AWS Bedrock

Forge assumes a customer-owned cross-account IAM role to discover AI resources and workload metadata across selected AWS accounts and regions. Runtime and enforcement coverage depend on which AWS control points you configure in addition to the inventory connection.

Coverage

Surface	Forge collects
Amazon Bedrock	Foundation models, inference profiles, model customization, Agents, aliases, action groups, and knowledge-base metadata
AgentCore	Runtimes, runtime endpoints, gateways, gateway targets, policy engines, policies, evaluators, memories, browsers, and code interpreters
Workloads	AI indicators on ECS, EKS, Lambda, EC2, ECR images, roles, tags, commands, and environment-variable names
Runtime	Bedrock model invocation logs, CloudWatch log metadata, CloudTrail events, and configured AgentCore receipts
Data context	Optional S3 bucket and object tags for exact `s3://bucket/key` references

Workload collection reads metadata and environment-variable names, not secret values.

Connection

Field	Requirement
Role ARN	Cross-account role that Forge assumes
External ID	Must match the role trust-policy condition
Regions	Explicit regions to inventory and poll
Account scope	One account or the same role deployed into each selected account

The generated setup artifact grants the current read paths used by Forge. Equivalent custom policies need:

bedrock:List*                    bedrock:Get*
bedrock-agentcore:List*          bedrock-agentcore:Get*
cloudwatch:GetMetricData         logs:Describe*
logs:FilterLogEvents             servicequotas:Get*
servicequotas:List*              sts:GetCallerIdentity
organizations:Describe*          organizations:List*

Workload attribution additionally uses ecs:ListClusters, eks:ListClusters, lambda:ListFunctions, iam:GetRole, and iam:ListAttachedRolePolicies. Cloud artifact discovery and image acquisition use ecr:DescribeRepositories, ecr:ListImages, ecr:BatchGetImage, ecr:GetDownloadUrlForLayer, and ecr:GetAuthorizationToken. S3 data labels are optional and require s3:GetBucketTagging, s3:GetObjectTagging, s3:GetBucketLocation, and s3:ListAllMyBuckets. Restrict object-tag access to approved buckets when using a custom policy.

Setup

Open Settings → Integrations → Amazon Web Services, enter the regions, Role ARN, and generated External ID, then open Guided setup.
Deploy the role in every account in scope, then save its ARN, external ID, and region list in Forge.
Select Test. Forge validates role assumption and the enabled service reads independently.
Select Sync and confirm account- and region-specific counts in Inventory.
Enable Bedrock model invocation logging separately if direct model-call telemetry is required.

Guided setup offers AWS CLI, Terraform, and CloudFormation. Review the trust policy principal, External ID, account, regions, and optional S3 resources before applying it. Enabling the optional runtime-logging checkbox creates a separate Bedrock invocation-logging role and log group; it does not change the Forge cross-account role into a write role.

Operator access and artifact scanning

Native NHI containment, identity rightsizing, and Agent access use a separate operator or broker connection. The inventory role remains read-only. Guided setup generates the bounded trust, permission policy, validation, and offboarding artifacts for the selected purpose. ECR image scanning uses the registry permissions above. Filesystem snapshot scanning is opt-in and additionally requires an exact scanner AMI for every selected region plus the generated, tag-constrained EC2, EBS snapshot, instance-profile, network-interface, and cleanup permissions. See Cloud artifact scanning.

Runtime

Path	Result
Bedrock invocation logging	Detective prompt/model metadata after AWS delivers the log
Bedrock Agents `RETURN_CONTROL`	A customer runtime can call Forge before and after the tool operation
AgentCore Gateway	Native Cedar policy can enforce directly; Forge policy requires a Forge gateway target, authorizer, or callback
Direct SDK call without logging or callback	Inventory only; no reviewable Forge session or inline decision

Forge provides validation and integration artifacts for signed Bedrock Agent invocation, RETURN_CONTROL, and AgentCore Gateway policy handoff.

Verification

Check	Expected result
Assume role	The connection test identifies the intended AWS account
Inventory	Bedrock, AgentCore, and workload records appear for each selected region
Invocation logging	A low-cost canary produces a new provider evidence record after CloudWatch delivery
Inline handoff	A canary tool operation records a Forge decision before execution
S3 labels	A known tagged object resolves to the expected imported labels

If inventory is partial, inspect the per-service permission result rather than expanding the role globally. A successful Bedrock read does not prove AgentCore, workload, log, or S3-tag access.

Get started

Observe

Secure

Enable

Integrations

Resources

Coverage

Connection

Setup

Operator access and artifact scanning

Runtime

Verification

​Coverage

​Connection

​Setup

​Operator access and artifact scanning

​Runtime

​Verification

Coverage

Connection

Setup

Operator access and artifact scanning

Runtime

Verification