CustomJWTAuthorizerConfiguration¶
Structure Class¶
dataclass
¶
Configuration for inbound JWT-based authorization, specifying how incoming requests should be authenticated.
Attributes¶
class-attribute
instance-attribute
¶
advertised_scope_mapping: dict[str, str] | None = None
A map that associates each scope in allowedScopes with a corresponding
advertised scope value. The advertised scope appears in OAuth protected
resource metadata and WWW-Authenticate response headers. Use this
parameter when the scope that clients request from your identity
provider differs from the scope in the validated token. Each key is a
scope from allowedScopes that the service uses for token validation.
Each value is the corresponding scope that the service advertises to
clients. Scopes without a mapping entry appear unchanged to clients.
class-attribute
instance-attribute
¶
allowed_audience: list[str] | None = None
Represents individual audience values that are validated in the incoming JWT token validation process.
class-attribute
instance-attribute
¶
allowed_clients: list[str] | None = None
Represents individual client IDs that are validated in the incoming JWT token validation process.
class-attribute
instance-attribute
¶
allowed_scopes: list[str] | None = None
An array of scopes that are allowed to access the token.
class-attribute
instance-attribute
¶
allowed_workload_configuration: AllowedWorkloadConfiguration | None = None
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
class-attribute
instance-attribute
¶
custom_claims: list[CustomClaimValidationType] | None = None
An array of objects that define a custom claim validation name, value, and operation
instance-attribute
¶
discovery_url: str
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
class-attribute
instance-attribute
¶
private_endpoint: PrivateEndpoint | None = None
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
class-attribute
instance-attribute
¶
private_endpoint_overrides: list[PrivateEndpointOverride] | None = None
The private endpoint overrides for the custom JWT authorizer configuration.