AWSTemplateFormatVersion: "2010-09-09" Description: > Cloudamize MCP Pull Agent - AWS Marketplace variant. Creates the AgentCoreExecutionRole, the AWSTransformAgentInvokeRole, and the two Bedrock AgentCore runtimes (pull agent + orchestrator) for the Unified_Agent_Set (cloudamize-data-pull-agent, cloudamize-migration-orchestrator). This variant is intended for BUYERS who have SUBSCRIBED to the Cloudamize agents on AWS Marketplace: the container images are pulled from the AWS Marketplace-managed ECR registry (an AWS-owned account), and pull access is granted by the buyer's Marketplace SUBSCRIPTION ENTITLEMENT rather than by a cross-account ECR repository policy maintained by Cloudamize. Deploy this stack directly into the AWS account that will host the runtime (the Customer_Account) - the account is taken implicitly from the deploying account via the AWS::AccountId pseudo parameter, so no separate account-id parameter is required. (Requirement 9 / customer-deployable-connector-jwt) # ----------------------------------------------------------------------------- # Parameter grouping metadata (cosmetic - console wizard only) # ----------------------------------------------------------------------------- Metadata: AWS::CloudFormation::Interface: ParameterGroups: - Label: default: Container images (AWS Marketplace-managed ECR - entitlement-based) Parameters: - PullAgentImageUri - OrchestratorImageUri - Label: default: Runtime names and network Parameters: - PullAgentRuntimeName - OrchestratorRuntimeName - NetworkMode - Label: default: Cloudamize JWT secret (blank JwtSecretArn = create; ARN = reuse) Parameters: - JwtSecretArn - JwtSecretName - CloudamizeJwtToken - Label: default: AgentCoreExecutionRole (idempotent create-or-reuse) Parameters: - CreateAgentCoreExecutionRole - AgentCoreExecutionRoleName - ExistingAgentCoreExecutionRoleArn - Label: default: AWSTransformAgentInvokeRole (idempotent create-or-reuse) Parameters: - CreateAWSTransformAgentInvokeRole - AWSTransformAgentInvokeRoleName - ExistingAWSTransformAgentInvokeRoleArn - TransformInvokeTrustPrincipal # ----------------------------------------------------------------------------- # Parameters # ----------------------------------------------------------------------------- Parameters: PullAgentImageUri: Type: String Description: >- PRIVATE ECR container image URI for the cloudamize-data-pull-agent (Subagent) runtime, served from the AWS MARKETPLACE-MANAGED ECR registry (an AWS-owned account: 709825985650.dkr.ecr.us-east-1.amazonaws.com/cloudamize/transform-cloudamize-ingestion:1.0.1). Bedrock AgentCore only pulls from PRIVATE ECR (public.ecr.aws is not supported). Buyers do NOT pull from Cloudamize's producer account; access to this Marketplace registry is granted automatically by the buyer's subscription ENTITLEMENT. The AgentCoreExecutionRole's ECR pull permission is derived automatically from the account in THIS URI, so there is no separate account parameter to keep in sync. Bump the tag (e.g. 1.0.0) when a new agent image version is published to Marketplace. Default: "709825985650.dkr.ecr.us-east-1.amazonaws.com/cloudamize/transform-cloudamize-ingestion:1.0.1" AllowedPattern: '^\d{12}\.dkr\.ecr\.[a-z0-9-]+\.amazonaws\.com/[a-z0-9._/-]+[:@]\S+$' ConstraintDescription: >- must be a well-formed PRIVATE ECR image URI of the form .dkr.ecr..amazonaws.com/: (public.ecr.aws URIs are not supported by Bedrock AgentCore) OrchestratorImageUri: Type: String Description: >- PRIVATE ECR container image URI for the cloudamize-migration-orchestrator runtime, served from the AWS MARKETPLACE-MANAGED ECR registry (an AWS-owned account: 709825985650.dkr.ecr.us-east-1.amazonaws.com/cloudamize/transform-cloudamize-orchastration:1.0.1). Bedrock AgentCore only pulls from PRIVATE ECR (public.ecr.aws is not supported). Buyers do NOT pull from Cloudamize's producer account; access to this Marketplace registry is granted automatically by the buyer's subscription ENTITLEMENT. The AgentCoreExecutionRole's ECR pull permission is derived automatically from the account in THIS URI, so there is no separate account parameter to keep in sync. Bump the tag (e.g. 1.0.0) when a new agent image version is published to Marketplace. Default: "709825985650.dkr.ecr.us-east-1.amazonaws.com/cloudamize/transform-cloudamize-orchastration:1.0.1" AllowedPattern: '^\d{12}\.dkr\.ecr\.[a-z0-9-]+\.amazonaws\.com/[a-z0-9._/-]+[:@]\S+$' ConstraintDescription: >- must be a well-formed PRIVATE ECR image URI of the form .dkr.ecr..amazonaws.com/: (public.ecr.aws URIs are not supported by Bedrock AgentCore) PullAgentRuntimeName: Type: String Description: >- Bedrock AgentCore runtime name for the pull agent (letters, digits, and underscores only; must start with a letter; max 48 characters). Default: cloudamize_data_pull_agent AllowedPattern: '^[a-zA-Z][a-zA-Z0-9_]{0,47}$' ConstraintDescription: >- must start with a letter and contain only letters, digits, and underscores (max 48 characters) OrchestratorRuntimeName: Type: String Description: >- Bedrock AgentCore runtime name for the migration orchestrator (letters, digits, and underscores only; must start with a letter; max 48 characters). Default: cloudamize_migration_orchestrator AllowedPattern: '^[a-zA-Z][a-zA-Z0-9_]{0,47}$' ConstraintDescription: >- must start with a letter and contain only letters, digits, and underscores (max 48 characters) NetworkMode: Type: String Description: Bedrock AgentCore runtime network mode. Default: PUBLIC AllowedValues: - PUBLIC - VPC # NOTE: The AWS Transform "stage" is no longer a CloudFormation parameter. # Both runtimes default it in code via os.environ.setdefault("STAGE", "prod") # (subagent_cli.py and orchestrator.py) before the agent_builder_sdk client # factory is used. To run against a non-prod AWS Transform environment, add a # STAGE entry to the relevant runtime's EnvironmentVariables block below. JwtSecretArn: Type: String Description: >- Controls the JWT secret mode via a SINGLE source of truth (there is no separate create/reuse toggle to avoid a stack update silently flipping modes): - Leave BLANK (the default) to have this stack CREATE the secret named JwtSecretName from CloudamizeJwtToken, stored as JSON {"CLOUDAMIZE_JWT_TOKEN": ""} (the shape the agent code reads). - Provide the ARN of an EXISTING Secrets Manager secret (e.g. arn:aws:secretsmanager:us-east-1:111122223333:secret:cmz/auth/token-AbCdEf) to REUSE it; the stack then creates no secret and CloudamizeJwtToken / JwtSecretName are ignored. On a stack update a previously-provided ARN is preserved, so the mode only changes if you explicitly blank or set this value. Used to scope the AgentCoreExecutionRole's secretsmanager:GetSecretValue / DescribeSecret permission to this specific secret rather than a wildcard. Default: "" AllowedPattern: '^$|^arn:aws(-[a-z-]+)?:secretsmanager:[a-z0-9-]+:\d{12}:secret:.+$' ConstraintDescription: >- must be empty (create a new secret) or a well-formed Secrets Manager secret ARN (arn::secretsmanager:::secret:) JwtSecretName: Type: String Description: >- Name of the Secrets Manager secret to create when JwtSecretArn is left blank. Ignored when JwtSecretArn is provided (reuse mode). Default: cmz/auth/token MinLength: 1 MaxLength: 512 CloudamizeJwtToken: Type: String Description: >- The Cloudamize JWT bearer token. Stored by this stack as the value of the CLOUDAMIZE_JWT_TOKEN key inside the created secret (only when JwtSecretArn is left blank - create mode). Leave at the placeholder when reusing an existing secret (JwtSecretArn provided). NoEcho keeps the value out of the console and CloudFormation events/logs. Default: your-jwt-token NoEcho: true MinLength: 1 CreateAgentCoreExecutionRole: Type: String Description: >- Whether to create a new AgentCoreExecutionRole. Set to "false" if a compatible role already exists in this account and you want this stack to reuse it instead (idempotent create-or-reuse); in that case set ExistingAgentCoreExecutionRoleArn. Default: "true" AllowedValues: - "true" - "false" AgentCoreExecutionRoleName: Type: String Description: >- IAM role name for the Bedrock AgentCore execution role. Only used when CreateAgentCoreExecutionRole is "true". Default: AgentCoreExecutionRole MinLength: 1 MaxLength: 64 ExistingAgentCoreExecutionRoleArn: Type: String Description: >- ARN of an existing AgentCoreExecutionRole to reuse. Required when CreateAgentCoreExecutionRole is "false"; ignored otherwise. Leave blank when CreateAgentCoreExecutionRole is "true". Default: "" AllowedPattern: '^$|^arn:aws(-[a-z-]+)?:iam::\d{12}:role/.+$' ConstraintDescription: >- must be empty or a well-formed IAM role ARN (arn::iam:::role/) CreateAWSTransformAgentInvokeRole: Type: String Description: >- Whether to create a new AWSTransformAgentInvokeRole. Set to "false" if a compatible role already exists in this account and you want this stack to reuse it instead (idempotent create-or-reuse); in that case set ExistingAWSTransformAgentInvokeRoleArn. Default: "true" AllowedValues: - "true" - "false" AWSTransformAgentInvokeRoleName: Type: String Description: >- IAM role name AWS Transform assumes to invoke the AgentCore runtimes. Only used when CreateAWSTransformAgentInvokeRole is "true". Default: AWSTransformAgentInvokeRole MinLength: 1 MaxLength: 64 ExistingAWSTransformAgentInvokeRoleArn: Type: String Description: >- ARN of an existing AWSTransformAgentInvokeRole to reuse. Required when CreateAWSTransformAgentInvokeRole is "false"; ignored otherwise. Leave blank when CreateAWSTransformAgentInvokeRole is "true". Default: "" AllowedPattern: '^$|^arn:aws(-[a-z-]+)?:iam::\d{12}:role/.+$' ConstraintDescription: >- must be empty or a well-formed IAM role ARN (arn::iam:::role/) TransformInvokeTrustPrincipal: Type: String Description: >- Service principal that AWS Transform uses to assume the AWSTransformAgentInvokeRole. Leave BLANK (the default) to derive it automatically from the deployment region as prod..compute.elastic-gumby.aws.internal - the regional form AWS Transform uses. Set an explicit value only if AWS Transform gives you a principal that does not follow that regional pattern. Default: "" # ----------------------------------------------------------------------------- # Conditions - implement the "create new role, or reuse an existing one" # idempotent pattern for both roles (Req 9.7), mirroring the Terraform # module's create_agentcore_execution_role / create_transform_invoke_role # boolean + data-source-lookup pattern. # ----------------------------------------------------------------------------- Conditions: ShouldCreateExecutionRole: !Equals [!Ref CreateAgentCoreExecutionRole, "true"] ShouldCreateInvokeRole: !Equals [!Ref CreateAWSTransformAgentInvokeRole, "true"] # When TransformInvokeTrustPrincipal is left blank, derive the principal # from the deployment region (prod..compute.elastic-gumby.aws.internal) # so the stack is not silently locked to us-east-1. UseRegionDerivedInvokePrincipal: !Equals [!Ref TransformInvokeTrustPrincipal, ""] # Create the JWT secret in-stack (from CloudamizeJwtToken) when no existing # secret ARN is supplied; otherwise reuse the secret named by JwtSecretArn. # Deriving the mode from JwtSecretArn (rather than a separate boolean) means # a stack update cannot silently flip create/reuse: the mode is a pure # function of this one preserved parameter value. ShouldCreateJwtSecret: !Equals [!Ref JwtSecretArn, ""] # ----------------------------------------------------------------------------- # Rules - enforce that the "reuse existing role" ARN parameters are non-empty # whenever the corresponding "create new role" parameter is set to "false" # (Req 9.9: fail the stack operation with an error identifying the invalid # parameter, before any resource is created, on a missing/malformed # parameter). # ----------------------------------------------------------------------------- Rules: ExecutionRoleArnRequiredWhenReusing: RuleCondition: !Equals [!Ref CreateAgentCoreExecutionRole, "false"] Assertions: - Assert: !Not [!Equals [!Ref ExistingAgentCoreExecutionRoleArn, ""]] AssertDescription: >- ExistingAgentCoreExecutionRoleArn is required (and must be a valid IAM role ARN) when CreateAgentCoreExecutionRole is "false" InvokeRoleArnRequiredWhenReusing: RuleCondition: !Equals [!Ref CreateAWSTransformAgentInvokeRole, "false"] Assertions: - Assert: !Not [!Equals [!Ref ExistingAWSTransformAgentInvokeRoleArn, ""]] AssertDescription: >- ExistingAWSTransformAgentInvokeRoleArn is required (and must be a valid IAM role ARN) when CreateAWSTransformAgentInvokeRole is "false" # ----------------------------------------------------------------------------- # Resources # ----------------------------------------------------------------------------- Resources: # --------------------------------------------------------------------------- # CloudamizeJwtSecret - the Cloudamize JWT stored as a key/value JSON secret # {"CLOUDAMIZE_JWT_TOKEN": ""}, the exact shape the agent code reads # (cloudamize_client._parse_jwt_secret_string). Created only when # CreateJwtSecret is "true"; otherwise the stack reuses the secret named by # JwtSecretArn. The token comes from the NoEcho CloudamizeJwtToken parameter # so the raw value is never shown in the console or CloudFormation events. # --------------------------------------------------------------------------- CloudamizeJwtSecret: Type: AWS::SecretsManager::Secret Condition: ShouldCreateJwtSecret Properties: Name: !Ref JwtSecretName Description: >- Cloudamize JWT bearer token (JSON key CLOUDAMIZE_JWT_TOKEN) for the Cloudamize MCP Pull Agent. SecretString: !Sub '{"CLOUDAMIZE_JWT_TOKEN": "${CloudamizeJwtToken}"}' Tags: - Key: Project Value: cloudamize-mcp-pull-agent - Key: ManagedBy Value: cloudformation # --------------------------------------------------------------------------- # AgentCoreExecutionRole - assumed by bedrock-agentcore.amazonaws.com to run # the pull agent and orchestrator runtimes. Trust is scoped to this account # via aws:SourceAccount (Req 9.2), mirroring # deployments/infrastructure/aws/modules/iam/main.tf # (data.aws_iam_policy_document.agentcore_trust_policy). # --------------------------------------------------------------------------- AgentCoreExecutionRole: Type: AWS::IAM::Role Condition: ShouldCreateExecutionRole Properties: RoleName: !Ref AgentCoreExecutionRoleName Path: / Description: >- Bedrock AgentCore execution role for the Cloudamize MCP Pull Agent (AWS Marketplace variant) AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Sid: AssumeRolePolicy Effect: Allow Principal: Service: bedrock-agentcore.amazonaws.com Action: sts:AssumeRole Condition: StringEquals: aws:SourceAccount: !Ref AWS::AccountId ArnLike: aws:SourceArn: !Sub "arn:${AWS::Partition}:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:*" Policies: # Least-privilege Secrets Manager read, scoped to the customer's own # JWT secret ARN (Req 9.6) - not a wildcard - mirrors # modules/iam/main.tf aws_iam_role_policy.cloudamize_jwt_secret. - PolicyName: cloudamize-jwt-secret-read PolicyDocument: Version: "2012-10-17" Statement: - Sid: CloudamizeJWTSecretRead Effect: Allow Action: - secretsmanager:GetSecretValue - secretsmanager:DescribeSecret Resource: !If - ShouldCreateJwtSecret - !Ref CloudamizeJwtSecret - !Ref JwtSecretArn # CloudWatch Logs access, scoped to the bedrock-agentcore log group # naming convention in this account/region - mirrors # modules/iam/main.tf aws_iam_role_policy.cloudwatch_logs_access. - PolicyName: cloudwatch-logs-access PolicyDocument: Version: "2012-10-17" Statement: - Sid: CloudWatchLogsGroup Effect: Allow Action: - logs:CreateLogGroup - logs:DescribeLogStreams Resource: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/bedrock-agentcore/*" - Sid: CloudWatchLogsDescribeGroups Effect: Allow Action: - logs:DescribeLogGroups Resource: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:*" - Sid: CloudWatchLogsStream Effect: Allow Action: - logs:CreateLogStream - logs:PutLogEvents - logs:GetLogEvents Resource: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/bedrock-agentcore/*:log-stream:*" # Bedrock model invocation. resources = ["*"] is required here # because bedrock:InvokeModel does not support resource-level scoping # to a specific foundation/inference-profile ARN across all model # providers - this mirrors the Terraform precedent in # modules/iam/main.tf (data.aws_iam_policy_document.bedrock_model_access), # which also uses Resource "*" for the same reason. - PolicyName: bedrock-model-access PolicyDocument: Version: "2012-10-17" Statement: - Sid: BedrockModelAccess Effect: Allow Action: - bedrock:InvokeModel - bedrock:InvokeModelWithResponseStream Resource: "*" - Sid: MarketplaceModelAccess Effect: Allow Action: - aws-marketplace:ViewSubscriptions - aws-marketplace:Subscribe Resource: "*" # ECR image pull - AWS MARKETPLACE-MANAGED REGISTRY. # # The registry ACCOUNT is derived directly from the image URIs (the # leading "." segment), which for this Marketplace variant is # the AWS-owned Marketplace ECR account (e.g. 709825985650) rather than # Cloudamize's producer account. Because the ARN is derived from the # URI, updating the image URI automatically re-scopes this pull grant # to the correct Marketplace registry account - no separate account # parameter to keep in sync. Both image URIs are covered in case the # pull agent and orchestrator resolve to different registry accounts. # # The region segment is a wildcard (:ecr:*:) ON PURPOSE. ECR pulls are # region-bound: AgentCore pulls from the region encoded in the image # URI, which may differ from the stack's deploy region (AWS::Region), # and Marketplace distribution registries are commonly region-specific. # Scoping the ARN to AWS::Region would grant pull on the WRONG regional # ECR and deny the pull. The wildcard covers whatever region the URI # encodes while staying scoped to the specific registry account and to # ECR repositories only. # # MARKETPLACE ENTITLEMENT (key difference from the self-hosted # template): this identity-based grant is only one half of access. The # OTHER half - the resource-based permission on the Marketplace # repository - is managed AUTOMATICALLY BY AWS MARKETPLACE based on the # buyer's SUBSCRIPTION to the Cloudamize product. Cloudamize does NOT # attach or maintain a per-customer ECR repository policy for this # variant; if the buyer's subscription is active, AWS grants the pull, # and if it lapses, AWS revokes it. ecr:GetAuthorizationToken has no # resource-level permissions and must be granted on "*" per AWS IAM # documentation for Amazon ECR actions. - PolicyName: ecr-pull-image-registry PolicyDocument: Version: "2012-10-17" Statement: - Sid: ECRImagePull Effect: Allow Action: - ecr:BatchGetImage - ecr:GetDownloadUrlForLayer - ecr:BatchCheckLayerAvailability Resource: - !Sub - "arn:${AWS::Partition}:ecr:*:${EcrAccount}:repository/*" - EcrAccount: !Select [0, !Split [".", !Ref PullAgentImageUri]] - !Sub - "arn:${AWS::Partition}:ecr:*:${EcrAccount}:repository/*" - EcrAccount: !Select [0, !Split [".", !Ref OrchestratorImageUri]] - Sid: ECRGetAuthorizationToken Effect: Allow Action: - ecr:GetAuthorizationToken Resource: "*" # AWS Transform Agentic API access required by the running agent # runtime (GetAgentInstance, UpdateJobStatus, SendMessage, etc). # transform-agents:* on Resource "*" mirrors the Terraform baseline # in modules/iam/main.tf # (data.aws_iam_policy_document.transform_agents_access), which # follows the canonical minimal IAM policy from the AWS Transform # Agent Builder Developer Guide. - PolicyName: transform-agents-access PolicyDocument: Version: "2012-10-17" Statement: - Sid: TransformAgentsApiPolicy Effect: Allow Action: - transform-agents:* Resource: "*" # --------------------------------------------------------------------------- # AWSTransformAgentInvokeRole - assumed by AWS Transform's Elastic Gumby # compute service to invoke the Bedrock AgentCore runtimes (Req 9.3), # mirroring modules/iam/main.tf # (data.aws_iam_policy_document.transform_invoke_trust_policy). # --------------------------------------------------------------------------- AWSTransformAgentInvokeRole: Type: AWS::IAM::Role Condition: ShouldCreateInvokeRole Properties: RoleName: !Ref AWSTransformAgentInvokeRoleName Path: / Description: Allows AWS Transform to invoke the Cloudamize AgentCore runtimes AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Sid: AssumeRolePolicy Effect: Allow Principal: # When no explicit principal is supplied, trust BOTH known AWS # Transform invoke principals: the public service principal # transform-agents.amazonaws.com (used by the published AWS # Marketplace AgentCore agents) AND the regional elastic-gumby # compute principal. Which one Transform actually assumes with # can vary by integration path; trusting both rules out an # "assume-role denied -> cannot invoke runtime -> Something went # wrong communicating with the agent" failure. An extra trusted # principal that never assumes is harmless. Supply an explicit # TransformInvokeTrustPrincipal to override with a single value. Service: !If - UseRegionDerivedInvokePrincipal - - transform-agents.amazonaws.com - !Sub "prod.${AWS::Region}.compute.elastic-gumby.aws.internal" - !Ref TransformInvokeTrustPrincipal Action: sts:AssumeRole Policies: # Least-privilege invoke permissions, scoped to this account's # bedrock-agentcore runtimes rather than a wildcard resource - # mirrors modules/iam/main.tf # (data.aws_iam_policy_document.transform_invoke_runtime). - PolicyName: invoke-agent-runtime PolicyDocument: Version: "2012-10-17" Statement: - Sid: InvokeAgentRuntime Effect: Allow Action: - bedrock-agentcore:InvokeAgentRuntime - bedrock-agentcore:GetAgentRuntime - bedrock-agentcore:GetAgentRuntimeEndpoint Resource: !Sub "arn:${AWS::Partition}:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:runtime/*" # --------------------------------------------------------------------------- # Bedrock AgentCore runtimes - one for the pull agent (Subagent), one for # the orchestrator (Req 9.1, 9.4). Both bind to the Unified_Agent_Set # through the AWS Transform configuration flow after this stack completes. # Mirrors deployments/infrastructure/aws/agentcore.tf # (aws_bedrockagentcore_agent_runtime). # --------------------------------------------------------------------------- PullAgentRuntime: Type: AWS::BedrockAgentCore::Runtime Properties: AgentRuntimeName: !Ref PullAgentRuntimeName Description: Cloudamize MCP Pull Agent - migration discovery subagent (AWS Marketplace variant) RoleArn: !If - ShouldCreateExecutionRole - !GetAtt AgentCoreExecutionRole.Arn - !Ref ExistingAgentCoreExecutionRoleArn AgentRuntimeArtifact: ContainerConfiguration: ContainerUri: !Ref PullAgentImageUri NetworkConfiguration: NetworkMode: !Ref NetworkMode EnvironmentVariables: # Consumed by cloudamize_client._get_jwt_token_from_secrets_manager via # os.environ["CLOUDAMIZE_JWT_SECRET_ID"] (the local-dev Secrets Manager # fallback). GetSecretValue accepts a full ARN as SecretId, so the ARN # value is passed under the same env name the code and Terraform use. CLOUDAMIZE_JWT_SECRET_ID: !If - ShouldCreateJwtSecret - !Ref CloudamizeJwtSecret - !Ref JwtSecretArn # AWS_REGION is injected from the stack's deploy region so the SDK and # boto3 clients target the correct regional endpoints. AWS_REGION: !Ref AWS::Region # STAGE is required by the agent_builder_sdk client factory to resolve # the Agentic API endpoint (along with AWS_REGION). Without it the SDK # raises "Either endpoint_url or both stage and region must be provided" # during the AgentCore initialization phase (before the application # code's setdefault runs). Set explicitly to avoid this race. STAGE: prod Tags: Project: cloudamize-mcp-pull-agent Component: cloudamize-data-pull-agent ManagedBy: cloudformation OrchestratorRuntime: Type: AWS::BedrockAgentCore::Runtime Properties: AgentRuntimeName: !Ref OrchestratorRuntimeName Description: Cloudamize Migration Orchestrator - chat-selectable job orchestrator (AWS Marketplace variant) RoleArn: !If - ShouldCreateExecutionRole - !GetAtt AgentCoreExecutionRole.Arn - !Ref ExistingAgentCoreExecutionRoleArn AgentRuntimeArtifact: ContainerConfiguration: ContainerUri: !Ref OrchestratorImageUri NetworkConfiguration: NetworkMode: !Ref NetworkMode EnvironmentVariables: # Matches the env var name the agent code and Terraform use # (CLOUDAMIZE_JWT_SECRET_ID); GetSecretValue accepts a full ARN value. CLOUDAMIZE_JWT_SECRET_ID: !If - ShouldCreateJwtSecret - !Ref CloudamizeJwtSecret - !Ref JwtSecretArn # AWS_REGION is injected from the stack's deploy region. AWS_REGION: !Ref AWS::Region # STAGE is required by the agent_builder_sdk client factory to resolve # the Agentic API endpoint (along with AWS_REGION). Without it the SDK # raises "Either endpoint_url or both stage and region must be provided" # during the AgentCore initialization phase (before the application # code's setdefault runs). Set explicitly to avoid this race. STAGE: prod Tags: Project: cloudamize-mcp-pull-agent Component: cloudamize-migration-orchestrator ManagedBy: cloudformation # ----------------------------------------------------------------------------- # Outputs # ----------------------------------------------------------------------------- Outputs: AgentCoreExecutionRoleArn: Description: >- ARN of the AgentCoreExecutionRole used by both runtimes (either newly created by this stack or the existing role you supplied). Value: !If - ShouldCreateExecutionRole - !GetAtt AgentCoreExecutionRole.Arn - !Ref ExistingAgentCoreExecutionRoleArn AWSTransformAgentInvokeRoleArn: Description: >- ARN of the AWSTransformAgentInvokeRole (either newly created by this stack or the existing role you supplied). Provide this ARN during the AWS Transform configuration flow when binding the runtime. Value: !If - ShouldCreateInvokeRole - !GetAtt AWSTransformAgentInvokeRole.Arn - !Ref ExistingAWSTransformAgentInvokeRoleArn CloudamizeJwtSecretArn: Description: >- ARN of the Cloudamize JWT secret the runtimes read (either newly created by this stack from CloudamizeJwtToken, or the existing JwtSecretArn you supplied). Value: !If - ShouldCreateJwtSecret - !Ref CloudamizeJwtSecret - !Ref JwtSecretArn PullAgentRuntimeArn: Description: ARN of the pull agent (Subagent) Bedrock AgentCore runtime. Value: !Ref PullAgentRuntime OrchestratorRuntimeArn: Description: ARN of the orchestrator Bedrock AgentCore runtime. Value: !Ref OrchestratorRuntime