AI Platform Connection Settings

This document outlines the required connection settings and credentials needed to configure integrations for supported AI Agent Registry vendors. Each integration requires specific authentication details and cloud resource information to establish secure connectivity between the AI Agent Registry and the vendor platform.
Refer to AI Agent Integration for more information on how to automatically discovery Agents.

Use the following tables to gather and configure the required values for each vendor:

AWS Bedrock AgentCore

The following credentials are required to configure an AWS Bedrock AgentCore integration. Ensure that the provided AWS account has the appropriate permissions to access the required AgentCore resources.

Connection Setting	Description
Authentication Method	Value: AWS Role Authentication method used for AWS Bedrock AgentCore integration
Secret Store	Value: PlainID internal SSM parameter store Secret storage mechanism used for securely storing credentials
Account ID	AWS Account ID
Region	AWS Region
Access Key ID	AWS Access Key ID
Secret Access Key	AWS Secret Access Key

Permissions

The AWS IAM role or user used for the integration must have the following permissions to discover and read AgentCore resources in their AWS Cloud. All listed actions are read-only; none expose or retrieve secret values.

IAM Action	Purpose
`bedrock-agentcore:ListAgentRuntimes`	Lists all agent runtimes in the account/region.
`bedrock-agentcore:GetAgentRuntime`	Retrieves runtime details for mapping into the AI Agent Registry.
`bedrock-agentcore:ListOauth2CredentialProviders`	Retrieves OAuth credential provider metadata (name, ARN, vendor) for the `OAuth_Client_Provider` attribute. No secrets are accessed.
`bedrock-agentcore:ListApiKeyCredentialProviders`	Retrieves API key credential provider names for attribute mapping. Metadata only — no key values are accessed.
`bedrock-agentcore:ListGateways`	Lists all gateways in the account/region.
`bedrock-agentcore:GetGateway`	Retrieves gateway details, including `Gateway_URL` and `Gateway_Auth_Type`.
`bedrock-agentcore:ListGatewayTargets`	Lists all targets configured for a given gateway.
`bedrock-agentcore:GetGatewayTarget`	Retrieves target details, including `Target_Type` and `Target_Outbound_Auth`.

Permissions Configuration

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockAgentCoreDiscovery",
      "Effect": "Allow",
      "Action": [
        "bedrock-agentcore:ListAgentRuntimes",
        "bedrock-agentcore:GetAgentRuntime",
        "bedrock-agentcore:ListOauth2CredentialProviders",
        "bedrock-agentcore:ListApiKeyCredentialProviders",
        "bedrock-agentcore:ListGateways",
        "bedrock-agentcore:GetGateway",
        "bedrock-agentcore:ListGatewayTargets",
        "bedrock-agentcore:GetGatewayTarget",
        "bedrock-agentcore:ListTagsForResource"
      ],
      "Resource": [
        "arn:aws:bedrock-agentcore:CUSTOMER_REGION:CUSTOMER_ACCOUNT_ID:runtime/*",
        "arn:aws:bedrock-agentcore:CUSTOMER_REGION:CUSTOMER_ACCOUNT_ID:gateway/*",
        "arn:aws:bedrock-agentcore:CUSTOMER_REGION:CUSTOMER_ACCOUNT_ID:token-vault/*"
      ]
    }
  ]
}

Microsoft Foundry

The following settings are required to connect Microsoft Foundry projects to the AI Agent Registry. These credentials are used to authenticate and access the target Foundry project and related Azure resources.

Connection Setting	Description
Authentication Method	Value: Azure API Key Authentication method used for Microsoft Foundry integration
Secret Store	Value: Plainid internal SSM parameter store Secret storage mechanism used for securely storing credentials

Microsoft Foundry Credentials

Connection Setting	Description
Project Endpoint	Project endpoint of the Microsoft Foundry project
Project Name	Microsoft Foundry project name
API Key	Microsoft Foundry project API key

Azure Credentials

The following Azure credentials and resource details are required to authorize access to the Microsoft Foundry environment and validate the associated Azure resources.

Connection Setting	Description
Resource Group	Resource Group in Azure that was created for the Microsoft Foundry instance or project. The Resource Group should allow Reader permissions for the Azure Entra Application. Check IAM on the specific resource level. If integration is required on the whole instance level, use the Foundry resource name. If integration is required on a specific project level, use the Foundry project resource name
Account Name	Foundry resource name in the Resource Group
Subscription ID	Subscription ID of the Foundry project in the Azure Resource Group
Tenant ID	Azure Entra Application Tenant ID
Client ID	Azure Entra Application Client ID
Client Secret	Azure Entra Application Client Secret

Documentation Index