Package software.amazon.awscdk.services.bedrockagentcore

Class GatewayCredentialProvider

java.lang.Object
software.amazon.jsii.JsiiObject
software.amazon.awscdk.services.bedrockagentcore.GatewayCredentialProvider
All Implemented Interfaces:
software.amazon.jsii.JsiiSerializable
@Generated(value="jsii-pacmak/1.138.0 (build 0ca7ee8)", date="2026-08-10T14:50:58.442Z") @Stability(Stable) public abstract class GatewayCredentialProvider extends software.amazon.jsii.JsiiObject
Factory class for creating different Gateway Credential Providers.

Example: 

 Gateway gateway = Gateway.Builder.create(this, "MyGateway")
         .gatewayName("my-gateway")
         .build();
 // Outbound auth: ApiKeyCredentialProvider + bindForGatewayApiKeyTarget, or ARNs from console/API
 String apiKeyIdentityArn = "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/apikeycredentialprovider/my-apikey";
 String apiKeySecretArn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-apikey-secret-abc123";
 AssetApiSchema opneapiSchema = ApiSchema.fromLocalAsset(path.join(__dirname, "mySchema.yml"));
 opneapiSchema.bind(this);
 // Create a gateway target with OpenAPI Schema
 GatewayTarget target = GatewayTarget.forOpenApi(this, "MyTarget", GatewayTargetOpenApiProps.builder()
         .gatewayTargetName("my-api-target")
         .description("Target for external API integration")
         .gateway(gateway) // Note: you need to pass the gateway reference
         .apiSchema(opneapiSchema)
         .credentialProviderConfigurations(List.of(GatewayCredentialProvider.fromApiKeyIdentityArn(ApiKeyCredentialProviderOptions.builder()
                 .providerArn(apiKeyIdentityArn)
                 .secretArn(apiKeySecretArn)
                 .build())))
         .build());

  • Constructor Details

    • GatewayCredentialProvider

      protected GatewayCredentialProvider(software.amazon.jsii.JsiiObjectRef objRef)

    • GatewayCredentialProvider

      protected GatewayCredentialProvider(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

    • GatewayCredentialProvider

      @Stability(Stable) protected GatewayCredentialProvider()

  • Method Details

    • fromApiKeyIdentity

      @Stability(Stable) @NotNull public static ICredentialProviderConfig fromApiKeyIdentity(@NotNull IApiKeyCredentialProvider provider, @Nullable FromApiKeyIdentityOptions options)
      Create an API key outbound auth configuration from a Token Vault IApiKeyCredentialProvider construct.

      Prefer this over

      invalid reference 
      GatewayCredentialProvider.fromApiKeyIdentityArn
      when the provider is defined in CDK.

      Parameters:
      provider - This parameter is required.
      options -

    • fromApiKeyIdentity

      @Stability(Stable) @NotNull public static ICredentialProviderConfig fromApiKeyIdentity(@NotNull IApiKeyCredentialProvider provider)
      Create an API key outbound auth configuration from a Token Vault IApiKeyCredentialProvider construct.

      Prefer this over

      invalid reference 
      GatewayCredentialProvider.fromApiKeyIdentityArn
      when the provider is defined in CDK.

      Parameters:
      provider - This parameter is required.

    • fromApiKeyIdentityArn

      @Stability(Stable) @NotNull public static ICredentialProviderConfig fromApiKeyIdentityArn(@NotNull ApiKeyCredentialProviderOptions props)
      Create an API key credential provider from Identity ARN Use this method when you have the Identity ARN as a string.

      Parameters:
      props -
      • The configuration properties for the API key credential provider.
      This parameter is required.
      Returns:
      ICredentialProviderConfig configured for API key authentication

    • fromIamRole

      @Stability(Stable) @NotNull public static ICredentialProviderConfig fromIamRole(@Nullable GatewayIamRoleCredentialProviderProps props)
      Create an IAM role credential provider.

      The gateway authenticates outbound requests using its own execution role (SigV4). Provide service and optionally region to explicitly choose the SigV4 signing service / region instead of relying on the gateway's inference from the target endpoint. Useful for cross-region calls and for targets where the service can't be inferred from the URL. Explicit service / region is only supported for MCP Server and OpenAPI targets; other target types must use the bare fromIamRole().

      Parameters:
      props -

    • fromIamRole

      @Stability(Stable) @NotNull public static ICredentialProviderConfig fromIamRole()
      Create an IAM role credential provider.

      The gateway authenticates outbound requests using its own execution role (SigV4). Provide service and optionally region to explicitly choose the SigV4 signing service / region instead of relying on the gateway's inference from the target endpoint. Useful for cross-region calls and for targets where the service can't be inferred from the URL. Explicit service / region is only supported for MCP Server and OpenAPI targets; other target types must use the bare fromIamRole().

    • fromOauthIdentity

      @Stability(Stable) @NotNull public static ICredentialProviderConfig fromOauthIdentity(@NotNull IOAuth2CredentialProvider provider, @NotNull FromOauthIdentityOptions options)
      Create an OAuth outbound auth configuration from a Token Vault IOAuth2CredentialProvider construct.

      Prefer this over

      invalid reference 
      GatewayCredentialProvider.fromOauthIdentityArn
      when the provider is defined in CDK.

      Parameters:
      provider - This parameter is required.
      options - This parameter is required.

    • fromOauthIdentityArn

      @Stability(Stable) @NotNull public static ICredentialProviderConfig fromOauthIdentityArn(@NotNull OAuthConfiguration props)
      Create an OAuth credential provider from Identity ARN Use this method when you have the Identity ARN as a string.

      Parameters:
      props -
      • The configuration properties for the OAuth credential provider.
      This parameter is required.
      Returns:
      ICredentialProviderConfig configured for OAuth authentication