agentcore-cli 0.31.1__py3-none-any.whl

agentcore/cli/commands/import_/import_gateway.py

@@ -0,0 +1,520 @@
+"""`agentcore import gateway` (port of commands/import/import-gateway.ts)."""
+
+from __future__ import annotations
+
+import copy
+import sys
+from collections.abc import Callable
+from typing import Any
+
+import typer
+
+from agentcore.aws import agentcore_control
+from agentcore.cli.commands.add._common import first_issue
+from agentcore.cli.constants import ANSI
+from agentcore.cli.errors import is_access_denied_error
+from agentcore.lib.errors.types import to_error
+from agentcore.lib.schemas.io.config_io import to_jsonable
+from agentcore.schema import GatewayName
+
+from . import import_pipeline
+from .import_runtime import print_failure, print_success
+from .import_utils import (
+    ImportContext,
+    ImportedResource,
+    fail_result,
+    find_resource_in_deployed_state,
+    parse_and_validate_arn,
+    resolve_import_context,
+    strip_reserved_tags,
+    to_stack_name,
+)
+from .template_utils import find_logical_id_by_property, find_logical_ids_by_type
+from .types import ImportResourceOptions, ImportResourceResult, ResourceToImport
+
+Progress = Callable[[str], None]
+
+
+# ============================================================================
+# AWS -> CLI schema mapping
+# ============================================================================
+
+
+def _schema_target(detail: dict[str, Any], target_type: str, schema: dict[str, Any], auth: Any, progress: Progress):
+    s3 = schema.get("s3") or {}
+    if s3.get("uri"):
+        source: dict[str, Any] = {"uri": s3["uri"]}
+        if s3.get("bucketOwnerAccountId"):
+            source["bucketOwnerAccountId"] = s3["bucketOwnerAccountId"]
+        target = {"name": detail["name"], "targetType": target_type, "schemaSource": {"s3": source}}
+        if auth:
+            target["outboundAuth"] = auth
+        return target
+    progress(f'Warning: Target "{detail["name"]}" ({target_type}) has no S3 URI, skipping')
+    return None
+
+
+def to_gateway_target_spec(  # noqa: PLR0911
+    detail: dict[str, Any],
+    credentials: dict[str, str],
+    on_progress: Progress,
+    runtime_arn_to_name: dict[str, str] | None = None,
+) -> dict[str, Any] | None:
+    """Map a GetGatewayTarget response to a local gateway target; None (with a message) when unsupported."""
+    config = detail.get("targetConfiguration") or {}
+    http = config.get("http")
+    if http:
+        runtime_config = http.get("agentcoreRuntime") or http.get("runtimeTargetConfiguration")
+        if runtime_config:
+            managed = (runtime_arn_to_name or {}).get(runtime_config["runtimeArn"])
+            if not managed:
+                on_progress(
+                    f'Error: Target "{detail["name"]}" references runtime "{runtime_config["runtimeArn"]}" which is '
+                    "not managed by this project. Import the runtime first: agentcore import runtime --arn "
+                    f"{runtime_config['runtimeArn']}"
+                )
+                return None
+            http_runtime: dict[str, Any] = {"runtime": managed}
+            if runtime_config.get("qualifier"):
+                http_runtime["runtimeEndpoint"] = runtime_config["qualifier"]
+            return {"name": detail["name"], "targetType": "httpRuntime", "httpRuntime": http_runtime}
+        on_progress(f'Warning: Target "{detail["name"]}" has HTTP configuration but no runtime, skipping')
+        return None
+
+    mcp = config.get("mcp")
+    if not mcp:
+        on_progress(f'Warning: Target "{detail["name"]}" has no MCP or HTTP configuration, skipping')
+        return None
+
+    auth = resolve_outbound_auth(detail, credentials, on_progress)
+
+    if mcp.get("mcpServer"):
+        target = {"name": detail["name"], "targetType": "mcpServer", "endpoint": mcp["mcpServer"]["endpoint"]}
+        if auth:
+            target["outboundAuth"] = auth
+        return target
+
+    if mcp.get("apiGateway"):
+        apigw = mcp["apiGateway"]
+        tool_config = apigw.get("apiGatewayToolConfiguration") or {}
+        api_config: dict[str, Any] = {
+            "toolFilters": [
+                {"filterPath": f.get("filterPath"), "methods": f.get("methods")}
+                for f in tool_config.get("toolFilters") or []
+            ]
+        }
+        if tool_config.get("toolOverrides"):
+            overrides = []
+            for o in tool_config["toolOverrides"]:
+                entry = {"name": o.get("name"), "path": o.get("path"), "method": o.get("method")}
+                if o.get("description"):
+                    entry["description"] = o["description"]
+                overrides.append(entry)
+            api_config["toolOverrides"] = overrides
+        target = {
+            "name": detail["name"],
+            "targetType": "apiGateway",
+            "apiGateway": {
+                "restApiId": apigw.get("restApiId"),
+                "stage": apigw.get("stage"),
+                "apiGatewayToolConfiguration": api_config,
+            },
+        }
+        if auth:
+            target["outboundAuth"] = auth
+        return target
+
+    if mcp.get("openApiSchema"):
+        return _schema_target(detail, "openApiSchema", mcp["openApiSchema"], auth, on_progress)
+    if mcp.get("smithyModel"):
+        return _schema_target(detail, "smithyModel", mcp["smithyModel"], auth, on_progress)
+
+    if mcp.get("lambda"):
+        lambda_arn = mcp["lambda"].get("lambdaArn")
+        if not lambda_arn:
+            on_progress(f'Warning: Target "{detail["name"]}" (lambda) has no ARN, skipping')
+            return None
+        s3_uri = ((mcp["lambda"].get("toolSchema") or {}).get("s3") or {}).get("uri")
+        if s3_uri:
+            on_progress(f'Mapping compute-backed Lambda target "{detail["name"]}" to lambdaFunctionArn type')
+            target = {
+                "name": detail["name"],
+                "targetType": "lambdaFunctionArn",
+                "lambdaFunctionArn": {"lambdaArn": lambda_arn, "toolSchemaFile": s3_uri},
+            }
+            if auth:
+                target["outboundAuth"] = auth
+            return target
+        on_progress(
+            f'Warning: Target "{detail["name"]}" (lambda) has inline tool schema, which cannot be imported. Skipping.'
+        )
+        return None
+
+    on_progress(f'Warning: Target "{detail["name"]}" has an unrecognized target type, skipping')
+    return None
+
+
+def resolve_outbound_auth(
+    detail: dict[str, Any], credentials: dict[str, str], _on_progress: Progress
+) -> dict[str, Any] | None:
+    for config in detail.get("credentialProviderConfigurations") or []:
+        provider = config.get("credentialProvider") or {}
+        if config.get("credentialProviderType") == "OAUTH" and provider.get("oauthCredentialProvider"):
+            oauth = provider["oauthCredentialProvider"]
+            name = credentials.get(oauth.get("providerArn"))
+            if name:
+                auth: dict[str, Any] = {"type": "OAUTH", "credentialName": name}
+                if oauth.get("scopes"):
+                    auth["scopes"] = oauth["scopes"]
+                return auth
+            raise ValueError(
+                f'Target "{detail["name"]}" uses an OAuth credential provider not found in this project\'s deployed '
+                "state. Import the credential first with `agentcore add credential` and re-run."
+            )
+        if config.get("credentialProviderType") == "API_KEY" and provider.get("apiKeyCredentialProvider"):
+            name = credentials.get(provider["apiKeyCredentialProvider"].get("providerArn"))
+            if name:
+                return {"type": "API_KEY", "credentialName": name}
+            raise ValueError(
+                f'Target "{detail["name"]}" uses an API Key credential provider not found in this project\'s deployed '
+                "state. Import the credential first with `agentcore add credential` and re-run."
+            )
+        # GATEWAY_IAM_ROLE: no outbound auth needed
+    return None
+
+
+def _map_claim(c: dict[str, Any]) -> dict[str, Any]:
+    match_value = c["authorizingClaimMatchValue"]["claimMatchValue"]
+    value: dict[str, Any] = {}
+    if match_value.get("matchValueString"):
+        value["matchValueString"] = match_value["matchValueString"]
+    if match_value.get("matchValueStringList"):
+        value["matchValueStringList"] = match_value["matchValueStringList"]
+    return {
+        "inboundTokenClaimName": c["inboundTokenClaimName"],
+        "inboundTokenClaimValueType": c["inboundTokenClaimValueType"],
+        "authorizingClaimMatchValue": {
+            "claimMatchOperator": c["authorizingClaimMatchValue"]["claimMatchOperator"],
+            "claimMatchValue": value,
+        },
+    }
+
+
+def to_gateway_spec(gateway: dict[str, Any], targets: list[dict[str, Any]], local_name: str) -> dict[str, Any]:
+    authorizer_type = gateway.get("authorizerType") or "NONE"
+    authorizer_configuration = None
+    jwt = (gateway.get("authorizerConfiguration") or {}).get("customJwtAuthorizer")
+    if authorizer_type == "CUSTOM_JWT" and jwt:
+        out: dict[str, Any] = {"discoveryUrl": jwt.get("discoveryUrl")}
+        for key in ("allowedAudience", "allowedClients", "allowedScopes"):
+            if jwt.get(key):
+                out[key] = jwt[key]
+        if jwt.get("customClaims"):
+            out["customClaims"] = [_map_claim(c) for c in jwt["customClaims"]]
+        authorizer_configuration = {"customJwtAuthorizer": out}
+
+    # The service returns protocolType "MCP" or null; null means a non-MCP gateway.
+    protocol_type = "MCP" if gateway.get("protocolType") == "MCP" else "None"
+    search_type = (((gateway.get("protocolConfiguration") or {}).get("mcp")) or {}).get("searchType")
+
+    policy_engine_configuration = None
+    pec = gateway.get("policyEngineConfiguration")
+    if pec:
+        parts = pec["arn"].split("/")
+        policy_engine_configuration = {"policyEngineName": parts[-1] or pec["arn"], "mode": pec.get("mode")}
+
+    spec: dict[str, Any] = {"name": local_name, "resourceName": gateway["name"]}
+    if protocol_type == "None":
+        spec["protocolType"] = "None"
+    if gateway.get("description"):
+        spec["description"] = gateway["description"]
+    spec["targets"] = targets
+    spec["authorizerType"] = authorizer_type
+    if authorizer_configuration:
+        spec["authorizerConfiguration"] = authorizer_configuration
+    spec["enableSemanticSearch"] = search_type == "SEMANTIC"
+    spec["exceptionLevel"] = "DEBUG" if gateway.get("exceptionLevel") == "DEBUG" else "NONE"
+    if policy_engine_configuration:
+        spec["policyEngineConfiguration"] = policy_engine_configuration
+    if gateway.get("roleArn"):
+        spec["executionRoleArn"] = gateway["roleArn"]
+    tags = strip_reserved_tags(gateway.get("tags"))
+    if tags:
+        spec["tags"] = tags
+    return spec
+
+
+def _state_dict(config_io: Any) -> dict[str, Any]:
+    return to_jsonable(config_io.read_deployed_state())
+
+
+def build_credential_arn_map(config_io: Any, target_name: str) -> dict[str, str]:
+    """Credential provider ARN -> credential name, from the deployed state."""
+    result: dict[str, str] = {}
+    try:
+        state = _state_dict(config_io)
+        creds = (((state.get("targets") or {}).get(target_name) or {}).get("resources") or {}).get("credentials")
+        if isinstance(creds, dict):
+            for name, entry in creds.items():
+                arn = (entry or {}).get("credentialProviderArn")
+                if isinstance(arn, str):
+                    result[arn] = name
+    except Exception:  # noqa: BLE001 - no deployed state: credentials won't be resolved
+        pass
+    return result
+
+
+# ============================================================================
+# Import flow
+# ============================================================================
+
+
+def handle_import_gateway(options: ImportResourceOptions) -> ImportResourceResult:  # noqa: C901, PLR0911, PLR0912, PLR0915
+    config_snapshot: dict[str, Any] | None = None
+    config_written = False
+    import_ctx: ImportContext | None = None
+
+    def rollback() -> None:
+        if config_written and config_snapshot is not None and import_ctx is not None:
+            try:
+                import_ctx.ctx.config_io.write_project_spec(config_snapshot)
+            except Exception as exc:  # noqa: BLE001
+                print(f"Warning: Could not restore agentcore.json: {exc}", file=sys.stderr)
+
+    try:
+        import_ctx = resolve_import_context(options, "import-gateway")
+        ctx, target, logger, on_progress = import_ctx.ctx, import_ctx.target, import_ctx.logger, import_ctx.on_progress
+        region = target["region"]
+
+        logger.start_step("Fetch gateway from AWS")
+        if options.arn:
+            gateway_id = parse_and_validate_arn(options.arn, "gateway", target).resource_id
+        else:
+            on_progress("Listing gateways in your account...")
+            summaries = agentcore_control.list_all_gateways(region=region)
+            if not summaries:
+                return fail_result(logger, "No gateways found in your account.", "gateway", "")
+            if len(summaries) == 1:
+                gateway_id = summaries[0]["gatewayId"]
+                on_progress(f"Found 1 gateway: {summaries[0]['name']} ({gateway_id}). Auto-selecting.")
+            else:
+                print(f"\nFound {len(summaries)} gateway(s):\n")
+                for i, s in enumerate(summaries):
+                    print(
+                        f"  {ANSI.dim}[{i + 1}]{ANSI.reset} {s['name']} — {s['status']}\n"
+                        f"       {ANSI.dim}{s['gatewayId']} ({s['authorizerType']}){ANSI.reset}"
+                    )
+                print("")
+                return fail_result(
+                    logger,
+                    "Multiple gateways found. Use --arn <arn> to specify which gateway to import.",
+                    "gateway",
+                    "",
+                )
+
+        on_progress(f"Fetching gateway details for {gateway_id}...")
+        try:
+            gateway_detail = agentcore_control.get_gateway_detail(region=region, gateway_id=gateway_id)
+        except Exception as exc:
+            if is_access_denied_error(exc):
+                return fail_result(
+                    logger,
+                    f'Gateway "{gateway_id}" could not be found in region {region}. AWS returned AccessDenied, which '
+                    "for this service typically means the gateway does not exist, the ARN is malformed, or your "
+                    "credentials lack bedrock-agentcore:GetGateway permission. Verify the ARN with: aws "
+                    f"bedrock-agentcore-control list-gateways --region {region}",
+                    "gateway",
+                    options.name or "",
+                )
+            raise
+        if gateway_detail["status"] != "READY":
+            on_progress(f"Warning: Gateway status is {gateway_detail['status']}, not READY")
+
+        on_progress("Listing gateway targets...")
+        target_summaries = agentcore_control.list_all_gateway_targets(region=region, gateway_id=gateway_id)
+        on_progress(f"Found {len(target_summaries)} target(s) for gateway")
+        target_details = [
+            agentcore_control.get_gateway_target_detail(region=region, gateway_id=gateway_id, target_id=ts["targetId"])
+            for ts in target_summaries
+        ]
+        logger.end_step("success")
+
+        logger.start_step("Validate name")
+        local_name = options.name if options.name is not None else gateway_detail["name"]
+        issue = first_issue(GatewayName, local_name)
+        if issue:
+            return fail_result(logger, f'Invalid name "{local_name}". {issue}', "gateway", local_name)
+        on_progress(f"Gateway: {gateway_detail['name']} -> local name: {local_name}")
+        logger.end_step("success")
+
+        logger.start_step("Check for duplicates")
+        project_spec = to_jsonable(ctx.config_io.read_project_spec())
+        if local_name in {g["name"] for g in project_spec.get("agentCoreGateways", [])}:
+            return fail_result(
+                logger,
+                f'Gateway "{local_name}" already exists in the project. Use --name to specify a different local name.',
+                "gateway",
+                local_name,
+            )
+        target_name = target.get("name") or "default"
+        existing = find_resource_in_deployed_state(ctx.config_io, target_name, "gateway", gateway_id)
+        is_reimport = bool(existing)
+        if existing:
+            if not options.name:
+                local_name = existing
+            on_progress("Gateway already managed by CloudFormation — re-adding to project config")
+        logger.end_step("success")
+
+        logger.start_step("Map gateway to project schema")
+        credential_arn_map = build_credential_arn_map(ctx.config_io, target_name)
+        runtime_arn_to_name: dict[str, str] = {}
+        try:
+            state = _state_dict(ctx.config_io)
+            runtimes = (((state.get("targets") or {}).get(target_name) or {}).get("resources") or {}).get("runtimes")
+            for name, rt in (runtimes or {}).items():
+                runtime_arn_to_name[rt["runtimeArn"]] = name
+        except Exception:  # noqa: BLE001
+            pass
+
+        mapped: list[dict[str, Any]] = []
+        unmanaged: list[str] = []
+        for td in target_details:
+            http = (td.get("targetConfiguration") or {}).get("http")
+            runtime_config = (http or {}).get("agentcoreRuntime") or (http or {}).get("runtimeTargetConfiguration")
+            if http and runtime_config and runtime_config["runtimeArn"] not in runtime_arn_to_name:
+                unmanaged.append(runtime_config["runtimeArn"])
+            spec = to_gateway_target_spec(td, credential_arn_map, on_progress, runtime_arn_to_name)
+            if spec:
+                mapped.append(spec)
+
+        if unmanaged:
+            arns = list(dict.fromkeys(unmanaged))
+            cmds = "\n".join(f"  agentcore import runtime --arn {a}" for a in arns)
+            return fail_result(
+                logger,
+                f"Gateway has {len(unmanaged)} httpRuntime target(s) referencing runtimes not managed by this project.\n"
+                f"Import the runtime(s) first:\n{cmds}\n\nThen retry: agentcore import gateway --arn "
+                f"{options.arn or gateway_detail['gatewayArn']}",
+                "gateway",
+                local_name,
+            )
+
+        gateway_spec = to_gateway_spec(gateway_detail, mapped, local_name)
+        on_progress(f"Mapped gateway with {len(mapped)} target(s)")
+        if len(mapped) < len(target_details):
+            on_progress(f"Warning: {len(target_details) - len(mapped)} target(s) could not be mapped and were skipped")
+        logger.end_step("success")
+
+        logger.start_step("Update project config")
+        config_snapshot = copy.deepcopy(project_spec)
+        project_spec.setdefault("agentCoreGateways", []).append(gateway_spec)
+        ctx.config_io.write_project_spec(project_spec)
+        config_written = True
+        on_progress(f'Added gateway "{local_name}" to agentcore.json')
+        logger.end_step("success")
+
+        logger.start_step("Build and synth CDK")
+        stack_name = to_stack_name(ctx.project_name, target_name)
+        mapped_names = {m["name"] for m in mapped}
+        target_id_map = {td["name"]: td["targetId"] for td in target_details if td["name"] in mapped_names}
+
+        def build_resources(synth: dict[str, Any], deployed: dict[str, Any]) -> list[ResourceToImport]:
+            deployed_ids = set(deployed.get("Resources", {}).keys())
+            gw_type = "AWS::BedrockAgentCore::Gateway"
+            logical_id = find_logical_id_by_property(
+                synth, gw_type, "Name", f"{ctx.project_name}-{local_name}", exclude_logical_ids=deployed_ids
+            ) or find_logical_id_by_property(synth, gw_type, "Name", local_name, exclude_logical_ids=deployed_ids)
+            if not logical_id:
+                candidates = [i for i in find_logical_ids_by_type(synth, gw_type) if i not in deployed_ids]
+                if len(candidates) == 1:
+                    logical_id = candidates[0]
+            if not logical_id:
+                return []
+            resources = [ResourceToImport(gw_type, logical_id, {"GatewayIdentifier": gateway_id})]
+
+            tgt_type = "AWS::BedrockAgentCore::GatewayTarget"
+            candidate_targets = [i for i in find_logical_ids_by_type(synth, tgt_type) if i not in deployed_ids]
+            for t_name, t_id in target_id_map.items():
+                t_logical = find_logical_id_by_property(
+                    synth, tgt_type, "Name", t_name, exclude_logical_ids=deployed_ids
+                )
+                if not t_logical and len(candidate_targets) == 1 and len(target_id_map) == 1:
+                    t_logical = candidate_targets[0]
+                if t_logical:
+                    resources.append(
+                        ResourceToImport(tgt_type, t_logical, {"GatewayIdentifier": gateway_id, "TargetId": t_id})
+                    )
+                else:
+                    on_progress(f'Warning: Could not find logical ID for target "{t_name}" in CloudFormation template')
+            return resources
+
+        pipeline = import_pipeline.execute_cdk_import_pipeline(
+            project_root=ctx.project_root,
+            stack_name=stack_name,
+            target=target,
+            config_io=ctx.config_io,
+            target_name=target_name,
+            on_progress=on_progress,
+            build_resources_to_import=build_resources,
+            deployed_state_entries=[ImportedResource("gateway", local_name, gateway_id, gateway_detail["gatewayArn"])],
+        )
+
+        if pipeline.no_resources:
+            if is_reimport:
+                logger.end_step("success")
+                logger.finalize(True)
+                return ImportResourceResult(
+                    True, "gateway", local_name, resource_id=gateway_id, log_path=logger.get_relative_log_path()
+                )
+            rollback()
+            return fail_result(
+                logger,
+                f'Could not find logical ID for gateway "{local_name}" in CloudFormation template',
+                "gateway",
+                local_name,
+            )
+        if not pipeline.success:
+            rollback()
+            logger.end_step("error", pipeline.error)
+            logger.finalize(False)
+            return ImportResourceResult(
+                False,
+                "gateway",
+                local_name,
+                error=Exception(pipeline.error or "Pipeline failed"),
+                log_path=logger.get_relative_log_path(),
+            )
+        logger.end_step("success")
+        logger.finalize(True)
+        return ImportResourceResult(
+            True, "gateway", local_name, resource_id=gateway_id, log_path=logger.get_relative_log_path()
+        )
+    except Exception as exc:  # noqa: BLE001
+        rollback()
+        if import_ctx is not None:
+            import_ctx.logger.log(str(exc), "error")
+            import_ctx.logger.finalize(False)
+        return ImportResourceResult(
+            False,
+            "gateway",
+            options.name or "",
+            error=to_error(exc),
+            log_path=import_ctx.logger.get_relative_log_path() if import_ctx else None,
+        )
+
+
+GATEWAY_NEXT_STEPS = [
+    ("agentcore deploy     ", "Deploy the imported stack"),
+    ("agentcore status     ", "Verify resource status"),
+    ("agentcore fetch access  ", "Get gateway URL and token"),
+]
+
+
+def register_import_gateway(import_app: typer.Typer) -> None:
+    @import_app.command("gateway", help="Import an existing AgentCore Gateway (with targets) from your AWS account")
+    def import_gateway(arn: str | None = typer.Option(None, "--arn", help="Gateway ARN to import")) -> None:
+        result = handle_import_gateway(ImportResourceOptions(arn=arn))
+        if result.success:
+            print_success("Gateway", result, GATEWAY_NEXT_STEPS)
+        else:
+            print_failure(result)

agentcore/cli/commands/import_/import_memory.py

@@ -0,0 +1,128 @@
+"""`agentcore import memory` (port of commands/import/import-memory.ts)."""
+
+from __future__ import annotations
+
+import sys
+from typing import Any
+
+import typer
+
+from agentcore.aws import agentcore_control
+from agentcore.cli.constants import ANSI
+from agentcore.schema import INDEXED_KEY_TYPES
+
+from .import_runtime import print_failure, print_success
+from .import_utils import ImportedResource, parse_and_validate_arn, strip_reserved_tags
+from .resource_import import execute_resource_import
+from .types import ImportResourceOptions, ImportResourceResult, ResourceImportDescriptor
+
+_STRATEGY_TYPES = {
+    "SEMANTIC_OVERRIDE": "SEMANTIC",
+    "SUMMARY_OVERRIDE": "SUMMARIZATION",
+    "USER_PREFERENCE_OVERRIDE": "USER_PREFERENCE",
+    "EPISODIC_OVERRIDE": "EPISODIC",
+    "SEMANTIC": "SEMANTIC",
+    "SUMMARIZATION": "SUMMARIZATION",
+    "USER_PREFERENCE": "USER_PREFERENCE",
+    "EPISODIC": "EPISODIC",
+}
+
+
+def map_strategy_type(api_type: str) -> str:
+    return _STRATEGY_TYPES.get(api_type, api_type)
+
+
+def filter_internal_namespaces(namespaces: list[str]) -> list[str]:
+    """Drop API-generated namespace patterns (they contain ``{memoryStrategyId}``)."""
+    return [ns for ns in namespaces if "{memoryStrategyId}" not in ns]
+
+
+def to_memory_spec(memory: dict[str, Any], local_name: str) -> dict[str, Any]:
+    strategies = []
+    for s in memory.get("strategies") or []:
+        entry: dict[str, Any] = {"type": map_strategy_type(s["type"])}
+        if s.get("name"):
+            entry["name"] = s["name"]
+        if s.get("description"):
+            entry["description"] = s["description"]
+        templates = filter_internal_namespaces(s.get("namespaceTemplates") or [])
+        if templates:
+            entry["namespaceTemplates"] = templates
+        if s.get("reflectionNamespaceTemplates"):
+            entry["reflectionNamespaceTemplates"] = s["reflectionNamespaceTemplates"]
+        strategies.append(entry)
+
+    indexed_keys = []
+    for k in memory.get("indexedKeys") or []:
+        if k.get("type") not in INDEXED_KEY_TYPES:
+            print(
+                f'{ANSI.yellow}[warn]{ANSI.reset} Skipping indexed key "{k.get("key")}" with unrecognised type '
+                f'"{k.get("type")}".',
+                file=sys.stderr,
+            )
+            continue
+        indexed_keys.append({"key": k["key"], "type": k["type"]})
+
+    spec: dict[str, Any] = {
+        "name": local_name,
+        "eventExpiryDuration": max(3, min(365, memory["eventExpiryDuration"])),
+        "strategies": strategies,
+    }
+    if indexed_keys:
+        spec["indexedKeys"] = indexed_keys
+    tags = strip_reserved_tags(memory.get("tags"))
+    if tags:
+        spec["tags"] = tags
+    if memory.get("encryptionKeyArn"):
+        spec["encryptionKeyArn"] = memory["encryptionKeyArn"]
+    if memory.get("executionRoleArn"):
+        spec["executionRoleArn"] = memory["executionRoleArn"]
+    return spec
+
+
+def _add(detail: Any, local_name: str, spec: dict[str, Any]) -> ImportResourceResult:
+    spec.setdefault("memories", []).append(to_memory_spec(detail, local_name))
+    return ImportResourceResult(success=True, resource_type="memory", resource_name=local_name)
+
+
+MEMORY_DESCRIPTOR: ResourceImportDescriptor[Any, Any] = ResourceImportDescriptor(
+    resource_type="memory",
+    display_name="memory",
+    log_command="import-memory",
+    list_resources=lambda region: agentcore_control.list_all_memories(region=region),
+    get_detail=lambda region, mid: agentcore_control.get_memory_detail(region=region, memory_id=mid),
+    parse_resource_id=lambda arn, target: parse_and_validate_arn(arn, "memory", target).resource_id,
+    extract_summary_id=lambda s: s["memoryId"],
+    format_list_item=lambda s, i: (
+        f"  {ANSI.dim}[{i + 1}]{ANSI.reset} {s['memoryId']} — {s['status']}\n       {ANSI.dim}{s['memoryArn']}{ANSI.reset}"
+    ),
+    format_auto_select_message=lambda s: f"Found 1 memory: {s['memoryId']}. Auto-selecting.",
+    extract_detail_name=lambda d: d["name"],
+    extract_detail_arn=lambda d: d["memoryArn"],
+    ready_status="ACTIVE",
+    extract_detail_status=lambda d: d["status"],
+    get_existing_names=lambda spec: [m["name"] for m in spec.get("memories") or []],
+    add_to_project_spec=_add,
+    cfn_resource_type="AWS::BedrockAgentCore::Memory",
+    cfn_name_property="Name",
+    cfn_identifier_key="MemoryId",
+    build_deployed_state_entry=lambda name, mid, d: ImportedResource("memory", name, mid, d["memoryArn"]),
+)
+
+
+def handle_import_memory(options: ImportResourceOptions) -> ImportResourceResult:
+    return execute_resource_import(MEMORY_DESCRIPTOR, options)
+
+
+def register_import_memory(import_app: typer.Typer) -> None:
+    @import_app.command("memory", help="Import an existing AgentCore Memory from your AWS account")
+    def import_memory(
+        arn: str | None = typer.Option(None, "--arn", help="Memory ARN to import"),
+        name: str | None = typer.Option(None, "--name", help="Local name for the imported memory"),
+        yes: bool = typer.Option(False, "-y", "--yes", help="Auto-confirm prompts"),
+    ) -> None:
+        result = handle_import_memory(ImportResourceOptions(arn=arn, name=name, yes=yes or None))
+        if result.success:
+            print_success("Memory", result, [])
+        else:
+            print_failure(result)