Package software.amazon.awscdk.services.bedrockagentcore

Interface CustomJwtConfiguration

All Superinterfaces:

software.amazon.jsii.JsiiSerializable

All Known Implementing Classes:

CustomJwtConfiguration.Jsii$Proxy

@Generated(value="jsii-pacmak/1.129.0 (build eaca441)",
           date="2026-05-19T08:18:44.376Z")
@Stability(Stable)
public interface CustomJwtConfiguration
extends software.amazon.jsii.JsiiSerializable

Custom JWT authorizer configuration.

Example:

 // Create a custom execution role
 Role executionRole = Role.Builder.create(this, "GatewayExecutionRole")
         .assumedBy(new ServicePrincipal("bedrock-agentcore.amazonaws.com"))
         .managedPolicies(List.of(ManagedPolicy.fromAwsManagedPolicyName("AmazonBedrockAgentCoreGatewayExecutionRolePolicy")))
         .build();
 // Create gateway with custom execution role
 Gateway gateway = Gateway.Builder.create(this, "MyGateway")
         .gatewayName("my-gateway")
         .description("Gateway with custom execution role")
         .protocolConfiguration(McpProtocolConfiguration.Builder.create()
                 .instructions("Use this gateway to connect to external MCP tools")
                 .searchType(McpGatewaySearchType.SEMANTIC)
                 .supportedVersions(List.of(MCPProtocolVersion.MCP_2025_03_26))
                 .build())
         .authorizerConfiguration(GatewayAuthorizer.usingCustomJwt(CustomJwtConfiguration.builder()
                 .discoveryUrl("https://auth.example.com/.well-known/openid-configuration")
                 .allowedAudience(List.of("my-app"))
                 .allowedClients(List.of("my-client-id"))
                 .allowedScopes(List.of("read", "write"))
                 .build()))
         .role(executionRole)
         .build();
 

Nested Class Summary

Nested Classes

Modifier and Type	Interface	Description
static final class	CustomJwtConfiguration.Builder	A builder for CustomJwtConfiguration
static final class	CustomJwtConfiguration.Jsii$Proxy	An implementation for CustomJwtConfiguration

Method Summary

Modifier and Type	Method	Description
static CustomJwtConfiguration.Builder	builder()
default List<String>	getAllowedAudience()	Represents individual audience values that are validated in the incoming JWT token validation process.
default List<String>	getAllowedClients()	Represents individual client IDs that are validated in the incoming JWT token validation process.
default List<String>	getAllowedScopes()	Represents individual scopes that are validated in the incoming JWT token validation process.
default List<GatewayCustomClaim>	getCustomClaims()	Custom claims for additional JWT token validation.
String	getDiscoveryUrl()	This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Method Details

getDiscoveryUrl

@Stability(Stable)
@NotNull
String getDiscoveryUrl()

This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.

Pattern: .+/.well-known/openid-configuration Required: Yes

getAllowedAudience

@Stability(Stable)
@Nullable
default List<String> getAllowedAudience()

Represents individual audience values that are validated in the incoming JWT token validation process.

Default: - No audience validation

getAllowedClients

@Stability(Stable)
@Nullable
default List<String> getAllowedClients()

Represents individual client IDs that are validated in the incoming JWT token validation process.

Default: - No client ID validation

getAllowedScopes

@Stability(Stable)
@Nullable
default List<String> getAllowedScopes()

Represents individual scopes that are validated in the incoming JWT token validation process.

Default: - No scope validation

getCustomClaims

@Stability(Stable)
@Nullable
default List<GatewayCustomClaim> getCustomClaims()

Custom claims for additional JWT token validation.

Allows you to validate additional fields in JWT tokens beyond the standard audience, client, and scope validations.

Default: - No custom claim validation

builder

@Stability(Stable)
static CustomJwtConfiguration.Builder builder()

Returns:

a CustomJwtConfiguration.Builder of CustomJwtConfiguration