PingOne Advanced Identity Cloud

AWS Bedrock

The AWS Bedrock application automatically discovers the AI agents you have hosted in AWS Bedrock. Once discovered, the platform gives you complete visibility into their core components:

  • Capabilities: Associated tools, knowledge bases, and guardrails.

  • Security and access: Execution credentials and IAM-based identity bindings.

The application combines identity creation and governance using separate reconciliation processes. A reconciliation on the Account provisioner object type creates and updates agent identities, and a reconciliation on the Agent Tool provisioner object type updates agent tools and entitlements.

Prerequisites in Advanced Identity Cloud

Before using the AWS Bedrock application, ensure you’ve taken these actions:

  • Purchased the Agent Governance add-on capability for Advanced Identity Cloud.

  • Modified the user managed object with a custom_iga_identity_type property in the Alpha realm. Learn more in Create the identity type.

  • Obtained the AWS Bedrock connector JAR file. This isn’t available to download from Backstage yet, but is available from your Ping Identity representative.

Prerequisites in AWS Bedrock

Create an IAM access policy

The AWS Bedrock application needs read permissions for Bedrock and an S3 inventory bucket.

  1. In the AWS console, go to IAM > Policies > Create policy.

  2. On the JSON tab, paste a policy similar to the following:

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadBedrockAgents",
      "Effect": "Allow",
      "Action": [ (1)
        "bedrock:ListAgents",
        "bedrock:GetAgent",
        "bedrock:ListAgentAliases",
        "bedrock:GetAgentAlias",
        "bedrock:ListAgentActionGroups",
        "bedrock:GetAgentActionGroup",
        "bedrock:ListAgentKnowledgeBases",
        "bedrock:ListAgentCollaborators",
        "bedrock:GetGuardrail"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ReadBedrockInventoryArtifacts",
      "Effect": "Allow",
      "Action": [ (1)
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::<inventory-bucket>/latest/*" (2)
    }
  ]
}
    1 Note that the policy is read-only and doesn’t allow any modifications to Bedrock agents or S3 inventory artifacts.
    2 Replace <inventory-bucket> with the name of your S3 inventory bucket. You can configure this name in the application’s Inventory Bucket field.

  3. Select Next.

  4. Name the policy iga-bedrock-application-policy, then select Create policy.

Create an IAM user for explicit credentials

Choose one of the following options:

  • If you intend to use the default credentials provider to access AWS Bedrock, you don’t need to create an IAM user and can skip to the next section.

  • If you intend to use explicit credentials to access AWS Bedrock, create an IAM user using these steps:

    1. In the AWS console, go to IAM > Users > Create user.

    2. Enter a username, for example iga-bedrock-application.

    3. Select Next.

    4. Under Set permissions, choose Attach policies directly.

    5. Search for iga-bedrock-application-policy, select it, then select Next > Create user.

    6. Open the user, then select the Security credentials tab.

    7. Select Create access key.

    8. For Use case, select Application running outside AWS, then select Next.

    9. Copy the access key ID and secret access key. You’ll need these for the Access Key ID and Secret Access Key application properties.

Register the application

  1. In the Advanced Identity Cloud admin console, go to apps Applications, and click grid_view Browse App Catalog.

  2. In the Browse App Catalog modal, select an application, and click Next.

  3. Review the Application Integration information, and click Next.

  4. In the Application Details window, specify the name, description, application owners, and logo for the application.

  5. Leave the Authoritative checkbox unselected.

  6. Click Create Application.

Configure the provisioner

  1. In the Advanced Identity Cloud admin console, go to apps Applications.

  2. Click the application you just registered to open the application details page.

  3. Click the Provisioning tab, then compare the message displayed with these options:

    • You haven’t set up provisioning yet
      This message indicates that Advanced Identity Cloud has found a connector server with a compatible connector installed, but you haven’t set up provisioning yet. In this case, click Set up Provisioning to set up provisioning for the application.

    • No Connector Servers available
      This message indicates that Advanced Identity Cloud either can’t find a connector server to use for provisioning or that it can find a connector server but it doesn’t have a compatible connector installed for this application.

      Show guidance

      • If you haven’t set up a connector server:

        1. Register a remote server

        2. (Optional) Reset the client secret

        3. Download a remote server

        4. Add the AWS Bedrock connector JAR file to the remote server’s connectors folder.

        5. Configure the remote server

        6. Refresh the AWS Bedrock application page in your browser, then begin step 3 again.

      • If you’ve already set up a connector server:

        1. Add the AWS Bedrock connector JAR file to the remote server’s connectors folder, then restart the connector server.

        2. Refresh the AWS Bedrock application page in your browser, then begin step 3 again.

  4. In the Connect to AWS Bedrock modal, enter the following information:

    • Region: Enter your AWS region. For example, enter us-east-1.

    • Account ID: Enter your AWS account ID from the AWS Management Console. For example, 423456789000.

    • Inventory Bucket: Enter the S3 bucket name for agent inventory. You must create this bucket in AWS first. Learn more in AWS Bedrock documentation.

    • Use Default Credentials Provider: Enable to use the default AWS credentials chain, or disable to enter an access key ID and secret access key.

    • Access Key ID (optional): If you disabled the default credentials provider, enter your AWS access key ID. For example, AMZ4XF91LDHBOGFEQYKW.

    • Secret Access Key (optional): If you disabled the default credentials provider, enter your AWS secret access key.

  5. (Optional) Click Show advanced settings to set any of the following options:

    Show advanced settings options
    Application specific settings
    Option Description

    Exclude Unmodified

    Select this option to synchronize only the modified properties on a target resource.
    Pool configuration
    Field Description

    Max idle and active container instances

    The maximum number of idle and active container instances. The default value is 10.

    Max Idle Connector Instances

    The maximum number of idle connector instances. The default value is 10.

    Set Timeout Period

    Select to enable a timeout period for the connection. After enabling, configure the following:

    • Timeout period (ms): The timeout period in milliseconds.

    Set Minimum Idle Time

    Select to set a minimum time (in milliseconds) before an idle object is removed. After enabling, configure the following:

    • Min idle time (ms): The minimum idle time in milliseconds.

    Min Idle Instances

    The minimum number of idle connector instances.
    Result Handler configuration
    Field Description

    Enable for connectors with the attribute normalizer interface

    Enables the attribute normalizer interface for supported connectors.

    Enable local filtering/search features

    Enables local filtering and search capabilities.

    Enable case insensitive filter

    Configures filters to ignore case sensitivity.

    Enable configuration of search attributes; disable for local connectors

    Enables search attribute configuration. Disable this option for local connectors.

    1. In the Operation Timeouts (ms) area, select the operations to enforce timeouts on and enter the duration in milliseconds.

      Available operations include Create, Validate, Test, Enable a Script on the Connector, Schema, Delete, Update, Sync, Authenticate, Get, Enable a Script on the Target, and Search.

    2. In the Operation Rate Limits area, select the operations to enforce rate limits on.

      You can enforce limits on specific operations, including Create, Validate, Test, Script on Connector, Schema, Delete, Update, Sync, Authenticate, Get, Script on Target, and Search.

      For each selected operation, configure the following fields:

      Field Description

      Request Limit

      Requests allowed over time.

      Request Period

      Limit resets after this time (ms).

      Request Timeout

      Time before exception thrown (ms).

  6. Click Connect.

  7. Verify that the status shows Connected.

Configure provisioning and reconciliation resources

To configure provisioning and reconciliation resources, follow the instructions in Onboard AI agents in the Agent Governance documentation.