r/aws_bedrockagentcore_gateway_target: add connector MCP target configuration#48706
Open
jesseturner21 wants to merge 9 commits into
Open
r/aws_bedrockagentcore_gateway_target: add connector MCP target configuration#48706jesseturner21 wants to merge 9 commits into
jesseturner21 wants to merge 9 commits into
Conversation
…minimal valid create + plan-only parameters test
… to plan-only pending real connector
Contributor
Community GuidelinesThis comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀 Voting for Prioritization
Pull Request Authors
|
github-actions
Bot
added
needs-triage
…ement findings in plan-only caveat
…test against a real knowledge base
…es MANAGED KB on allowlisted account
…pass against a MANAGED KB (add GetKnowledgeBase perm + propagation wait)
justinretzolk
added
enhancement
…e credential provider at plan time
- The mcp target union (api_gateway, connector, lambda, mcp_server, open_api_schema,
smithy_model) had only SizeAtMost(1) per member and no cross-field rule, so setting
two members passed validation and apply "succeeded" while Expand kept only the first
(switch order), leaving a perpetual "+ <dropped member>" diff. Added
listvalidator.ExactlyOneOf across the six members.
- credential_provider_configuration members used ConflictsWith (preventing multiples)
but nothing required at least one, so an empty credential_provider_configuration {}
passed validation and only failed at apply ("At least one credential provider must
be configured"). Added listvalidator.AtLeastOneOf across the five members; combined
with the existing ConflictsWith this yields exactly-one semantics.
Add an acctest asserting multiple mcp members, no mcp member, and an empty
credential_provider_configuration are all rejected at plan time.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds the
connectorMCP target configuration block toaws_bedrockagentcore_gateway_target— a pre-built connector integration target. Supportssource.connector_id,enabled, and per-toolconfigurationswithparameter_overrides(path,description,visible) andparameter_values(free-form JSON). Maps toConnectorTargetConfiguration/ConnectorConfigurationin the AgentCore Control API.parameter_valuesis the SDK'sdocument.Interface(free-form JSON), modeled as ajsontypes.Normalizedattribute with a smithy-document round-trip (tfsmithy.DocumentFromJSONString/DocumentToJSONString), matching the existing pattern ininternal/service/bedrockagent/prompt.go.Source
aws/aws-sdk-go-v2@8881653298eb2d13cc8b60910bd7c2e8b6642df4(service/bedrockagentcorecontrol,ConnectorTargetConfiguration)Testing
Two acceptance tests. The connector live-create test is gated on
TF_AWS_BEDROCK_KNOWLEDGE_BASE_ID(mirroring the existing Bedrock KB tests'TF_AWS_BEDROCK_OSS_COLLECTION_NAMEgating) because the connector requires a MANAGED-type Bedrock knowledge base (see contract below); it was run live against a MANAGED KB:The offline plan-only test covers the
parameter_valuesJSON round-trip andparameter_overrideswithout needing a KB:Connector contract (verified against the live API)
Pinned down by probing
CreateGatewayTargetdirectly:configurations[].name→ onlyRetrieve(RetrieveAndGenerate/retrieve→ "Configuration 'X': not found in connector").parameter_valueskey → onlyknowledgeBaseId(numberOfResults→ "'numberOfResults' is not a recognized parameter").VECTORKB fails with "Retrieve is not supported for this knowledge base type."bedrock:Retrieveandbedrock:GetKnowledgeBaseon the KB ARN (the connector validation callsGetKnowledgeBaseto inspect the KB type;Retrievealone → "Insufficient permissions to validate the specified resource").time_sleepguards the newly-created inline policy's propagation before the target is validated.The test config provisions the gateway, grants the role those two actions, creates the connector target against the KB, and import-verifies it.
Closes #48503