View a markdown version of this page

Comprendre les événements Amazon Bedrock AgentCore Gateway CloudTrail - Amazon Bedrock AgentCore
InvokeGateway événement de données avec erreur d'authentificationÉvénement InvokeGateway de données réussiÉvénement de gestion

Comprendre les événements Amazon Bedrock AgentCore Gateway CloudTrail

Un suivi est une configuration qui permet de transmettre des événements sous forme de fichiers journaux à un compartiment Amazon S3 que vous spécifiez. CloudTrail les fichiers journaux contiennent une ou plusieurs entrées de journal. Un événement représente une demande unique provenant de n'importe quelle source et inclut des informations telles que l'action demandée, la date et l'heure de l'action, ainsi que les paramètres de la demande.

Note

Le contenu des demandes et des réponses relatives aux événements liés aux données est expurgé, et les allégations relatives au jeton Web JSON (JWT) contiennent des entités HTML nettoyées pour des raisons de sécurité.

Note

Pour les événements de gestion, seuls les paramètres de demande définis par l'API Gateway sont éligibles à la rédaction. Tous les champs supplémentaires que vous incluez dans une demande et qui ne font pas partie de l'API sont enregistrés CloudTrail exactement tels que vous les avez envoyés et ne sont pas expurgés. N'incluez pas de mots de passe ou d'autres informations sensibles dans les champs qui ne font pas partie de l'API.

Les sections suivantes présentent des exemples d' CloudTrail événements :

InvokeGateway événement de données avec erreur d'authentification

L'exemple suivant montre une entrée de CloudTrail journal qui illustre l'InvokeGatewayaction comportant une erreur d'authentification. L'erreur d'authentification est visible dans le body champ duresponseElements.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AWSAccount",
    "principalId": "",
    "accountId": "anonymous"
  },
  "eventTime": "2025-07-14T02:14:42Z",
  "eventSource": "bedrock-agentcore.amazonaws.com",
  "eventName": "InvokeGateway",
  "awsRegion": "us-west-2",
  "sourceIPAddress": "34.XXX.XXX.206",
  "userAgent": "python-httpx/0.28.1",
  "requestParameters": {
    "body": {
      "id": 0,
      "method": "initialize",
      "params": {
        "clientInfo": {
          "name": "mcp",
          "version": "0.1.0"
        },
        "protocolVersion": "2025-06-18",
        "capabilities": {}
      },
      "jsonrpc": "2.0"
    }
  },
  "responseElements": {
    "body": {
      "jsonrpc": "2.0",
      "id": 0,
      "error": {
        "code": -32001,
        "message": "Invalid Bearer token"
      }
    },
    "contentType": "application/json",
    "statusCode": 401
  },
  "requestID": "1234abcd-12ab-34cd-56ef-1234567890ab",
  "eventID": "12345678-1234-5678-9abc-123456789012",
  "readOnly": false,
  "resources": [
    {
      "accountId": "XXXXXXXXXX",
      "type": "AWS::BedrockAgentCore::Gateway",
      "ARN": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXX:gateway/test-openapi-gateway-b24f8c26-u9p3rjw8qw"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "XXXXXXXXXX",
  "sharedEventID": "12345678-xxxx-xxxx-xxxx-123456789012",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.2",
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "test-openapi-gateway-xxxxxxx-u9p3rjw8qw.gateway.bedrock-agentcore.us-west-2.amazonaws.com"
  }
}

Événement InvokeGateway de données réussi

L'exemple suivant montre une entrée de CloudTrail journal indiquant une InvokeGateway action réussie :

{
      "eventVersion": "1.11",
      "userIdentity": {
        "type": "AWSAccount",
        "principalId": "",
        "accountId": "anonymous"
      },
      "eventTime": "2025-07-14T02:14:42Z",
      "eventSource": "bedrock-agentcore.amazonaws.com",
      "eventName": "InvokeGateway",
      "awsRegion": "us-west-2",
      "sourceIPAddress": "35.88.103.184",
      "userAgent": "python-httpx/0.28.1",
      "requestParameters": {
        "body": {
          "id": 1,
          "method": "tools/call",
          "params": {
            "name": "SmithyTarget___ListTables",
            "arguments": "REDACTED"
          },
          "jsonrpc": "2.0"
        }
      },
      "responseElements": {
        "body": {
          "jsonrpc": "2.0",
          "id": 1,
          "result": {
            "isError": false,
            "content": "REDACTED"
          }
        },
        "contentType": "application/json",
        "statusCode": 200
      },
      "additionalEventData": {
        "targetId": "0JTXXX4YMA",
        "jwt": {
          "headers": {
            "kid": "hGrcJwz5MX6hNeuL6jdXE4hjK7sT6oj+yN7kN+arRv4=",
            "alg": "RS256"
          },
          "claims": {
            "sub": "4ammgxxxxxxxxxxxm3b8c",
            "token_use": "access",
            "scope": "python-cognito-resource-server-id/write python-cognito-resource-server-id/read",
            "auth_time": 1752459276,
            "iss": "https://cognito-idp.us-west-2.amazonaws.com/us-west-2_Fxxxxxhtq",
            "exp": 1752462876,
            "iat": 1752459276,
            "version": 2,
            "jti": "1234abcd-12ab-34cd-56ef-1234567890ab"
          },
          "type": "JWS"
        },
        "downstreamRequestIds": [
          "H3RDH6T03DG10996U0M2P1V1IFVV4KQNSO5AEMVJF66Q9ASUAAJG"
        ]
      },
      "requestID": "1234abcd-12ab-34cd-56ef-1234567890ab",
      "eventID": "12345678-1234-5678-9abc-123456789012",
      "readOnly": false,
      "resources": [
        {
          "accountId": "XXXXXXXXXX",
          "type": "AWS::BedrockAgentCore::Gateway",
          "ARN": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXX:gateway/test-gateway-65129e91-mtzoadyihf"
        }
      ],
      "eventType": "AwsApiCall",
      "managementEvent": false,
      "recipientAccountId": "XXXXXXXXXX",
      "sharedEventID": "1234abcd-12ab-34cd-56ef-1234567890ab",
      "eventCategory": "Data",
      "tlsDetails": {
        "tlsVersion": "TLSv1.2",
        "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
        "clientProvidedHostHeader": "test-gateway-65129e91-xxxxxxxx.gateway.bedrock-agentcore.us-west-2.amazonaws.com"
      }
    }

Événement de gestion

L'exemple suivant montre une entrée de CloudTrail journal pour un événement de gestion :

{
  "eventVersion": "1.09",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROXXXXXXXXXXXXNRD7D:xxxxx",
    "arn": "arn:aws:sts::XXXXXXXXXXXX:assumed-role/HydraInvocationRole-xxxxxxxxx/xxxx",
    "accountId": "XXXXXXXXXXXX",
    "accessKeyId": "xxxxxxxxx",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "xxxxxxxx",
        "arn": "arn:aws:iam::XXXXXXXXXXXX:role/HydraInvocationRole-xxx",
        "accountId": "XXXXXXXXXXXX",
        "userName": "HydraInvocationRole-xxxxx"
      },
      "attributes": {
        "creationDate": "2025-07-14T02:42:43Z",
        "mfaAuthenticated": "false"
      }
    },
    "invokedBy": "bedrock-agentcore.amazonaws.com"
  },
  "eventTime": "2025-07-14T02:47:38Z",
  "eventSource": "bedrock-agentcore.amazonaws.com",
  "eventName": "CreateGateway",
  "awsRegion": "us-west-2",
  "sourceIPAddress": "bedrock-agentcore.amazonaws.com",
  "userAgent": "bedrock-agentcore.amazonaws.com",
  "requestParameters": {
    "roleArn": "arn:aws:iam::XXXXXXXXXXXX:role/PythonGenesisTestGatewayRole",
    "name": "***",
    "authorizerConfiguration": {
      "customJWTAuthorizer": {
        "allowedClients": [
          "xxxxxxxxx"
        ],
        "discoveryUrl": "https://cognito-idp.us-west-2.amazonaws.com/us-west-2_xxxxx/.well-known/openid-configuration"
      }
    },
    "description": "***",
    "protocolType": "MCP",
    "authorizerType": "CUSTOM_JWT"
  },
  "responseElements": {
    "authorizerConfiguration": {
      "customJWTAuthorizer": {
        "allowedClients": [
          "xxxxxxxxxxxxxxx"
        ],
        "discoveryUrl": "https://cognito-idp.us-west-2.amazonaws.com/us-west-2_xxxxxx/.well-known/openid-configuration"
      }
    },
    "description": "***",
    "protocolType": "MCP",
    "gatewayArn": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXXXX:gateway/test-openapi-gateway-xxxxxxx-xxxxxx",
    "workloadIdentityDetails": {
      "workloadIdentityArn": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXXXX:workload-identity-directory/default/workload-identity/test-openapi-gateway-xxxxxx-xxxxx"
    },
    "createdAt": "2025-07-14T02:47:38.302834063Z",
    "gatewayUrl": "https://test-openapi-gateway-xxxxxxx-8fb4mo6pqx.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp",
    "roleArn": "arn:aws:iam::XXXXXXXXXXXX:role/PythonGenesisTestGatewayRole",
    "name": "***",
    "authorizerType": "CUSTOM_JWT",
    "gatewayId": "test-openapi-gateway-9c8f7109-8fb4mo6pqx",
    "status": "CREATING",
    "updatedAt": "2025-07-14T02:47:38.302845797Z"
  },
  "requestID": "0fb99b0b-a4d1-xxxx-8aee-c703adaa6bd9",
  "eventID": "b12bf859-xxxx-48d7-952a-d5c6ec00fb68",
  "readOnly": false,
  "resources": [
    {
      "accountId": "XXXXXXXXXXXX",
      "type": "AWS::BedrockAgentCore::Gateway",
      "ARN": "arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXXXX:gateway/test-openapi-gateway-xxxxxxx-8fb4mo6pqx"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "XXXXXXXXXXXX",
  "eventCategory": "Management"
}