AgentCore GatewayのHTTPターゲットにconnectorタイプが追加されたのでAgentCore Memoryを繋いでみた

{
  "http": {
    "connector": {
      "source": {
        "connectorId": "agentcore-memory"
      },
      "parameters": {
        "memoryId": "<公開したいMemoryのID>"
      }
    }
  }
}

git clone https://github.com/yuu551/agentcore-memory-gateway-sample.git
cd agentcore-memory-gateway-sample
uv run scripts/create_gateway.py --name memory-gateway-blog \
  --role-arn arn:aws:iam::<アカウントID>:role/memory-gateway-role

aws iam create-role \
  --role-name memory-gateway-role \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "bedrock-agentcore.amazonaws.com"},
      "Action": "sts:AssumeRole",
      "Condition": {"StringEquals": {"aws:SourceAccount": "<アカウントID>"}}
    }]
  }'

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock-agentcore:GetMemory",
        "bedrock-agentcore:CreateEvent",
        "bedrock-agentcore:GetEvent",
        "bedrock-agentcore:ListEvents",
        "bedrock-agentcore:ListSessions",
        "bedrock-agentcore:ListActors",
        "bedrock-agentcore:GetMemoryRecord",
        "bedrock-agentcore:ListMemoryRecords",
        "bedrock-agentcore:RetrieveMemoryRecords"
      ],
      "Resource": "arn:aws:bedrock-agentcore:us-east-1:<アカウントID>:memory/<MemoryのID>"
    }
  ]
}

aws iam put-role-policy \
  --role-name memory-gateway-role \
  --policy-name memory-connector-access \
  --policy-document file://memory-connector-access.json

HTTP target configuration is not supported for gateways with MCP protocol type.
Provide an MCP-compatible target configuration and retry the request.

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

response = client.create_gateway(
    name="memory-gateway-blog",
    roleArn="arn:aws:iam::<アカウントID>:role/memory-gateway-role",
    authorizerType="AWS_IAM",
)
print(response["gatewayId"], response["status"])

import boto3

client = boto3.client("bedrock-agentcore-control", region_name="us-east-1")

response = client.create_gateway_target(
    gatewayIdentifier="<GatewayのID>",
    name="memory-connector",
    targetConfiguration={
        "http": {
            "connector": {
                "source": {"connectorId": "agentcore-memory"},
                "parameters": {"memoryId": "<MemoryのID>"},
            }
        }
    },
    credentialProviderConfigurations=[
        {"credentialProviderType": "GATEWAY_IAM_ROLE"}
    ],
)
print(response["targetId"], response["status"])

https://{gatewayId}.gateway.bedrock-agentcore.{region}.amazonaws.com/{targetName}/{path}

import json
import urllib.request

import boto3
from botocore.auth import SigV4Auth
from botocore.awsrequest import AWSRequest

creds = boto3.Session().get_credentials().get_frozen_credentials()
gateway_url = "https://<GatewayのID>.gateway.bedrock-agentcore.us-east-1.amazonaws.com"
memory_id = "<MemoryのID>"

def call(path: str, body: dict) -> None:
    url = gateway_url + path
    data = json.dumps(body).encode()
    request = AWSRequest(
        method="POST", url=url, data=data,
        headers={"Content-Type": "application/json"},
    )
    SigV4Auth(creds, "bedrock-agentcore", "us-east-1").add_auth(request)
    req = urllib.request.Request(
        url, data=data, headers=dict(request.headers), method="POST"
    )
    with urllib.request.urlopen(req) as resp:
        print(resp.status, resp.read().decode())

call(f"/memory-connector/memories/{memory_id}/actors", {"maxResults": 10})

uv run scripts/invoke_memory.py --gateway-id <GatewayのID> --memory-id <MemoryのID>

200 {"actorSummaries":[{"actorId":"travel-user"}]}

call("/memory-connector/memories/<別のMemoryのID>/actors", {"maxResults": 10})

400 {"success":false,"error":"Request path does not match the target's configured resource"}

import time
import uuid

call(
    f"/memory-connector/memories/{memory_id}/events",
    {
        "clientToken": str(uuid.uuid4()),
        "actorId": "blog-test-user",
        "sessionId": "blog-test-session",
        "eventTimestamp": int(time.time()),
        "payload": [
            {
                "conversational": {
                    "content": {"text": "Gateway経由で書き込むテストメッセージです"},
                    "role": "USER",
                }
            }
        ],
    },
)

201 {"event":{"actorId":"blog-test-user","branch":{"name":"main"},
"eventId":"0000001786189541000#15c48ea0", ... }}

200 {"events":[{"actorId":"blog-test-user", ...
"payload":[{"conversational":{"content":{"text":"Gateway経由で書き込むテストメッセージです"},
"role":"USER"}}],"sessionId":"blog-test-session"}]}

# 管理画面役: Gateway経由でMemoryの会話履歴を閲覧する(Memoryへの直接権限は不要)
# call()はレスポンスのJSONを返すように変更したものを使います
def call(path: str, body: dict) -> dict:
    url = gateway_url + path
    data = json.dumps(body).encode()
    request = AWSRequest(
        method="POST", url=url, data=data,
        headers={"Content-Type": "application/json"},
    )
    SigV4Auth(creds, "bedrock-agentcore", "us-east-1").add_auth(request)
    req = urllib.request.Request(
        url, data=data, headers=dict(request.headers), method="POST"
    )
    with urllib.request.urlopen(req) as resp:
        return json.loads(resp.read())

actor_id = "customer-001"

# 1. 顧客のセッション一覧
sessions = call(
    f"/memory-connector/memories/{memory_id}/actor/{actor_id}/sessions",
    {"maxResults": 10},
)
print(f"=== {actor_id} のセッション一覧 ===")
for s in sessions["sessionSummaries"]:
    print(f"  {s['sessionId']}")

# 2. セッションを選んで会話履歴を表示
session_id = sessions["sessionSummaries"][0]["sessionId"]
events = call(
    f"/memory-connector/memories/{memory_id}/actor/{actor_id}/sessions/{session_id}",
    {"maxResults": 50},
)
print(f"\n=== 会話履歴: {session_id} ===")
for e in sorted(events["events"], key=lambda x: x["eventTimestamp"]):
    for p in e["payload"]:
        conv = p.get("conversational")
        if conv:
            speaker = "顧客" if conv["role"] == "USER" else "エージェント"
            print(f"  [{speaker}] {conv['content']['text']}")

=== customer-001 のセッション一覧 ===
  support-session-042

=== 会話履歴: support-session-042 ===
  [顧客] 注文した商品がまだ届きません。注文番号はORD-1234です。
  [エージェント] ご不便をおかけしております。ORD-1234の配送状況を確認しますね。現在配送センターを出発済みで、明日午前中に到着予定です。
  [顧客] ありがとうございます。ちなみに置き配に変更できますか?
  [エージェント] 承知しました。置き配(玄関前)に変更いたしました。到着時に通知が届きます。

response = client.create_gateway_target(
    gatewayIdentifier="<GatewayのID>",
    name="tenant-b-memory",
    targetConfiguration={
        "http": {
            "connector": {
                "source": {"connectorId": "agentcore-memory"},
                "parameters": {"memoryId": "<テナントBのMemoryのID>"},
            }
        }
    },
    credentialProviderConfigurations=[
        {"credentialProviderType": "GATEWAY_IAM_ROLE"}
    ],
)

statement = (
    'permit (principal is AgentCore::IamEntity, action, '
    'resource == AgentCore::Gateway::"<GatewayのARN>");'
)

client.create_policy(
    policyEngineId="<Policy EngineのID>",
    name="MemoryGatewayBase",
    definition={"policy": {"statement": statement}},
    validationMode="IGNORE_ALL_FINDINGS",
)

statement = (
    'forbid (principal is AgentCore::IamEntity, '
    'action == AgentCore::Action::"memory-connector___POST:/memories/{memoryId}/events", '
    'resource == AgentCore::Gateway::"<GatewayのARN>") '
    'when { principal.id like "*<閲覧ユーザーのロール名>*" };'
)

client.create_policy(
    policyEngineId="<Policy EngineのID>",
    name="DenyMemoryWriteForViewer",
    definition={"policy": {"statement": statement}},
)

読み取り(ListEvents) -> 200 {"events":[...]}
書き込み(CreateEvent) -> 403 {"success":false,"error":"Request Denied: Gateway Target
request not allowed due to policy enforcement
[Policy evaluation denied due to DenyMemoryWriteForViewer-u1nslq9nra]"}

aws cognito-idp create-user-pool --pool-name memory-gateway-jwt-pool

aws cognito-idp add-custom-attributes --user-pool-id <プールID> \
  --custom-attributes \
  Name=tenant_id,AttributeDataType=String,Mutable=true \
  Name=role,AttributeDataType=String,Mutable=true

aws cognito-idp create-user-pool-client --user-pool-id <プールID> \
  --client-name user-client \
  --explicit-auth-flows ALLOW_USER_PASSWORD_AUTH ALLOW_REFRESH_TOKEN_AUTH

aws cognito-idp admin-create-user --user-pool-id <プールID> \
  --username tenant-a-user \
  --user-attributes Name=custom:tenant_id,Value=tenant-a Name=custom:role,Value=viewer \
  --message-action SUPPRESS
aws cognito-idp admin-set-user-password --user-pool-id <プールID> \
  --username tenant-a-user --password '<パスワード>' --permanent

response = client.create_gateway(
    name="memory-gateway-jwt",
    roleArn="arn:aws:iam::<アカウントID>:role/memory-gateway-role",
    authorizerType="CUSTOM_JWT",
    authorizerConfiguration={
        "customJWTAuthorizer": {
            "discoveryUrl": "https://cognito-idp.us-east-1.amazonaws.com/<プールID>/.well-known/openid-configuration",
            "allowedAudience": ["<アプリクライアントID>"],
        }
    },
)

import boto3

cognito = boto3.client("cognito-idp", region_name="us-east-1")
result = cognito.initiate_auth(
    ClientId="<アプリクライアントID>",
    AuthFlow="USER_PASSWORD_AUTH",
    AuthParameters={"USERNAME": "tenant-a-user", "PASSWORD": "<パスワード>"},
)
id_token = result["AuthenticationResult"]["IdToken"]

# SigV4署名の代わりにBearerヘッダーを付けるだけ
headers = {"Content-Type": "application/json", "Authorization": f"Bearer {id_token}"}

有効なIDトークン -> 200 {"actorSummaries":[...]}
不正なトークン -> 401 {"success":false,"error":"Invalid Bearer token"}

statement = (
    'forbid (principal is AgentCore::OAuthUser, '
    'action in AgentCore::Action::"memory-connector", '
    'resource == AgentCore::Gateway::"<GatewayのARN>") '
    'unless { principal.hasTag("custom:tenant_id") '
    '&& principal.getTag("custom:tenant_id") == "tenant-a" };'
)

statement = (
    'forbid (principal is AgentCore::OAuthUser, '
    'action in [AgentCore::Action::"memory-connector___POST:/memories/{memoryId}/events", '
    'AgentCore::Action::"tenant-b-memory___POST:/memories/{memoryId}/events"], '
    'resource == AgentCore::Gateway::"<GatewayのARN>") '
    'unless { principal.hasTag("custom:role") '
    '&& principal.getTag("custom:role") == "admin" };'
)

LOG_ONLY -> 200 (通るが評価結果はログに記録される)
ENFORCE  -> 403 (ブロックされる)

statement = (
    'forbid (principal is AgentCore::OAuthUser, '
    'action == AgentCore::Action::"memory-connector___POST:/memories/{memoryId}/actor/{actorId}/sessions/{sessionId}", '
    'resource == AgentCore::Gateway::"<GatewayのARN>") '
    'unless { principal.hasTag("sub") && context has input && context.input has actorId '
    '&& context.input.actorId == principal.getTag("sub") };'
)

自分のactorId(=sub)のListEvents -> 200 {"events":[]}
他人のactorId(customer-001)のListEvents -> 403 (自分のアクター以外を拒否するポリシー)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyUnlessFromGateway",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "bedrock-agentcore:ListActors",
      "Resource": "arn:aws:bedrock-agentcore:us-east-1:<アカウントID>:memory/<MemoryのID>",
      "Condition": {
        "ArnNotEquals": {
          "aws:SourceArn": "arn:aws:bedrock-agentcore:us-east-1:<アカウントID>:gateway/<GatewayのID>"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyExceptGatewayRole",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "bedrock-agentcore:ListActors",
      "Resource": "arn:aws:bedrock-agentcore:us-east-1:<アカウントID>:memory/<MemoryのID>",
      "Condition": {
        "StringNotLike": {"aws:PrincipalArn": "*role/<Gateway実行ロール名>*"}
      }
    }
  ]
}

直接ListActors        -> AccessDeniedException (User ... is not authorized)
Gateway経由ListActors -> 200 {"actorSummaries":[...]}