AgentCore GatewayがAWS WAFをサポートしたのでレートベースルールとBot Controlを試してみた

import json

def handler(event, context):
    method = event.get("method", "")
    params = event.get("params", {})

    if method == "tools/call":
        tool_name = params.get("name", "")
        arguments = params.get("arguments", {})

        if tool_name == "hello":
            name = arguments.get("name", "World")
            return {
                "content": [{"type": "text", "text": f"Hello, {name}!"}]
            }

    elif method == "tools/list":
        return {
            "tools": [{
                "name": "hello",
                "description": "Returns a greeting message",
                "inputSchema": {
                    "type": "object",
                    "properties": {"name": {"type": "string", "description": "Name to greet"}},
                    "required": []
                }
            }]
        }

    return {"content": [{"type": "text", "text": "Hello, World!"}]}

# Gateway 用 IAM ロール作成（信頼ポリシー: bedrock-agentcore.amazonaws.com）
aws iam create-role \
  --role-name agentcore-waf-demo-gateway-role \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "bedrock-agentcore.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }]
  }'

# Lambda 呼び出し権限を付与
aws iam put-role-policy \
  --role-name agentcore-waf-demo-gateway-role \
  --policy-name lambda-invoke \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:us-east-1:ACCOUNT_ID:function:agentcore-waf-demo-hello"
    }]
  }'

aws bedrock-agentcore-control create-gateway \
  --name agentcore-waf-demo \
  --role-arn arn:aws:iam::ACCOUNT_ID:role/agentcore-waf-demo-gateway-role \
  --protocol-type MCP \
  --authorizer-type NONE \
  --exception-level DEBUG \
  --region us-east-1

aws bedrock-agentcore-control create-gateway-target \
  --gateway-identifier GATEWAY_ID \
  --name hello-tool \
  --credential-provider-configurations '[{"credentialProviderType":"GATEWAY_IAM_ROLE"}]' \
  --target-configuration '{
    "mcp": {
      "lambda": {
        "lambdaArn": "arn:aws:lambda:us-east-1:ACCOUNT_ID:function:agentcore-waf-demo-hello",
        "toolSchema": {
          "inlinePayload": [{
            "name": "hello",
            "description": "Returns a greeting message",
            "inputSchema": {
              "type": "object",
              "properties": {"name": {"type": "string", "description": "Name to greet"}},
              "required": []
            }
          }]
        }
      }
    }
  }' \
  --region us-east-1

aws cloudfront create-distribution \
  --distribution-config '{
    "CallerReference": "agentcore-waf-demo-cf",
    "Origins": {
      "Quantity": 1,
      "Items": [{
        "Id": "agentcore-gateway",
        "DomainName": "GATEWAY_ID.gateway.bedrock-agentcore.us-east-1.amazonaws.com",
        "CustomOriginConfig": {
          "HTTPPort": 80,
          "HTTPSPort": 443,
          "OriginProtocolPolicy": "https-only",
          "OriginSslProtocols": {"Quantity": 1, "Items": ["TLSv1.2"]}
        }
      }]
    },
    "DefaultCacheBehavior": {
      "TargetOriginId": "agentcore-gateway",
      "ViewerProtocolPolicy": "https-only",
      "AllowedMethods": {"Quantity": 7, "Items": ["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"], "CachedMethods": {"Quantity": 2, "Items": ["GET","HEAD"]}},
      "CachePolicyId": "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
      "OriginRequestPolicyId": "b689b0a8-53d0-40ab-baf2-68738e2966ac",
      "Compress": true
    },
    "Enabled": true,
    "Comment": "AgentCore Gateway WAF Monetize demo"
  }'