aws-cdk-lib.aws_elasticloadbalancingv2.AuthenticateJwtOptions

AuthenticateJwtOptions Struct

Options for ListenerAction.authenticateJwt().

Source

aws-elasticloadbalancingv2/lib/alb/application-listener-action.ts

Type last changed

v2.247.0 · 2 Apr 2026

Example

declare const lb: elbv2.ApplicationLoadBalancer;
declare const certificate: elbv2.IListenerCertificate;
declare const myTargetGroup: elbv2.ApplicationTargetGroup;

// JWT authentication requires HTTPS
const listener = lb.addListener('Listener', {
  protocol: elbv2.ApplicationProtocol.HTTPS,
  port: 443,
  certificates: [certificate],
  defaultAction: elbv2.ListenerAction.authenticateJwt({
    issuer: 'https://issuer.example.com',
    jwksEndpoint: 'https://issuer.example.com/.well-known/jwks.json',
    next: elbv2.ListenerAction.forward([myTargetGroup]),
  }),
});

Properties

issuerstringissuerstrissuerStringIssuerstringIssuer*stringrequired#

The issuer of the JWT token.

This must be a full URL, including the HTTPS protocol, the domain, and the path.

example

'https://issuer.example.com'

jwksEndpointstringjwks_endpointstrjwksEndpointStringJwksEndpointstringJwksEndpoint*stringrequired#

The JWKS (JSON Web Key Set) endpoint URL.

The endpoint must be publicly accessible and return the public keys used to verify JWT signatures.

example

'https://issuer.example.com/jwks'

nextListenerActionnextListenerActionnextListenerActionNextListenerActionNextListenerActionrequired#

What action to execute next.

Multiple actions form a linked chain; the chain must always terminate in a (weighted)forward, fixedResponse or redirect action.