:Manage credentials

Overview

Credentials store the authentication information required to access external services. AgentCore must authenticate with external services such as model providers through credentials before it can invoke their capabilities. Currently, credentials are supported in key-value format and provided as environment variables.

Security risks of exposing credentials

Credentials such as API keys are equivalent to identity keys for accessing external services. If leaked, others can use the credential to invoke the corresponding service, which may cause financial losses, quota consumption, data breaches, or service abuse.

To reduce risks, we recommend that you follow these practices:

• Do not expose credentials in plaintext in code repositories, logs, screenshots, chats, or tickets.

• Follow the principle of least privilege and use separate credentials for different purposes or environments.

• Rotate credentials regularly. If you suspect a leak, immediately revoke the original credential on the provider side and replace it with a new one.

AgentCore provides centralized credential management to effectively reduce these risks. Credentials are stored centrally in the Workspace and referenced or bound by resources such as Agents on demand, eliminating the need to repeatedly fill in credentials in multiple places or hardcode them in plaintext, thereby reducing the exposure surface of credentials.

Create a credential

1. Sign in to the AgentCore console.

2. In the left navigation pane, click Credential Management.

3. In the upper-right corner, click Create Credential.

4. Configure the following parameters:

Manage credentials