Resource Type: AWS > Bedrock AgentCore > OAuth2 Credential Provider

The Amazon Bedrock AgentCore OAuth2 Credential Provider resource holds the configuration (vendor, clientId, discovery URLs) used by an Agent Runtime to obtain OAuth2 tokens from an external identity provider on behalf of users or workloads. The OAuth2 client secret is stored in AWS Secrets Manager; the provider itself is metadata-only and is never serialised into Guardrails CMDB.

Resource Context

OAuth2 Credential Provider is a part of the Bedrock AgentCore service.

Each OAuth2 Credential Provider lives under a Region.

Controls

The primary controls for AWS > Bedrock AgentCore > OAuth2 Credential Provider are:

Quick Actions

In Your Workspace

Developers

Resource Type URI

tmod:@turbot/aws-bedrockagentcore#/resource/types/oauth2CredentialProvider

Category URI

tmod:@turbot/turbot#/resource/categories/iam

GraphQL

query resource(id: "tmod:@turbot/aws-bedrockagentcore#/resource/types/oauth2CredentialProvider") { … }

query resourceActivities(filter: "resourceId:'tmod:@turbot/aws-bedrockagentcore#/resource/types/oauth2CredentialProvider'") { … }

mutation createResource(input: { … })

mutation updateResource(input: { … })

CLI

Get Resource

turbot graphql resource --id "tmod:@turbot/aws-bedrockagentcore#/resource/types/oauth2CredentialProvider"

Steampipe Query

Get Resource

select * from guardrails_resource where resource_type_uri = 'tmod:@turbot/aws-bedrockagentcore#/resource/types/oauth2CredentialProvider';

Get Policy Settings (By Resource ID)

select * from guardrails_policy_setting where filter = 'resourceTypeId:"tmod:@turbot/aws-bedrockagentcore#/resource/types/oauth2CredentialProvider"';

Get Resource Notification

select * from guardrails_notification where resource_type_uri = 'tmod:@turbot/aws-bedrockagentcore#/resource/types/oauth2CredentialProvider' and notification_type in ('resource_updated', 'resource_created');