View a markdown version of this page

Create gateway with Policy Engine - Amazon Bedrock AgentCore

Create gateway with Policy Engine

This section provides examples of creating a gateway with a policy engine associated for policy enforcement.

Note

  • Use the values for the authorization configuration that you specified when you set up inbound authorization — for a JWT authorizer, the discovery URL of your identity provider and the client IDs you allow. For how these are chosen, see Set up inbound authorization for your gateway.

  • Where you specify an explicit gateway service role ARN, it must be a role you have already created. For more information, see Set up permissions for AgentCore Gateway.

Select one of the following methods:

Example
AgentCore CLI

  1. In an AgentCore project, add a gateway and name the policy engine it should enforce:

    agentcore add gateway --name my-gateway \
  --protocol-type MCP \
  --authorizer-type CUSTOM_JWT \
  --discovery-url https://cognito-idp.us-west-2.amazonaws.com/some-user-pool/.well-known/openid-configuration \
  --allowed-clients clientId \
  --policy-engine my_policy_engine \
  --policy-engine-mode ENFORCE

  2. Deploy to create both resources in your account:

    agentcore deploy --yes

    The engine named by --policy-engine must already be in the project — add it first with agentcore add policy-engine. The CLI resolves the engine ARN for you, so you do not need to know it in advance. Run agentcore status after deploying to read the gateway URL.

AWS CLI

  1. Run the following code in a terminal to create a gateway with a Policy Engine using the AWS CLI:

    aws bedrock-agentcore-control create-gateway \
  --name my-gateway \
  --role-arn arn:aws:iam::123456789012:role/my-gateway-service-role \
  --protocol-type MCP \
  --authorizer-type CUSTOM_JWT \
  --authorizer-configuration '{
    "customJWTAuthorizer": {
      "discoveryUrl": "https://cognito-idp.us-west-2.amazonaws.com/some-user-pool/.well-known/openid-configuration",
      "allowedClients": ["clientId"]
    }
  }' \
  --policy-engine-configuration '{
    "mode": "ENFORCE",
    "arn": "arn:aws:bedrock-agentcore:us-west-2:123456789012:policy-engine/my_policy_engine-a1b2c3d4e5"
  }'

    The gatewayUrl in the response is the endpoint to use when you invoke the gateway.

AWS Python SDK (Boto3)

  1. The following Python code shows how to create a gateway with a Policy Engine using the AWS Python SDK (Boto3):

    import boto3

gateway_client = boto3.client('bedrock-agentcore-control')

response = gateway_client.create_gateway(
    name='my-gateway',
    protocolType='MCP',
    authorizerType='CUSTOM_JWT',
    authorizerConfiguration={
        'customJWTAuthorizer': {
            'allowedClients': ['clientId'],
            'discoveryUrl': 'https://cognito-idp.us-west-2.amazonaws.com/some-user-pool/.well-known/openid-configuration'
        }
    },
    roleArn='arn:aws:iam::123456789012:role/my-gateway-service-role',
    policyEngineConfiguration={
        'mode': 'ENFORCE',
        'arn': 'arn:aws:bedrock-agentcore:us-west-2:123456789012:policy-engine/my_policy_engine-a1b2c3d4e5'
    }
)
print(f"GATEWAY ARN: {response['gatewayArn']}")
print(f"GATEWAY URL: {response['gatewayUrl']}")

    The gatewayUrl in the response is the endpoint to use when you invoke the gateway.