class LambdaInterceptor 🔹

Language	Type name
.NET	Amazon.CDK.AWS.Bedrock.Agentcore.Alpha.LambdaInterceptor
Go	github.com/aws/aws-cdk-go/awsbedrockagentcorealpha/v2#LambdaInterceptor
Java	software.amazon.awscdk.services.bedrock.agentcore.alpha.LambdaInterceptor
Python	aws_cdk.aws_bedrock_agentcore_alpha.LambdaInterceptor
TypeScript (source)	@aws-cdk/aws-bedrock-agentcore-alpha » LambdaInterceptor

Implements IInterceptor

A Lambda-based interceptor for Gateway.

Interceptors allow you to run custom code during each invocation of your gateway:

• REQUEST interceptors execute before calling the target
• RESPONSE interceptors execute after the target responds

See also: https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-interceptors.html

Example

// Create Lambda functions for interceptors
const requestInterceptorFn = new lambda.Function(this, "RequestInterceptor", {
  runtime: lambda.Runtime.PYTHON_3_12,
  handler: "index.handler",
  code: lambda.Code.fromInline(`
def handler(event, context):
    # Validate and transform request
    return {
        "interceptorOutputVersion": "1.0",
        "mcp": {
            "transformedGatewayRequest": event["mcp"]["gatewayRequest"]
        }
    }
  `),
});

const responseInterceptorFn = new lambda.Function(this, "ResponseInterceptor", {
  runtime: lambda.Runtime.PYTHON_3_12,
  handler: "index.handler",
  code: lambda.Code.fromInline(`
def handler(event, context):
    # Filter or transform response
    return {
        "interceptorOutputVersion": "1.0",
        "mcp": {
            "transformedGatewayResponse": event["mcp"]["gatewayResponse"]
        }
    }
  `),
});

// Create gateway with interceptors
const gateway = new agentcore.Gateway(this, "MyGateway", {
  gatewayName: "my-gateway",
  interceptorConfigurations: [
    agentcore.LambdaInterceptor.forRequest(requestInterceptorFn, {
      passRequestHeaders: true  // Only if you need to inspect headers
    }),
    agentcore.LambdaInterceptor.forResponse(responseInterceptorFn)
  ]
});

Properties

Name	Type	Description
interceptionPoint🔹	InterceptionPoint	The interception point (REQUEST or RESPONSE).

---

interceptionPoint🔹

Type: InterceptionPoint

The interception point (REQUEST or RESPONSE).

Methods

Name	Description
bind(_scope, gateway)🔹	Binds this Lambda interceptor to a Gateway.
static forRequest(lambdaFunction, options?)🔹	Create a REQUEST interceptor that executes before the gateway calls the target.
static forResponse(lambdaFunction, options?)🔹	Create a RESPONSE interceptor that executes after the target responds.

---

bind(_scope, gateway)🔹

public bind(_scope: Construct, gateway: IGateway): InterceptorBindConfig

Parameters

• _scope Construct — The construct scope (currently unused, reserved for future extensions).
• gateway IGateway — The gateway this interceptor is being bound to.

Returns

• InterceptorBindConfig

Binds this Lambda interceptor to a Gateway.

This method:

1. Grants the Gateway's IAM role permission to invoke the Lambda function
2. Returns the CloudFormation configuration for this interceptor

---

static forRequest(lambdaFunction, options?)🔹

public static forRequest(lambdaFunction: IFunction, options?: InterceptorOptions): LambdaInterceptor

Parameters

• lambdaFunction IFunction — The Lambda function to invoke.
• options InterceptorOptions — Optional configuration for the interceptor.

Returns

• LambdaInterceptor

Create a REQUEST interceptor that executes before the gateway calls the target.

Important: When this interceptor is added to a gateway, the gateway's IAM role will automatically be granted lambda:InvokeFunction permission on the specified Lambda function.

---

static forResponse(lambdaFunction, options?)🔹

public static forResponse(lambdaFunction: IFunction, options?: InterceptorOptions): LambdaInterceptor

Parameters

• lambdaFunction IFunction — The Lambda function to invoke.
• options InterceptorOptions — Optional configuration for the interceptor.

Returns

• LambdaInterceptor

Create a RESPONSE interceptor that executes after the target responds.

Important: When this interceptor is added to a gateway, the gateway's IAM role will automatically be granted lambda:InvokeFunction permission on the specified Lambda function.