AWS Bedrock Agents Adapter

npm install @tealtiger/bedrock-agents-adapter

// action-group-handler.ts
import { TealTigerBedrockAdapter } from '@tealtiger/bedrock-agents-adapter';
import { TealEngine } from 'tealtiger';

const engine = new TealEngine({
  policy: {
    rules: [
      { condition: { action: 'database.delete' }, automation: 'auto_deny' },
      { condition: { action: 'payment.*', amount: { gt: 100 } }, automation: 'approval_required' }
    ]
  },
  freeze: [
    { id: 'FREEZE-001', condition: { action: 'system.*' }, reason: 'FREEZE_SYSTEM_ACCESS', severity: 'critical' }
  ]
});

const adapter = new TealTigerBedrockAdapter({
  engine,
  agentAliasId: process.env.AGENT_ALIAS_ID,
  evidenceBucket: 'tealtiger-evidence-prod',
  onDeny: 'return_message'  // Return denial message to agent
});

// Wrap your handler
export const handler = adapter.wrap(async (event, context) => {
  // Your existing action group logic
  const { actionGroup, function: fn, parameters } = event;

  // This code only runs if TealTiger allows the action
  const result = await executeAction(actionGroup, fn, parameters);
  return result;
});

import { TealTigerBedrockAdapter } from '@tealtiger/bedrock-agents-adapter';

const adapter = new TealTigerBedrockAdapter({
  engine,
  mode: 'sidecar',
  port: 8090,
  healthCheck: '/health'
});

// Adapter exposes HTTP endpoint for governance checks
// Bedrock Agent → Sidecar (localhost:8090/evaluate) → Action Group
await adapter.start();

interface BedrockAdapterOptions {
  /** TealEngine instance */
  engine: TealEngine;

  /** Bedrock Agent Alias ID (for identification) */
  agentAliasId?: string;

  /** S3 bucket for evidence storage */
  evidenceBucket?: string;

  /** Behavior on DENY decision */
  onDeny: 'return_message' | 'throw_error' | 'silent_block';

  /** Deployment mode */
  mode?: 'lambda_layer' | 'sidecar';

  /** Map Bedrock action groups to TealTiger actions */
  actionMapping?: Record<string, string>;

  /** Extract agent identity from Bedrock session */
  identityExtractor?: (event: BedrockAgentEvent) => NHIIdentity;

  /** Cost tracking integration */
  costTracking?: {
    enabled: boolean;
    /** Track Bedrock model invocation costs */
    trackModelCosts: boolean;
    /** Track action group Lambda costs */
    trackLambdaCosts: boolean;
  };
}

const adapter = new TealTigerBedrockAdapter({
  engine,
  actionMapping: {
    // ActionGroup::Function → TealTiger action
    'CustomerService::lookupOrder': 'order.read',
    'CustomerService::processRefund': 'payment.refund',
    'DatabaseOps::executeQuery': 'database.query',
    'DatabaseOps::deleteRecord': 'database.delete',
    'KnowledgeBase::retrieve': 'kb.search'
  }
});

const adapter = new TealTigerBedrockAdapter({
  engine,
  evidenceBucket: 'tealtiger-evidence-prod',
  evidenceConfig: {
    prefix: 'bedrock-agents/',
    format: 'json',  // or 'sarif'
    partitioning: 'date',  // s3://bucket/bedrock-agents/2026/06/01/
    encryption: 'aws:kms',
    kmsKeyId: 'arn:aws:kms:us-east-1:123456789:key/abc-123'
  }
});

TealTiger/BedrockAgents/Evaluations (count)
TealTiger/BedrockAgents/Denials (count)
TealTiger/BedrockAgents/LatencyMs (p50, p99)
TealTiger/BedrockAgents/CostUSD (sum)
TealTiger/BedrockAgents/DriftScore (avg)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::tealtiger-evidence-prod/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:PutMetricData"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": { "cloudwatch:namespace": "TealTiger/BedrockAgents" }
      }
    },
    {
      "Effect": "Allow",
      "Action": ["kms:GenerateDataKey", "kms:Decrypt"],
      "Resource": "arn:aws:kms:us-east-1:123456789:key/abc-123"
    }
  ]
}