class RuntimeAuthorizerConfiguration 🔹

Language	Type name
.NET	Amazon.CDK.AWS.Bedrock.Agentcore.Alpha.RuntimeAuthorizerConfiguration
Go	github.com/aws/aws-cdk-go/awsbedrockagentcorealpha/v2#RuntimeAuthorizerConfiguration
Java	software.amazon.awscdk.services.bedrock.agentcore.alpha.RuntimeAuthorizerConfiguration
Python	aws_cdk.aws_bedrock_agentcore_alpha.RuntimeAuthorizerConfiguration
TypeScript (source)	@aws-cdk/aws-bedrock-agentcore-alpha » RuntimeAuthorizerConfiguration

Abstract base class for runtime authorizer configurations.

Provides static factory methods to create different authentication types.

Example

const repository = new ecr.Repository(this, "TestRepository", {
  repositoryName: "test-agent-runtime",
});
const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");

// String claim - validates that the claim exactly equals the specified value
// Uses EQUALS operator automatically
const departmentClaim = agentcore.RuntimeCustomClaim.withStringValue('department', 'engineering');

// String array claim with CONTAINS operator (default)
// Validates that the claim array contains a specific string value
// IMPORTANT: CONTAINS requires exactly one value in the array parameter
const rolesClaim = agentcore.RuntimeCustomClaim.withStringArrayValue('roles', ['admin']);

// String array claim with CONTAINS_ANY operator
// Validates that the claim array contains at least one of the specified values
// Use this when you want to check for multiple possible values
const permissionsClaim = agentcore.RuntimeCustomClaim.withStringArrayValue(
  'permissions',
  ['read', 'write'],
  agentcore.CustomClaimOperator.CONTAINS_ANY
);

// Use custom claims in authorizer configuration
const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
  runtimeName: "myAgent",
  agentRuntimeArtifact: agentRuntimeArtifact,
  authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingJWT(
    "https://example.com/.well-known/openid-configuration",
    ["client1", "client2"],
    ["audience1"],
    ["read", "write"],
    [departmentClaim, rolesClaim, permissionsClaim] // Custom claims
  ),
});

Initializer

new RuntimeAuthorizerConfiguration()

Methods

Name	Description
static usingCognito(userPool, userPoolClients, allowedAudience?, allowedScopes?, customClaims?)🔹	Use AWS Cognito User Pool authentication.
static usingIAM()🔹	Use IAM authentication (default).
static usingJWT(discoveryUrl, allowedClients?, allowedAudience?, allowedScopes?, customClaims?)🔹	Use custom JWT authentication.
static usingOAuth(discoveryUrl, clientId, allowedAudience?, allowedScopes?, customClaims?)🔹	Use OAuth 2.0 authentication. Supports various OAuth providers.

---

static usingCognito(userPool, userPoolClients, allowedAudience?, allowedScopes?, customClaims?)🔹

public static usingCognito(userPool: IUserPool, userPoolClients: IUserPoolClient[], allowedAudience?: string[], allowedScopes?: string[], customClaims?: RuntimeCustomClaim[]): RuntimeAuthorizerConfiguration

Parameters

• userPool IUserPool — The Cognito User Pool.
• userPoolClients IUserPoolClient[] — The Cognito User Pool App Clients.
• allowedAudience string[] — Optional array of allowed audiences.
• allowedScopes string[] — Optional array of allowed scopes.
• customClaims RuntimeCustomClaim[] — Optional array of custom claim validations.

Returns

• RuntimeAuthorizerConfiguration

Use AWS Cognito User Pool authentication.

Validates Cognito-issued JWT tokens.

---

static usingIAM()🔹

public static usingIAM(): RuntimeAuthorizerConfiguration

Returns

• RuntimeAuthorizerConfiguration

Use IAM authentication (default).

Requires AWS credentials to sign requests using SigV4.

---

static usingJWT(discoveryUrl, allowedClients?, allowedAudience?, allowedScopes?, customClaims?)🔹

public static usingJWT(discoveryUrl: string, allowedClients?: string[], allowedAudience?: string[], allowedScopes?: string[], customClaims?: RuntimeCustomClaim[]): RuntimeAuthorizerConfiguration

Parameters

• discoveryUrl string — The OIDC discovery URL (must end with /.well-known/openid-configuration).
• allowedClients string[] — Optional array of allowed client IDs.
• allowedAudience string[] — Optional array of allowed audiences.
• allowedScopes string[] — Optional array of allowed scopes.
• customClaims RuntimeCustomClaim[] — Optional array of custom claim validations.

Returns

• RuntimeAuthorizerConfiguration

Use custom JWT authentication.

Validates JWT tokens against the specified OIDC provider.

---

static usingOAuth(discoveryUrl, clientId, allowedAudience?, allowedScopes?, customClaims?)🔹

public static usingOAuth(discoveryUrl: string, clientId: string, allowedAudience?: string[], allowedScopes?: string[], customClaims?: RuntimeCustomClaim[]): RuntimeAuthorizerConfiguration

Parameters

• discoveryUrl string — The OIDC discovery URL (must end with /.well-known/openid-configuration).
• clientId string — OAuth client ID.
• allowedAudience string[] — Optional array of allowed audiences.
• allowedScopes string[] — Optional array of allowed scopes.
• customClaims RuntimeCustomClaim[] — Optional array of custom claim validations.

Returns

• RuntimeAuthorizerConfiguration

Use OAuth 2.0 authentication. Supports various OAuth providers.