agentcore-gateway
Skill1 starsChanged 2 months agoMITView on GitHub
Configure or diagnose Amazon Bedrock AgentCore Gateway target authentication, JWT caller propagation, request interceptors and opaque upstream errors. Use when a direct API works but Gateway fails, or when mapping inbound identity to outbound target credentials.
In this repository3 other files it gives its agents.
- AGENTS.mdAGENTS.md
- agentcore-operationsSkill
- agentcore-runtimeSkill
The file
We split this skill into the rules it gives an agent
6 rules. About 0 are common, 6 are distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈6
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 17
Read identity propagation for header/signing boundaries and diagnosing failures for controlled hop tests.
- Distinctive: line 24
Check current target-specific credential support and the rendered IaC shape.
- Distinctive: line 25
Do not transfer an OpenAPI workaround to an HTTP, Lambda or MCP target blindly.
- Distinctive: line 27
Never print token values to prove propagation.
- Distinctive: line 28
Test the same scoped caller directly and through Gateway using a non-mutating operation.
- Distinctive: line 30
Verify absent, invalid and conflicting credentials fail as intended.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Trace identity across the Gateway hop
Identify the target type, inbound authorizer, outbound credential provider, interceptor and upstream verifier. These are separate decisions. Preserve the user's existing identity model; a shared service credential is not automatically a replacement for per-caller authorization.
Read identity propagation for header/signing boundaries and diagnosing failures for controlled hop tests.
Workflow
- Draw the actual route: caller → Gateway → interceptor/signing → target → verifier. Record who validates each credential and which identity the target authorizes.
- Check current target-specific credential support and the rendered IaC shape. Do not transfer an OpenAPI workaround to an HTTP, Lambda or MCP target blindly.
- Trace header names through emission, allowlisting, signing and consumption. Never print token values to prove propagation.
- Test the same scoped caller directly and through Gateway using a non-mutating operation. Keep the operation, token scope and time window equivalent.
- Verify absent, invalid and conflicting credentials fail as intended. Report the boundary isolated by evidence, not a guessed cause from a generic error string.
The offline header test models one historical SigV4-plus-forwarded-bearer design. It checks a contract, not live AWS signing or JWT cryptography. Deployment changes remain subject to the user's authorized scope.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.