> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Bedrock

> Connect Bedrock, AgentCore, AWS workload inventory, and runtime evidence.

Forge assumes a customer-owned cross-account IAM role to discover AI resources
and workload metadata across selected AWS accounts and regions. Runtime and
enforcement coverage depend on which AWS control points you configure in
addition to the inventory connection.

## Coverage

| Surface        | Forge collects                                                                                                                          |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| Amazon Bedrock | Foundation models, inference profiles, model customization, Agents, aliases, action groups, and knowledge-base metadata                 |
| AgentCore      | Runtimes, runtime endpoints, gateways, gateway targets, policy engines, policies, evaluators, memories, browsers, and code interpreters |
| Workloads      | AI indicators on ECS, EKS, Lambda, EC2, ECR images, roles, tags, commands, and environment-variable names                               |
| Runtime        | Bedrock model invocation logs, CloudWatch log metadata, CloudTrail events, and configured AgentCore receipts                            |
| Data context   | Optional S3 bucket and object tags for exact `s3://bucket/key` references                                                               |

Workload collection reads metadata and environment-variable names, not secret
values.

## Connection

| Field         | Requirement                                                      |
| ------------- | ---------------------------------------------------------------- |
| Role ARN      | Cross-account role that Forge assumes                            |
| External ID   | Must match the role trust-policy condition                       |
| Regions       | Explicit regions to inventory and poll                           |
| Account scope | One account or the same role deployed into each selected account |

The generated setup artifact grants the current read paths used by Forge.
Equivalent custom policies need:

```text theme={"system"}
bedrock:List*                    bedrock:Get*
bedrock-agentcore:List*          bedrock-agentcore:Get*
cloudwatch:GetMetricData         logs:Describe*
logs:FilterLogEvents             servicequotas:Get*
servicequotas:List*              sts:GetCallerIdentity
organizations:Describe*          organizations:List*
```

Workload attribution additionally uses `ecs:ListClusters`,
`eks:ListClusters`, `lambda:ListFunctions`, `iam:GetRole`, and
`iam:ListAttachedRolePolicies`. Cloud artifact discovery and image acquisition
use `ecr:DescribeRepositories`, `ecr:ListImages`, `ecr:BatchGetImage`,
`ecr:GetDownloadUrlForLayer`, and `ecr:GetAuthorizationToken`.

S3 data labels are optional and require `s3:GetBucketTagging`,
`s3:GetObjectTagging`, `s3:GetBucketLocation`, and `s3:ListAllMyBuckets`.
Restrict object-tag access to approved buckets when using a custom policy.

## Setup

1. Open **Settings → Integrations → Amazon Web Services**, enter the regions,
   Role ARN, and generated External ID, then open **Guided setup**.
2. Deploy the role in every account in scope, then save its ARN, external ID,
   and region list in Forge.
3. Select **Test**. Forge validates role assumption and the enabled service
   reads independently.
4. Select **Sync** and confirm account- and region-specific counts in
   **Inventory**.
5. Enable Bedrock model invocation logging separately if direct model-call
   telemetry is required.

Guided setup offers AWS CLI, Terraform, and CloudFormation. Review the trust
policy principal, External ID, account, regions, and optional S3 resources
before applying it. Enabling the optional runtime-logging checkbox creates a
separate Bedrock invocation-logging role and log group; it does not change the
Forge cross-account role into a write role.

## Operator access and artifact scanning

Native NHI containment, identity rightsizing, and Agent access use a separate
operator or broker connection. The inventory role remains read-only. Guided
setup generates the bounded trust, permission policy, validation, and
offboarding artifacts for the selected purpose.

ECR image scanning uses the registry permissions above. Filesystem snapshot
scanning is opt-in and additionally requires an exact scanner AMI for every
selected region plus the generated, tag-constrained EC2, EBS snapshot,
instance-profile, network-interface, and cleanup permissions. See
[Cloud artifact scanning](/observe/cloud-artifact-scanning).

## Runtime

| Path                                        | Result                                                                                                          |
| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| Bedrock invocation logging                  | Detective prompt/model metadata after AWS delivers the log                                                      |
| Bedrock Agents `RETURN_CONTROL`             | A customer runtime can call Forge before and after the tool operation                                           |
| AgentCore Gateway                           | Native Cedar policy can enforce directly; Forge policy requires a Forge gateway target, authorizer, or callback |
| Direct SDK call without logging or callback | Inventory only; no reviewable Forge session or inline decision                                                  |

Forge provides validation and integration artifacts for signed Bedrock Agent
invocation, `RETURN_CONTROL`, and AgentCore Gateway policy handoff.

## Verification

| Check              | Expected result                                                                     |
| ------------------ | ----------------------------------------------------------------------------------- |
| Assume role        | The connection test identifies the intended AWS account                             |
| Inventory          | Bedrock, AgentCore, and workload records appear for each selected region            |
| Invocation logging | A low-cost canary produces a new provider evidence record after CloudWatch delivery |
| Inline handoff     | A canary tool operation records a Forge decision before execution                   |
| S3 labels          | A known tagged object resolves to the expected imported labels                      |

If inventory is partial, inspect the per-service permission result rather than
expanding the role globally. A successful Bedrock read does not prove
AgentCore, workload, log, or S3-tag access.