RuntimeAuthorizerConfiguration

class aws_cdk.aws_bedrock_agentcore_alpha.RuntimeAuthorizerConfiguration

Bases: object

(experimental) Abstract base class for runtime authorizer configurations.

Provides static factory methods to create different authentication types.

Stability:: experimental
ExampleMetadata:: fixture=default infused

Example:

repository = ecr.Repository(self, "TestRepository",
    repository_name="test-agent-runtime"
)
agent_runtime_artifact = agentcore.AgentRuntimeArtifact.from_ecr_repository(repository, "v1.0.0")

runtime = agentcore.Runtime(self, "MyAgentRuntime",
    runtime_name="myAgent",
    agent_runtime_artifact=agent_runtime_artifact,
    authorizer_configuration=agentcore.RuntimeAuthorizerConfiguration.using_oAuth("https://github.com/.well-known/openid-configuration", "oauth_client_123")
)

Stability:: experimental

Static Methods

classmethod using_cognito(user_pool, user_pool_clients, allowed_audience=None)

(experimental) Use AWS Cognito User Pool authentication.

Validates Cognito-issued JWT tokens.

Parameters:

user_pool (IUserPool) – The Cognito User Pool.
user_pool_clients (Sequence[IUserPoolClient]) – The Cognito User Pool App Clients.
allowed_audience (Optional[Sequence[str]]) – Optional array of allowed audiences.

Return type:

RuntimeAuthorizerConfiguration

Returns:

RuntimeAuthorizerConfiguration for Cognito authentication

Stability:

experimental

classmethod using_iam()

(experimental) Use IAM authentication (default).

Requires AWS credentials to sign requests using SigV4.

Return type:: RuntimeAuthorizerConfiguration
Returns:: RuntimeAuthorizerConfiguration for IAM authentication
Stability:: experimental

classmethod using_jwt(discovery_url, allowed_clients=None, allowed_audience=None)

(experimental) Use custom JWT authentication.

Validates JWT tokens against the specified OIDC provider.

Parameters:

discovery_url (str) – The OIDC discovery URL (must end with /.well-known/openid-configuration).
allowed_clients (Optional[Sequence[str]]) – Optional array of allowed client IDs.
allowed_audience (Optional[Sequence[str]]) – Optional array of allowed audiences.

Return type:

RuntimeAuthorizerConfiguration

Returns:

RuntimeAuthorizerConfiguration for JWT authentication

Stability:

experimental

classmethod using_o_auth(discovery_url, client_id, allowed_audience=None)

(experimental) Use OAuth 2.0 authentication. Supports various OAuth providers.

Parameters:

discovery_url (str) – The OIDC discovery URL (must end with /.well-known/openid-configuration).
client_id (str) – OAuth client ID.
allowed_audience (Optional[Sequence[str]]) – Optional array of allowed audiences.

Return type:

RuntimeAuthorizerConfiguration

Returns:

RuntimeAuthorizerConfiguration for OAuth authentication

Stability:

experimental