AWS Bedrock

Forge assumes a customer-owned cross-account IAM role to discover AI resources and workload metadata across selected AWS accounts and regions. Gateway inline policy also requires the generated Gateway operator role and interceptor resources in each account that contains a protected Gateway.

Coverage

Surface	Forge collects
Amazon Bedrock	Foundation models, Agents, versions, aliases, action groups, individual functions, collaborators, execution roles, knowledge bases, data sources, flows, prompts, and guardrails
Bedrock AgentCore	Runtimes and endpoints; MCP gateways, targets, and advertised tools; policies; identities and credential providers; memories; browsers; code interpreters; bundles; harnesses; evaluators; and payments
AWS Agent Registry	Registries and registry records through the GA Agent Registry control-plane API
Workloads	AI indicators on ECS, EKS, Lambda, EC2, ECR images, roles, tags, commands, and environment-variable names
Runtime	Bedrock model invocation logs, CloudWatch log metadata, CloudTrail events, and configured AgentCore receipts
Data context	Optional S3 bucket and object tags for exact `s3://bucket/key` references

Workload collection reads metadata and environment-variable names, not secret values.

Connection

Field	Requirement
Role ARN	Cross-account role that Forge assumes
OIDC trust	Must match Forge’s generated issuer, subject, and audience
Regions	Explicit regions to inventory and poll
Account scope	One account or the same role deployed into each selected account

The generated setup artifact grants explicit read actions for every collector; it does not grant wildcard Bedrock or AgentCore mutations. Equivalent custom policies should mirror the current List, Get, and Describe operations in the generated policy. bedrock-agentcore:InvokeGateway is separately scoped to gateway ARNs because MCP tools/list is a signed gateway invocation, not a control-plane read.

Feature-specific requirements

Do not treat one successful AWS API call as validation for every feature. Add only the permission group for the features you enable and use the generated artifacts as the source of truth for their current action list.

Feature	Required authority and evidence
Federation and OIDC	The AWS account must contain the generated OIDC provider and role trust with an exact issuer, audience, and subject. The saved account ID and Role ARN must identify that role, and every selected Region must be explicit. Forge uses `AssumeRoleWithWebIdentity`; an IAM user or long-lived access key is not a substitute.
Base cloud workload inventory	The inventory role needs `sts:GetCallerIdentity`, read-only IAM metadata, and the generated ECS, EKS, Lambda, EC2, ECR, API Gateway, CodeBuild, CloudFormation, Backup, Config, CloudWatch, and Logs reads. Global IAM evidence is account-scoped; regional workload APIs are collected only in selected Regions.
Bedrock and AgentCore inventory	Add the generated read actions in the `bedrock` and `bedrock-agentcore` namespaces. `bedrock-agentcore:InvokeGateway` is separately limited to gateway ARNs for signed MCP `tools/list` discovery. It is not general tool-execution authority.
AWS Agent Registry	The GA IAM namespace is `agent-registry:*`, and Forge calls `ListRegistries`, `GetRegistry`, and `ListRegistryRecords` through the `agent-registry-control` endpoint. The generated policy also grants `agent-registry:GetRegistryRecord` as part of the current read-only Registry permission group. Public-preview `bedrock-agentcore` registry actions remain in generated artifacts during AWS’s migration window; a successful or failed call to the public-preview AgentCore registry endpoint does not validate the GA Registry path.
NHI inventory	Add the generated IAM list/get reads, credential report, Access Advisor, identity-provider, and `cloudtrail:LookupEvents` permissions. Access Advisor completion is asynchronous. CloudTrail creator and role-use lookups are rate-limited and collected serially, so a complete run can take longer.
Identity rightsizing	Keep IAM and CloudTrail evidence reads on the inventory role. Use a distinct federated operator role for approved IAM changes and independent inventory-role readback. A verified inventory connection can start rightsizing collection even when an unrelated AWS family has partial coverage, but execution remains blocked unless rightsizing-specific usage, grant history, mutation, readback, and rollback evidence are complete.
JIT and Agent identity	Use a separate, organization-scoped federated Agent access operator, not the inventory or rightsizing role. It requires two distinct customer-managed boundaries in the same authority account: a workload boundary for Agent identity roles and an operator boundary attached to the operator role. The generated operator role and boundary carry the exact Forge organization tag, and managed Agent roles stay under `/forge/agent-identities/<organization-id>/`. Existing operator resources owned by another Forge organization are not modified. Agent credentials remain bounded by the active profile, integration ceiling, and native AWS STS lifetime.

Workload attribution additionally uses ecs:ListClusters, eks:ListClusters, lambda:ListFunctions, iam:GetRole, and iam:ListAttachedRolePolicies. Cloud artifact discovery and image acquisition use ecr:DescribeRepositories, ecr:ListImages, ecr:BatchGetImage, ecr:GetDownloadUrlForLayer, and ecr:GetAuthorizationToken. S3 data labels are optional and require s3:GetBucketTagging, s3:GetObjectTagging, s3:GetBucketLocation, and s3:ListAllMyBuckets. Restrict object-tag access to approved buckets when using a custom policy.

Setup

Open Integrations → Amazon Web Services, enter the regions, Role ARN, and account ID, then open Guided setup.
Deploy the generated OIDC provider, trust policy, and read-only role in every account in scope, then save its ARN and region list in Forge.
Select Test. Forge validates role assumption and the enabled service reads independently.
Select Sync and confirm account- and region-specific counts in Inventory.
Enable Bedrock model invocation logging separately if direct model-call telemetry is required.

Saving a new connection triggers its first inventory run. Manual Sync and the periodic scheduler use the same idempotent collector and persistence path. Coverage is recorded per region and resource family; an AgentCore denial does not discard successful Bedrock or AgentCore families from the same run. For an MCP AgentCore gateway, Forge stores the gateway as an MCP server, each gateway target as a connector, and each advertised tool separately with its description and input schema. Forge combines control-plane schemas with a SigV4-signed MCP tools/list response. A tool is related to a target only when AWS’s advertised name supplies an unambiguous target prefix; gateway helper tools remain gateway-scoped. Guided setup provides a CloudFormation stack. Review the OIDC issuer, subject, audience, account, regions, and optional S3 resources before applying it.

Operator access and artifact scanning

Native NHI containment, identity rightsizing, and Agent access use a separate operator or broker connection. The inventory role remains read-only. Guided setup generates the bounded trust, permission policy, validation, and offboarding artifacts for the selected purpose. See Non-human identities, Identity rightsizing, and Agent identities for the feature workflows. Saving an inventory connection does not enable IAM mutation or Agent credential issuance. ECR image scanning uses the registry permissions above. Filesystem snapshot scanning is opt-in and additionally requires an exact scanner AMI for every selected region plus the generated, tag-constrained EC2, EBS snapshot, instance-profile, network-interface, and cleanup permissions. See Cloud artifact scanning.

Runtime

Path	Result
Bedrock invocation logging	Detective prompt/model metadata after AWS delivers the log
Bedrock Agents `RETURN_CONTROL`	A customer runtime can call Forge before and after the tool operation
AgentCore Gateway MCP tool calls	Forge request and response interceptors can evaluate and rewrite tool traffic inline
Direct SDK call without logging or callback	Inventory only; no reviewable Forge session or inline decision

AgentCore Gateway inline policy

In Integrations → Amazon Web Services → Guided setup, copy and deploy the generated CloudFormation stack in the account that owns your AgentCore Gateways. For AWS Organizations, deploy the generated organization stack to the member accounts in scope. The stack creates the Gateway operator role, request and response interceptor Lambdas, a short-lived runtime credential store, and session state. You do not need to replace an existing Gateway or change its tool targets.
Save the AWS connection and run Sync. Forge discovers Gateways in the selected regions and attaches its two interceptors to eligible Gateways. Repeat Sync after adding a Gateway or region. The ordinary scheduler also reconciles new Gateways.
Check the Sync diagnostics and read the Gateway in AWS with aws bedrock-agentcore-control get-gateway --gateway-identifier <gateway-id> --region <region>. Protection requires both Forge interceptor ARNs in interceptorConfigurations and Gateway status READY. If either slot already contains a customer interceptor, Forge leaves it intact and reports observing coverage. That Gateway remains observe-only until its interceptors can be composed safely.
Call a low-risk MCP tool through the Gateway and confirm the Forge policy decision appears in Activity. Exercise a block policy and verify the target did not run. For redaction, inspect the content returned to the caller.

Forge evaluates MCP tools/call requests before target execution and responses before delivery:

Forge action	Gateway behavior
Allow or review	Let the call continue and record the decision.
Block	Stop the call before the target runs, or withhold a blocked response.
Redact or filter	Rewrite the selected arguments or response content. If Forge cannot produce an exact rewrite, block the call.
Nudge agent	Add policy guidance to the tool result returned to the agent. A request-stage nudge is carried into the result.
Nudge human	Record the decision for review; the Gateway has no human display channel.
Require approval	Block the current attempt and create a Forge review request. An approved session-scoped grant can authorize a retry; the Gateway cannot pause and resume an in-flight call.

Direct calls that bypass the Gateway are not protected by these interceptors. HTTP and inference target traffic is not covered by the MCP tool-call policy path. A response policy cannot undo side effects already performed by a tool. The older generated example that creates a new Lambda tool target is not part of Guided setup. It contains a sample tool implementation and does not protect the targets on your existing Gateway.

Verification

Check	Expected result
Assume role	The connection test identifies the intended AWS account
Inventory	Bedrock, AgentCore, and workload records appear for each selected region
Invocation logging	A low-cost canary produces a new provider evidence record after CloudWatch delivery
Inline handoff	A canary tool operation records a Forge decision before execution
S3 labels	A known tagged object resolves to the expected imported labels

If inventory is partial, inspect the per-account, per-region, and per-resource- family result rather than expanding the role globally. Healthy families remain usable and visible; a failed Agent Registry read does not erase successful Bedrock, workload, or NHI inventory. Partial inventory is not complete rightsizing evidence: each rightsizing dimension still has to pass its own usage, history, mutation, readback, and rollback checks.

Permission troubleshooting

Run validation through Test so the same OIDC assertion and AssumeRoleWithWebIdentity path used by scheduled sync is exercised. For supporting diagnosis, inspect the role trust and run the generated validation script in the target account; do not replace the Forge federation test with long-lived access keys.

Failed Forge read	Required access	Validation command and healthy result
Bedrock models	`bedrock:ListFoundationModels`	`aws bedrock list-foundation-models --region <region>` returns a list or healthy empty result
Bedrock agents	`bedrock:ListAgents`	`aws bedrock-agent list-agents --region <region> --max-items 1` returns without `AccessDenied`
AgentCore resource	The corresponding `bedrock-agentcore:List` or `Get` action	Run the exact AgentCore CLI/API operation named by the Forge blocker in its reported Region
Agent Registry	GA `agent-registry:ListRegistries`	`aws agent-registry-control list-registries --region <region> --max-items 1` calls the actual GA endpoint and returns a list or healthy empty result
Lambda workload	`lambda:ListFunctions`	`aws lambda list-functions --region <region> --max-items 1` succeeds
IAM role evidence	`iam:GetRole`, `iam:ListAttachedRolePolicies`	`aws iam get-role --role-name <known-role>` returns the expected account role
CloudTrail activity	`cloudtrail:LookupEvents`	`aws cloudtrail lookup-events --region <region> --max-items 1` succeeds for every Region required by the evidence window

AccessDenied includes the denied action and resource; add that action only at the intended account/resource scope. Verify identity and location before editing policy:

aws sts get-caller-identity
aws iam get-role --role-name <role-name>

The caller account must equal the saved account ID. The returned role ARN must match the saved Role ARN, including partition, path, and role name. Run the failed regional API in the Region shown by Forge; a healthy response in a different account or Region does not resolve the blocker. If agent-registry-control is not a recognized AWS CLI command, update AWS CLI before testing. Do not substitute the public-preview AgentCore registry command.

Simulation versus the actual endpoint

iam:SimulatePrincipalPolicy is useful supporting evidence, but an allowed simulation is not proof that the service endpoint will accept the request. Test with credentials for the exact assumed role and call the exact endpoint, action, account, Region, and resource ARN reported by Forge. If simulation allows the action but the real call returns 403, keep the real endpoint result as the blocker and check service control policies, permissions boundaries, session or resource policies, endpoint policy, service availability, and API namespace. For Agent Registry specifically, test agent-registry-control with an agent-registry:* read action; do not use the public-preview AgentCore registry endpoint as proof.

CloudTrail and IAM history

LookupEvents returns the past 90 days of management events for one account and one Region; it does not prove data-event coverage or retained history beyond that window. For recent diagnosis, query the exact action and Region, for example:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=PutRolePolicy \
  --region us-east-1 \
  --max-items 1

IAM is a global service, and AWS records its management events in the us-east-1 event history. Use the Region reported by Forge for regional service activity, but use us-east-1 when diagnosing IAM mutation history. Action-level usage requires the event classes for the permissions being evaluated, complete pagination, and exact attribution to the role session. Service-level Access Advisor timestamps are investigation evidence, not proof that an individual action was unused. Rightsizing also needs grant-lifetime evidence. Use continuous AWS Config history for the IAM resource when available, or complete successful IAM mutation history for the entire analysis window together with the current IAM snapshot. That history must cover every relevant create, delete, inline-policy, managed-policy attachment, trust-policy, group-membership, and access-key change for the target. A missing Region, page, selector, retention interval, or unmatched IAM mutation leaves that dimension partial and blocks an executable removal; Forge does not interpret missing history as inactivity. InvalidIdentityToken means AWS rejected the federated token before service permissions were evaluated. Re-run Guided setup: it verifies the exact OIDC provider ARN and issuer, adds the generated audience without removing other client IDs, and validates the role trust audience and subject. If that exact readback passes, check the provider thumbprints or issuer certificate-chain fallback and confirm that the system clock is correct.

Get started

Observe

Secure

Enable

Integrations

Resources

Coverage

Connection

Feature-specific requirements

Setup

Operator access and artifact scanning

Runtime

AgentCore Gateway inline policy

Verification

Permission troubleshooting

Simulation versus the actual endpoint

CloudTrail and IAM history

​Coverage

​Connection

​Feature-specific requirements

​Setup

​Operator access and artifact scanning

​Runtime

​AgentCore Gateway inline policy

​Verification

​Permission troubleshooting

​Simulation versus the actual endpoint

​CloudTrail and IAM history

Coverage

Connection

Feature-specific requirements

Setup

Operator access and artifact scanning

Runtime

AgentCore Gateway inline policy

Verification

Permission troubleshooting

Simulation versus the actual endpoint

CloudTrail and IAM history