2.266.0

class GatewayCredentialProvider

LanguageType name
.NETAmazon.CDK.AWS.BedrockAgentCore.GatewayCredentialProvider
Gogithub.com/aws/aws-cdk-go/awscdk/v2/awsbedrockagentcore#GatewayCredentialProvider
Javasoftware.amazon.awscdk.services.bedrockagentcore.GatewayCredentialProvider
Pythonaws_cdk.aws_bedrockagentcore.GatewayCredentialProvider
TypeScript (source)aws-cdk-lib » aws_bedrockagentcore » GatewayCredentialProvider

Factory class for creating different Gateway Credential Providers.

Example


const gateway = new agentcore.Gateway(this, "MyGateway", {
  gatewayName: "my-gateway",
});

// Outbound auth: ApiKeyCredentialProvider + bindForGatewayApiKeyTarget, or ARNs from console/API
const apiKeyIdentityArn = "arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/apikeycredentialprovider/my-apikey"
const apiKeySecretArn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-apikey-secret-abc123"

const opneapiSchema = agentcore.ApiSchema.fromLocalAsset(path.join(__dirname, "mySchema.yml"));
opneapiSchema.bind(this);

// Create a gateway target with OpenAPI Schema
const target = agentcore.GatewayTarget.forOpenApi(this, "MyTarget", {
  gatewayTargetName: "my-api-target",
  description: "Target for external API integration",
  gateway: gateway,  // Note: you need to pass the gateway reference
  apiSchema: opneapiSchema,
  credentialProviderConfigurations: [
    agentcore.GatewayCredentialProvider.fromApiKeyIdentityArn({
     providerArn: apiKeyIdentityArn,
     secretArn: apiKeySecretArn
    }),
  ],
});

Initializer

new GatewayCredentialProvider()

Methods

NameDescription
static fromApiKeyIdentity(provider, options?)Create an API key outbound auth configuration from a Token Vault {@link IApiKeyCredentialProvider} construct.
static fromApiKeyIdentityArn(props)Create an API key credential provider from Identity ARN Use this method when you have the Identity ARN as a string.
static fromIamRole(props?)Create an IAM role credential provider.
static fromOauthIdentity(provider, options)Create an OAuth outbound auth configuration from a Token Vault {@link IOAuth2CredentialProvider} construct.
static fromOauthIdentityArn(props)Create an OAuth credential provider from Identity ARN Use this method when you have the Identity ARN as a string.

static fromApiKeyIdentity(provider, options?)

public static fromApiKeyIdentity(provider: IApiKeyCredentialProvider, options?: FromApiKeyIdentityOptions): ICredentialProviderConfig

Parameters

Returns

Create an API key outbound auth configuration from a Token Vault {@link IApiKeyCredentialProvider} construct.

Prefer this over {@link GatewayCredentialProvider.fromApiKeyIdentityArn} when the provider is defined in CDK.

static fromApiKeyIdentityArn(props)

public static fromApiKeyIdentityArn(props: ApiKeyCredentialProviderOptions): ICredentialProviderConfig

Parameters

Returns

Create an API key credential provider from Identity ARN Use this method when you have the Identity ARN as a string.

static fromIamRole(props?)

public static fromIamRole(props?: GatewayIamRoleCredentialProviderProps): ICredentialProviderConfig

Parameters

Returns

Create an IAM role credential provider.

The gateway authenticates outbound requests using its own execution role (SigV4). Provide service and optionally region to explicitly choose the SigV4 signing service / region instead of relying on the gateway's inference from the target endpoint. Useful for cross-region calls and for targets where the service can't be inferred from the URL. Explicit service / region is only supported for MCP Server and OpenAPI targets; other target types must use the bare fromIamRole().

static fromOauthIdentity(provider, options)

public static fromOauthIdentity(provider: IOAuth2CredentialProvider, options: FromOauthIdentityOptions): ICredentialProviderConfig

Parameters

Returns

Create an OAuth outbound auth configuration from a Token Vault {@link IOAuth2CredentialProvider} construct.

Prefer this over {@link GatewayCredentialProvider.fromOauthIdentityArn} when the provider is defined in CDK.

static fromOauthIdentityArn(props)

public static fromOauthIdentityArn(props: OAuthConfiguration): ICredentialProviderConfig

Parameters

  • props OAuthConfiguration — - The configuration properties for the OAuth credential provider.

Returns

Create an OAuth credential provider from Identity ARN Use this method when you have the Identity ARN as a string.

← PreviousNext →