interface IApiKeyCredentialProvider 🔹

Language	Type name
.NET	Amazon.CDK.AWS.Bedrock.Agentcore.Alpha.IApiKeyCredentialProvider
Go	github.com/aws/aws-cdk-go/awsbedrockagentcorealpha/v2#IApiKeyCredentialProvider
Java	software.amazon.awscdk.services.bedrock.agentcore.alpha.IApiKeyCredentialProvider
Python	aws_cdk.aws_bedrock_agentcore_alpha.IApiKeyCredentialProvider
TypeScript (source)	@aws-cdk/aws-bedrock-agentcore-alpha » IApiKeyCredentialProvider

Implements IDependable, IConstruct, IEnvironmentAware, IResource, IGrantable, IApiKeyCredentialProviderRef

Implemented by ApiKeyCredentialProvider

Obtainable from ApiKeyCredentialProvider.fromApiKeyCredentialProviderAttributes()

An API key credential provider registered in AgentCore Token Vault.

Properties

Name	Type	Description
apiKeyCredentialProviderRef🔹	ApiKeyCredentialProviderReference	A reference to a ApiKeyCredentialProvider resource.
credentialProviderArn🔹	string	The ARN of this credential provider.
env🔹	ResourceEnvironment	The environment this resource belongs to.
grantPrincipal🔹	IPrincipal	The principal to grant permissions to.
node🔹	Node	The tree node.
stack🔹	Stack	The stack in which this resource is defined.
apiKeySecretArn?🔹	string	The ARN of the Secrets Manager secret that stores the API key after the resource is created.
createdTime?🔹	string	Timestamp when the credential provider was created.
lastUpdatedTime?🔹	string	Timestamp when the credential provider was last updated.

---

apiKeyCredentialProviderRef🔹

Type: ApiKeyCredentialProviderReference

A reference to a ApiKeyCredentialProvider resource.

---

credentialProviderArn🔹

Type: string

The ARN of this credential provider.

---

env🔹

Type: ResourceEnvironment

The environment this resource belongs to.

For resources that are created and managed in a Stack (those created by creating new class instances like new Role(), new Bucket(), etc.), this is always the same as the environment of the stack they belong to.

For referenced resources (those obtained from referencing methods like Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be different than the stack they were imported into.

---

grantPrincipal🔹

Type: IPrincipal

The principal to grant permissions to.

---

node🔹

Type: Node

The tree node.

---

stack🔹

Type: Stack

The stack in which this resource is defined.

---

apiKeySecretArn?🔹

Type: string (optional)

The ARN of the Secrets Manager secret that stores the API key after the resource is created.

May be undefined for resources imported without this attribute.

---

createdTime?🔹

Type: string (optional)

Timestamp when the credential provider was created.

---

lastUpdatedTime?🔹

Type: string (optional)

Timestamp when the credential provider was last updated.

Methods

Name	Description
applyRemovalPolicy(policy)🔹	Apply the given removal policy to this resource.
bindForGatewayApiKeyTarget()🔹	ARNs for use with gateway targets (GatewayCredentialProvider.fromApiKeyIdentity or fromApiKeyIdentityArn).
grant(grantee, ...actions)🔹	Grants IAM actions to the IAM principal.
grantAdmin(grantee)🔹	Grant control plane permissions to manage this provider.
grantFullAccess(grantee)🔹	Grant read, admin, and credential retrieval permissions.
grantRead(grantee)🔹	Grant GetApiKeyCredentialProvider and ListApiKeyCredentialProviders, scoped to this provider and parent resources required by the Bedrock AgentCore authorization model.
grantUse(grantee)🔹	Grant permission to retrieve API key material for outbound calls (GetResourceApiKey).
with(...mixins)🔹	Applies one or more mixins to this construct.

---

applyRemovalPolicy(policy)🔹

public applyRemovalPolicy(policy: RemovalPolicy): void

Parameters

• policy RemovalPolicy

Apply the given removal policy to this resource.

The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.

The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).

---

bindForGatewayApiKeyTarget()🔹

public bindForGatewayApiKeyTarget(): GatewayApiKeyIdentityBinding

Returns

• GatewayApiKeyIdentityBinding

ARNs for use with gateway targets (GatewayCredentialProvider.fromApiKeyIdentity or fromApiKeyIdentityArn).

---

grant(grantee, ...actions)🔹

public grant(grantee: IGrantable, ...actions: string[]): Grant

Parameters

• grantee IGrantable
• actions string

Returns

• Grant

Grants IAM actions to the IAM principal.

---

grantAdmin(grantee)🔹

public grantAdmin(grantee: IGrantable): Grant

Parameters

• grantee IGrantable

Returns

• Grant

Grant control plane permissions to manage this provider.

---

grantFullAccess(grantee)🔹

public grantFullAccess(grantee: IGrantable): Grant

Parameters

• grantee IGrantable

Returns

• Grant

Grant read, admin, and credential retrieval permissions.

---

grantRead(grantee)🔹

public grantRead(grantee: IGrantable): Grant

Parameters

• grantee IGrantable

Returns

• Grant

Grant GetApiKeyCredentialProvider and ListApiKeyCredentialProviders, scoped to this provider and parent resources required by the Bedrock AgentCore authorization model.

---

grantUse(grantee)🔹

public grantUse(grantee: IGrantable): Grant

Parameters

• grantee IGrantable

Returns

• Grant

Grant permission to retrieve API key material for outbound calls (GetResourceApiKey).

---

with(...mixins)🔹

public with(...mixins: IMixin[]): IConstruct

Parameters

• mixins IMixin — The mixins to apply.

Returns

• IConstruct

Applies one or more mixins to this construct.

Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited.