GatewayCredentialProvider

class aws_cdk.aws_bedrockagentcore.GatewayCredentialProvider

Bases: object

Factory class for creating different Gateway Credential Providers.

ExampleMetadata:: fixture=default infused

Example:

gateway = agentcore.Gateway(self, "MyGateway",
    gateway_name="my-gateway"
)

# Outbound auth: ApiKeyCredentialProvider + bindForGatewayApiKeyTarget, or ARNs from console/API
api_key_identity_arn = "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/apikeycredentialprovider/my-apikey"
api_key_secret_arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-apikey-secret-abc123"

opneapi_schema = agentcore.ApiSchema.from_local_asset(path.join(__dirname, "mySchema.yml"))
opneapi_schema.bind(self)

# Create a gateway target with OpenAPI Schema
target = agentcore.GatewayTarget.for_open_api(self, "MyTarget",
    gateway_target_name="my-api-target",
    description="Target for external API integration",
    gateway=gateway,  # Note: you need to pass the gateway reference
    api_schema=opneapi_schema,
    credential_provider_configurations=[
        agentcore.GatewayCredentialProvider.from_api_key_identity_arn(
            provider_arn=api_key_identity_arn,
            secret_arn=api_key_secret_arn
        )
    ]
)

Static Methods

classmethod from_api_key_identity(provider, *, credential_location=None)

Create an API key outbound auth configuration from a Token Vault {@link IApiKeyCredentialProvider} construct.

Prefer this over {@link GatewayCredentialProvider.fromApiKeyIdentityArn} when the provider is defined in CDK.

Parameters:

provider (IApiKeyCredentialProvider)
credential_location (Optional[ApiKeyCredentialLocation]) – Where to place the API key on outbound requests. Default: header Authorization with ``Bearer `` prefix

Return type:

ICredentialProviderConfig

classmethod from_api_key_identity_arn(*, provider_arn, secret_arn, credential_location=None)

Create an API key credential provider from Identity ARN Use this method when you have the Identity ARN as a string.

Parameters:

provider_arn (str) – The API key credential provider ARN. This is returned when creating the API key credential provider via Console or API. Format: arn:aws:bedrock-agentcore:region:account:token-vault/id/apikeycredentialprovider/name
secret_arn (str) – The ARN of the Secrets Manager secret containing the API key. This is returned when creating the API key credential provider via Console or API. Format: arn:aws:secretsmanager:region:account:secret:name
credential_location (Optional[ApiKeyCredentialLocation]) – The location of the API key credential. This field specifies where in the request the API key should be placed. Default: - HEADER

Return type:

ICredentialProviderConfig

Returns:

ICredentialProviderConfig configured for API key authentication

classmethod from_iam_role(*, region=None, service=None)

Create an IAM role credential provider.

The gateway authenticates outbound requests using its own execution role (SigV4). Provide service and optionally region to explicitly choose the SigV4 signing service / region instead of relying on the gateway’s inference from the target endpoint. Useful for cross-region calls and for targets where the service can’t be inferred from the URL. Explicit service / region is only supported for MCP Server and OpenAPI targets; other target types must use the bare fromIamRole().

Parameters:

region (Optional[str]) – The AWS Region used for SigV4 signing of outbound requests. Can be up to 32 characters long. Pattern: ^[a-zA-Z0-9-]+$ Default: - Gateway’s own Region
service (Optional[str]) – The AWS service name used for SigV4 signing of outbound requests. Use the SigV4 signing name (typically the endpoint prefix), e.g. bedrock-runtime, s3, execute-api, dynamodb. Can be up to 64 characters long. Pattern: ^[a-zA-Z0-9._-]+$ Default: - Gateway infers the service from the target endpoint

Return type:

ICredentialProviderConfig

classmethod from_oauth_identity(provider, *, scopes, custom_parameters=None)

Create an OAuth outbound auth configuration from a Token Vault {@link IOAuth2CredentialProvider} construct.

Prefer this over {@link GatewayCredentialProvider.fromOauthIdentityArn} when the provider is defined in CDK.

Parameters:

provider (IOAuth2CredentialProvider)
scopes (Sequence[str]) – OAuth scopes the gateway should request for this target.
custom_parameters (Optional[Mapping[str, str]]) – Additional OAuth parameters for the provider. Default: - none

Return type:

ICredentialProviderConfig

classmethod from_oauth_identity_arn(*, provider_arn, scopes, secret_arn, custom_parameters=None)

Create an OAuth credential provider from Identity ARN Use this method when you have the Identity ARN as a string.

Parameters:

provider_arn (str) – The OAuth credential provider ARN. This is returned when creating the OAuth credential provider via Console or API. Format: arn:aws:bedrock-agentcore:region:account:token-vault/id/oauth2credentialprovider/name Required: Yes
scopes (Sequence[str]) – The OAuth scopes for the credential provider. These scopes define the level of access requested from the OAuth provider. Array Members: Minimum number of 0 items. Maximum number of 100 items. Length Constraints: Minimum length of 1. Maximum length of 64. Required: Yes
secret_arn (str) – The ARN of the Secrets Manager secret containing OAuth credentials (client ID and secret). This is returned when creating the OAuth credential provider via Console or API. Format: arn:aws:secretsmanager:region:account:secret:name Required: Yes
custom_parameters (Optional[Mapping[str, str]]) – Custom parameters for the OAuth flow. Default: - No custom parameters

Return type:

ICredentialProviderConfig

Returns:

ICredentialProviderConfig configured for OAuth authentication