# AWS Bedrock AgentCore Attributes

Schema attributes for resources in the **AWS Bedrock AgentCore** dataset.

## AWS Bedrock AgentCore Runtime Endpoint

**Resource ID**: `aws:agentcore-runtime-endpoint`

**Resource type**: `std:agent`

**Identity attribute**: `agentRuntimeEndpointArn`

**Display attribute**: `endpointName`

**Features**: `ACTIVATE, DEACTIVATE`

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | The agent runtime endpoint ARN. |
| `disabled` | boolean | Whether the agent runtime endpoint is disabled. |
| `agentRuntimeEndpointArn` | string | Endpoint ARN. |
| `agentRuntimeArn` | string | Base agent runtime ARN. |
| `endpointId` | string | Endpoint ID. |
| `endpointName` | string | Endpoint name. |
| `endpointDescription` | string | Description. |
| `endpointStatus` | string | Endpoint status. |
| `liveVersion` | string | The version of the runtime currently live. |
| `targetVersion` | string | The version targeted for deployment. |
| `endpointCreatedAt` | string | Creation time. |
| `endpointLastUpdatedAt` | string | Last update time. |
| `agentRuntimeVersion` | string | Agent runtime version. |
| `agentRuntimeId` | string | Agent runtime ID. |
| `agentRuntimeName` | string | Agent runtime name. |
| `runtimeDescription` | string | Runtime description. |
| `runtimeStatus` | string | Runtime agent status. |
| `runtimeLastUpdatedAt` | string | Runtime last update time. |
| `tags` | string | The tags applied to the AWS Bedrock AgentCore Runtime Endpoint. |
| `spStatus` | string | SailPoint-normalized runtime endpoint status. |
| `spDescription` | string | Description sourced from the endpoint or runtime version (first non-null). |
| `awsRegion` | string | AWS region where the runtime endpoint resides. |
| `awsAccountId` | string | AWS account ID where the runtime endpoint resides. |
| `spBusinessApplication` | string | SailPoint business application of the runtime endpoint. Always AWS Bedrock AgentCore. |

## AWS Bedrock AgentCore Gateway

**Resource ID**: `aws:agentcore-gateway`

**Resource type**: `std:application`

**Identity attribute**: `gatewayArn`

**Display attribute**: `name`

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | The gateway ARN. |
| `gatewayArn` | string | The gateway ARN. |
| `gatewayId` | string | The gateway ID. |
| `name` | string | The gateway name. |
| `description` | string | The gateway description. |
| `gatewayUrl` | string | The resolvable URL for the gateway. |
| `roleArn` | string | The IAM role ARN used by the gateway. |
| `authorizerType` | string | The authorizer configuration type. |
| `authorizerDiscoveryUrl` | string | The extracted discovery URL for the authorizer. |
| `policyEngineArn` | string | The policy engine ARN applied to the gateway. |
| `protocolType` | string | The API protocol type. |
| `exceptionLevel` | string | The exception tracking/error level. |
| `kmsKeyArn` | string | The KMS key ARN used for encryption. |
| `gatewayStatus` | string | Gateway status. |
| `createdAt` | string | Creation time. |
| `updatedAt` | string | Last update time. |
| `workloadIdentityArn` | string | The associated workload identity ARN. |
| `tags` | string | The tags applied to the gateway. |
| `spStatus` | string | SailPoint-normalized gateway status. |
| `spDescription` | string | Gateway description (mirrors description field). |
| `awsRegion` | string | AWS region where the gateway resides. |
| `awsAccountId` | string | AWS account ID where the gateway resides. |
| `spBusinessApplication` | string | SailPoint business application of the gateway. Always AWS Bedrock AgentCore. |

## AWS Bedrock AgentCore Gateway Target

**Resource ID**: `aws:agentcore-target`

**Resource type**: `std:capability`

**Identity attribute**: `targetArn`

**Display attribute**: `name`

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | The gateway target ARN. |
| `targetArn` | string | The target ARN. |
| `name` | string | Target name. |
| `description` | string | Target description. |
| `gatewayArn` | string | The ARN of the gateway this target belongs to. |
| `targetId` | string | Target ID. |
| `targetStatus` | string | Target status. |
| `createdAt` | string | Creation time. |
| `updatedAt` | string | Last update time. |
| `lastSynchronizedAt` | string | Time the target was last synchronized. |
| `type` | string | Type. |
| `mcpTargetType` | string | Derived MCP target type. |
| `spStatus` | string | SailPoint-normalized target status. |
| `spDescription` | string | Target description (mirrors description field). |
| `awsRegion` | string | AWS region where the gateway target resides. |
| `awsAccountId` | string | AWS account ID where the gateway target resides. |
| `spBusinessApplication` | string | SailPoint business application of the target. Always AWS Bedrock AgentCore. |

## AWS Bedrock AgentCore Credential Provider

**Resource ID**: `aws:agentcore-credential-provider`

**Resource type**: `std:credential`

**Identity attribute**: `credentialProviderArn`

**Display attribute**: `name`

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | The credential provider ARN. |
| `credentialProviderArn` | string | Credential provider ARN. |
| `name` | string | Name of the provider. |
| `apiKeySecretArn` | string | The ARN to the API key Secrets Manager secret. |
| `callbackUrl` | string | OAuth callback URL. |
| `credentialProviderVendor` | string | Provider vendor identity. |
| `clientSecretArn` | string | Secret ARN containing the OAuth client secret. |
| `createdTime` | string | Creation time. |
| `lastUpdatedTime` | string | Last update time. |
| `tags` | string | The tags applied to the credential provider. |
| `awsRegion` | string | AWS region where the credential provider resides. |
| `awsAccountId` | string | AWS account ID where the credential provider resides. |
| `spBusinessApplication` | string | SailPoint business application of the credential provider. Always AWS Bedrock AgentCore. |

## AWS Bedrock AgentCore Inbound Access Config

**Resource ID**: `aws:agentcore-inbound-access-config`

**Resource type**: `std:credential`

**Identity attribute**: `agentRuntimeArn`

**Display attribute**: `agentRuntimeName`

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | The inbound access config identity. |
| `agentRuntimeArn` | string | ARN of the agent runtime. |
| `agentRuntimeName` | string | Name of the agent runtime. |
| `authorizerDiscoveryUrl` | string | The extracted discovery URL for the authorizer. |
| `allowedAudience` | array | Allowed audience. |
| `allowedClients` | array | Allowed clients. |
| `allowedScopes` | array | Allowed scopes. |
| `tags` | string | The tags applied to the inbound access config. |
| `awsRegion` | string | AWS region where the inbound access config resides. |
| `awsAccountId` | string | AWS account ID where the inbound access config resides. |
| `spBusinessApplication` | string | SailPoint business application of the inbound access config. Always AWS Bedrock AgentCore. |

## AWS Bedrock AgentCore Workload Identity

**Resource ID**: `aws:agentcore-workload-identity`

**Resource type**: `std:account`

**Identity attribute**: `workloadIdentityArn`

**Display attribute**: `name`

**Classification**: `machine`

| Attribute | Type | Description |
| --- | --- | --- |
| `classification` | string | The classification of the account (for example, machine). |
| `identity` | string | The workload identity ARN. |
| `workloadIdentityArn` | string | The workload identity ARN. |
| `name` | string | Name of the workload identity. |
| `createdTime` | string | Creation time. |
| `lastUpdatedTime` | string | Last update time. |
| `tags` | string | The tags applied to the workload identity. |
| `awsRegion` | string | AWS region where the workload identity resides. |
| `awsAccountId` | string | AWS account ID where the workload identity resides. |
| `spBusinessApplication` | string | SailPoint business application of the workload identity. Always AWS Bedrock AgentCore. |

## AWS AgentCore Agent Uses Role

**Resource ID**: `aws:agentcore-agent-uses-role`

**Resource type**: `std:access`

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Unique identifier of the form aws:agentcore-agent-uses-role\#{Agent Alias ARN}\#{Role ARN}. |

## AWS AgentCore Agent Has Workload Identity

**Resource ID**: `aws:agentcore-agent-has-workload-identity`

**Resource type**: `std:extends`

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Unique identifier of the form aws:agentcore-agent-has-workload-identity\#{Agent Runtime Endpoint ARN}\#{Workload Identity ARN}. |

## AWS AgentCore Application Has Workload Identity

**Resource ID**: `aws:agentcore-application-has-workload-identity`

**Resource type**: `std:extends`

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Unique identifier of the form aws:agentcore-application-has-workload-identity\#{Gateway ARN}\#{Workload Identity ARN}. |
| `awsRegion` | string | AWS region associated with the link. |

## AWS AgentCore Agent Has Inbound Access

**Resource ID**: `aws:agentcore-agent-has-inbound-access`

**Resource type**: `std:access`

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Unique identifier of the form aws:agentcore-agent-has-inbound-access\#{Agent Runtime Endpoint ARN}\#{Agent Runtime ARN}/InboundAccess. |
| `awsRegion` | string | AWS region associated with the link. |

## AWS AgentCore Capability Uses Credential

**Resource ID**: `aws:agentcore-capability-uses-credential`

**Resource type**: `std:access`

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Unique identifier of the form aws:agentcore-capability-uses-credential\#{Gateway Target ARN}\#{Credential Provider ARN}. |

## AWS AgentCore Application Has Capability

**Resource ID**: `aws:agentcore-application-has-capability`

**Resource type**: `std:access`

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Unique identifier of the form aws:agentcore-application-has-capability\#{Gateway ARN}\#{Gateway Target ARN}. |