
付款执行权限 (ProcessPaymentRole)
对于代表代理执行支付交易的确定性代码路径：
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowProcessPayment", "Effect": "Allow", "Action": "bedrock-agentcore:ProcessPayment", "Resource": [ "arn:aws:bedrock-agentcore:*:111122223333:payment-manager/*/session/*" ] }, { "Sid": "AllowPaymentReadOperations", "Effect": "Allow", "Action": [ "bedrock-agentcore:GetPaymentInstrument", "bedrock-agentcore:GetPaymentInstrumentBalance", "bedrock-agentcore:GetPaymentSession" ], "Resource": [ "arn:aws:bedrock-agentcore:*:111122223333:payment-manager/*/instrument/*", "arn:aws:bedrock-agentcore:*:111122223333:payment-manager/*/session/*" ] } ] }
重要
请勿将 PaymentSession 写入权限（例如CreatePaymentSession）和ProcessPayment角色相同，否则来电者可以通过创建预算较高的新会话来绕过付款限制。
服务角色权限 (ResourceRetrievalRole)
以下服务角色由运行时 AgentCore 付款担任，用于检索凭证和管理工作负载身份。它未分配给人类用户。
信任策略
服务角色必须信任bedrock-agentcore.amazonaws.com服务主体。以下信任政策限制了对特定账户和付款管理器的访问权限：
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "bedrock-agentcore.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "<account>" }, "ArnLike": { "aws:SourceArn": "arn:aws:bedrock-agentcore:<region>:<account>:payment-manager/<payment-manager-name>-*" } } } ] }
基本权限（在创建付款管理器时附加）
创建付款管理器时，会将以下权限附加到该服务角色。它们授予付款管理器访问工作负载身份和支付令牌操作的权限：
{ "Version": "2012-10-17", "Statement": [ { "Sid": "WorkloadIdentityManagement", "Effect": "Allow", "Action": [ "bedrock-agentcore:CreateWorkloadIdentity", "bedrock-agentcore:DeleteWorkloadIdentity" ], "Resource": [ "arn:aws:bedrock-agentcore:<region>:<account>:workload-identity-directory/default", "arn:aws:bedrock-agentcore:<region>:<account>:workload-identity-directory/default/workload-identity/*" ] }, { "Sid": "WorkloadIdentityAccess", "Effect": "Allow", "Action": [ "bedrock-agentcore:GetWorkloadAccessToken" ], "Resource": [ "arn:aws:bedrock-agentcore:<region>:<account>:workload-identity-directory/default", "arn:aws:bedrock-agentcore:<region>:<account>:workload-identity-directory/default/workload-identity/<payment-manager-name>-*" ] }, { "Sid": "PaymentTokenBaseAccess", "Effect": "Allow", "Action": [ "bedrock-agentcore:GetResourcePaymentToken" ], "Resource": [ "arn:aws:bedrock-agentcore:<region>:<account>:token-vault/default", "arn:aws:bedrock-agentcore:<region>:<account>:workload-identity-directory/default", "arn:aws:bedrock-agentcore:<region>:<account>:workload-identity-directory/default/workload-identity/<payment-manager-name>-*" ] } ] }
Per-connector 权限
每次向付款管理器添加付款连接器时，服务角色都会附加以下权限。它们允许访问特定的支付凭证提供商及其支持机密：
{ "Version": "2012-10-17", "Statement": [ { "Sid": "PaymentTokenAccess", "Effect": "Allow", "Action": [ "bedrock-agentcore:GetResourcePaymentToken" ], "Resource": [ "<payment-credential-provider-arn>" ] }, { "Sid": "SecretsManagerAccess", "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": [ "<secret-arns>" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "<account>" } } } ] }
使用现有角色
如果您选择使用现有的服务角色而不是创建新的服务角色，请确保该角色具有：
-
上面显示的信任策略，以可信委托人
bedrock-agentcore.amazonaws.com为准。 -
工作负载身份和付款令牌访问的基本权限。
-
Per-connector 付款管理器的连接器引用的每个付款凭证提供商的权限。
注意
管理员、代理开发者和付款执行角色使用允许arn:aws:iam::111122223333:root他们担任的标准账户信任策略。
有关 IAM 策略的示例，请参阅 A mazon Bedrock AgentCore 的身份和访问管理。
