Package software.amazon.awscdk.services.bedrockagentcore

Interface IWorkloadIdentity

All Superinterfaces:

software.constructs.IConstruct, software.constructs.IDependable, IEnvironmentAware, IGrantable, IResource, IWorkloadIdentityRef, software.amazon.jsii.JsiiSerializable

All Known Subinterfaces:

IWorkloadIdentity.Jsii$Default

All Known Implementing Classes:

IWorkloadIdentity.Jsii$Proxy, WorkloadIdentity

@Generated(value="jsii-pacmak/1.129.0 (build eaca441)",
           date="2026-05-19T08:18:44.448Z")
@Stability(Stable)
public interface IWorkloadIdentity
extends software.amazon.jsii.JsiiSerializable, IResource, IGrantable, IWorkloadIdentityRef

A workload identity for Amazon Bedrock AgentCore.

Represents the stable identity of an agent within an account's agent identity directory. It ties together IAM roles, OAuth2 flows, API keys, and workload access tokens for consistent authentication across environments.

See Also:

• https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/understanding-agent-identities.html

Nested Class Summary

Nested Classes

Modifier and Type	Interface	Description
static interface	IWorkloadIdentity.Jsii$Default	Internal default implementation for IWorkloadIdentity.
static final class	IWorkloadIdentity.Jsii$Proxy	A proxy class which represents a concrete javascript instance of this type.

Method Summary

Modifier and Type	Method	Description
default String	getCreatedTime()	Timestamp when the workload identity was created.
default String	getLastUpdatedTime()	Timestamp when the workload identity was last updated.
String	getWorkloadIdentityArn()	The ARN of this workload identity.
String	getWorkloadIdentityName()	The name of this workload identity.
Grant	grant(IGrantable grantee, String... actions)	Grants IAM actions on this workload identity, scoped to its ARN and the parent resources required by the Bedrock AgentCore authorization model.
Grant	grantAdmin(IGrantable grantee)	Grant control plane permissions to manage this workload identity.
Grant	grantFullAccess(IGrantable grantee)	Grant read, list, admin, and use permissions.
Grant	grantRead(IGrantable grantee)	Grant GetWorkloadIdentity and ListWorkloadIdentities, scoped to this identity and parent resources required by the Bedrock AgentCore authorization model.
Grant	grantUse(IGrantable grantee)	Grant data plane permissions to mint workload access tokens (GetWorkloadAccessToken, GetWorkloadAccessTokenForJWT, GetWorkloadAccessTokenForUserId).

Methods inherited from interface software.constructs.IConstruct

getNode, with

Methods inherited from interface software.amazon.awscdk.interfaces.IEnvironmentAware

getEnv

Methods inherited from interface software.amazon.awscdk.services.iam.IGrantable

getGrantPrincipal

Methods inherited from interface software.amazon.awscdk.IResource

applyRemovalPolicy, getStack

Methods inherited from interface software.amazon.awscdk.interfaces.bedrockagentcore.IWorkloadIdentityRef

getWorkloadIdentityRef

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Method Details

getWorkloadIdentityArn

@Stability(Stable)
@NotNull
String getWorkloadIdentityArn()

The ARN of this workload identity.

getWorkloadIdentityName

@Stability(Stable)
@NotNull
String getWorkloadIdentityName()

The name of this workload identity.

getCreatedTime

@Stability(Stable)
@Nullable
default String getCreatedTime()

Timestamp when the workload identity was created.

getLastUpdatedTime

@Stability(Stable)
@Nullable
default String getLastUpdatedTime()

Timestamp when the workload identity was last updated.

grant

@Stability(Stable)
@NotNull
Grant grant(@NotNull
 IGrantable grantee,
 @NotNull
 String... actions)

Grants IAM actions on this workload identity, scoped to its ARN and the parent resources required by the Bedrock AgentCore authorization model.

Parameters:

grantee - This parameter is required.

actions - This parameter is required.

grantAdmin

@Stability(Stable)
@NotNull
Grant grantAdmin(@NotNull
 IGrantable grantee)

Grant control plane permissions to manage this workload identity.

Parameters:

grantee - This parameter is required.

grantFullAccess

@Stability(Stable)
@NotNull
Grant grantFullAccess(@NotNull
 IGrantable grantee)

Grant read, list, admin, and use permissions.

Parameters:

grantee - This parameter is required.

grantRead

@Stability(Stable)
@NotNull
Grant grantRead(@NotNull
 IGrantable grantee)

Grant GetWorkloadIdentity and ListWorkloadIdentities, scoped to this identity and parent resources required by the Bedrock AgentCore authorization model.

Parameters:

grantee - This parameter is required.

grantUse

@Stability(Stable)
@NotNull
Grant grantUse(@NotNull
 IGrantable grantee)

Grant data plane permissions to mint workload access tokens (GetWorkloadAccessToken, GetWorkloadAccessTokenForJWT, GetWorkloadAccessTokenForUserId).

Parameters:

grantee - This parameter is required.