---
schema_version: "1"
id: 6c43dbe68ac84925a9483556a28156197c066e5114ebd183e67eee49a80ba2da
title: Adding a Scanner for Amazon Bedrock AgentCore Runtime
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/exchange/adding-bedrock-agentcore-scanner.md
canonical_url: https://docs.mulesoft.com/exchange/adding-bedrock-agentcore-scanner
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 75eacd8f42d009a9a4df1459b7ca810a87e8db30d6d6acf498d45afc0475187c
description: MuleSoft Documentation Site
latest: true
---
---
product: Exchange
---

# Adding a Scanner for Amazon Bedrock AgentCore Runtime

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Add a scanner to discover, import, and sync agents from Agent Runtime into Exchange. Then you can
govern the agents and consume them in other applications.

## Before You Begin

This setup requires specific configurations and access privileges in Amazon Bedrock to enable the
scanner to access and list Amazon Bedrock AgentCore agents.

- Prerequisites:

  - An active AWS account to register and host agents.

  - Access to Amazon Bedrock AgentCore in the AWS Console.

  - An AWS app registration in the AWS Console to generate credentials.

- Required Configuration Values:

  - **AWS Region** for endpoint URL construction (for example,
    `[https://bedrock.<region>.amazonaws.com](https://bedrock.\<region\>.amazonaws.com)`).

  - **Agent Endpoint and Version** because created agents must have an assigned endpoint and version
    to be discoverable.

  - **Access Key and Secret Access Key** generated for the Identity and Access Management (IAM)
    user.

- Required Permissions and Roles:

  - An IAM user with an inline policy that allows:

    - `bedrock-agentcore:ListAgentRuntimes`

    - `bedrock-agentcore:ListAgentRuntimeEndpoints`

    - `bedrock-agentcore:GetAgentCard`

    - `bedrock-agentcore:GetAgentRuntime`

    - `bedrock-agentcore:ListAgentRuntimeVersions`

  - Standard Bedrock permissions are also required:

    - `bedrock:GetAgent`

    - `bedrock:ListAgents`

- Required Authentication:

  - IAM Signature (SigV4) is the default authentication method for AWS users.

  - OAuth 2.0 is available for AgentCore through `CreateOauth2CredentialProvider`.

- Scanner Configuration Scope and Limitations:

  - Agents must be published with an active endpoint for scanner discovery.

  - Security reviews indicate medium server-side request forgery (SSRF) risk if a user-supplied
    region is not validated during URL construction.

  - Basic AgentCore agents do not expose A2A cards, but AgentCore supports A2A cards when agents
    expose them.

For more information, see the
[Amazon Bedrock documentation](https://docs.aws.amazon.com/bedrock-agentcore/).

## Add a Scanner for Amazon Bedrock AgentCore

1.  Verify that you are in the business group where you want to add the scanner.

2.  From the sidebar in Exchange, click **Scanners**.

3.  Enter a name for the scanner.

4.  In **Scanner Run Configuration**, complete these fields or options:

    <table><colgroup><col> <col></colgroup><thead><tr><th><strong>Field/Option</strong></th><th><strong>Value</strong></th></tr></thead><tbody><tr><td><p><strong>Run Schedule</strong></p></td><td><p>Select a frequency and local time.</p></td></tr><tr><td><p><strong>Sync Review</strong></p></td><td><p>Select an option: Auto-resolve or Ask to review.</p></td></tr></tbody></table>

5.  From **Connection Configuration**, complete these fields:

    <table><colgroup><col> <col></colgroup><thead><tr><th><strong>Field</strong></th><th><strong>Value</strong></th></tr></thead><tbody><tr><td><p><strong>Provider</strong></p></td><td><p>Select <strong>Amazon</strong>.</p></td></tr><tr><td><p><strong>Platform</strong></p></td><td><p>Select <strong>AWS AgentCore</strong>.</p></td></tr><tr><td><p><strong>Asset Type</strong></p></td><td><p>Only agents are supported.</p></td></tr><tr><td><p><strong>Authentication Method</strong></p></td><td><p>Select <strong>Access key</strong>.</p></td></tr><tr><td><p><strong>Access Key ID</strong></p></td><td><p>Enter the access key ID.</p></td></tr><tr><td><p><strong>Secret Access Key</strong></p></td><td><p>Enter the secret access key.</p></td></tr><tr><td><p><strong>AWS Region</strong></p></td><td><p>Select a region.</p></td></tr></tbody></table>

6.  Click **Test Connection**.

    If the connection fails, review the **Connection Configuration** settings. Update the settings,
    and then test the connection again.

7.  To send email notifications:

    1.  Select **Advanced Settings** and turn on **Send Email Notifications**.

    2.  Enter an email address.

8.  Click **Add Scanner**.

## See Also

- [Amazon Scanners](https://docs.mulesoft.com/exchange/aws-scanners)

- [Discovering and Cataloging External Services with Scanners](https://docs.mulesoft.com/exchange/discovering-and-importing-external-agents)

- [Managing Scanners In Exchange](https://docs.mulesoft.com/exchange/managing-scanners)