GatewayProps

class aws_cdk.aws_bedrockagentcore.GatewayProps(*, authorizer_configuration=None, description=None, exception_level=None, gateway_name=None, interceptor_configurations=None, kms_key=None, policy_engine_configuration=None, protocol_configuration=None, role=None, tags=None)

Bases: object

Properties for defining a Gateway.

Parameters:

  • authorizer_configuration (Optional[IGatewayAuthorizerConfig]) – The authorizer configuration for the gateway. Default: - A default authorizer will be created using Cognito

  • description (Optional[str]) – Optional description for the gateway Valid characters are a-z, A-Z, 0-9, _ (underscore), - (hyphen) and spaces The description can have up to 200 characters. Default: - No description

  • exception_level (Optional[GatewayExceptionLevel]) – The verbosity of exception messages Use DEBUG mode to see granular exception messages from a Gateway. Default: - Exception messages are sanitized for presentation to end users

  • gateway_name (Optional[str]) – The name of the gateway Valid characters are a-z, A-Z, 0-9, _ (underscore) and - (hyphen) The name must be unique within your account. Default: - auto generate

  • interceptor_configurations (Optional[Sequence[IInterceptor]]) – Interceptor configurations for the gateway. Interceptors allow you to run custom code during each gateway invocation: - REQUEST interceptors execute before the gateway calls the target - RESPONSE interceptors execute after the target responds A gateway can have at most one REQUEST interceptor and one RESPONSE interceptor. Default: - No interceptors

  • kms_key (Optional[IKey]) – The AWS KMS key used to encrypt data associated with the gateway. Default: - No encryption

  • policy_engine_configuration (Union[GatewayPolicyEngineConfig, Dict[str, Any], None]) – The policy engine configuration for this gateway. When provided, the specified policy engine will be associated with this gateway. All agent requests through this gateway will be evaluated against the Cedar policies defined in the policy engine. Default: - No policy engine (requests are not subject to Cedar policy authorization)

  • protocol_configuration (Optional[IGatewayProtocolConfig]) – The protocol configuration for the gateway. Default: - A default protocol configuration will be created using MCP with following params supportedVersions: [MCPProtocolVersion.MCP_2025_03_26], searchType: McpGatewaySearchType.SEMANTIC, instructions: “Default gateway to connect to external MCP tools”,

  • role (Optional[IRole]) – The IAM role that provides permissions for the gateway to access AWS services. Default: - A new role will be created

  • tags (Optional[Mapping[str, str]]) – Tags for the gateway A list of key:value pairs of tags to apply to this Gateway resource. Default: - No tags

ExampleMetadata:

fixture=default infused

Example:

gateway = agentcore.Gateway(self, "MyGateway",
    gateway_name="my-gateway"
)

lambda_function = lambda_.Function(self, "MyFunction",
    runtime=lambda_.Runtime.NODEJS_22_X,
    handler="index.handler",
    code=lambda_.Code.from_inline("""
                exports.handler = async (event) => {
                    return {
                        statusCode: 200,
                        body: JSON.stringify({ message: 'Hello from Lambda!' })
                    };
                };
            """)
)

# Create a gateway target with Lambda and tool schema
target = agentcore.GatewayTarget.for_lambda(self, "MyLambdaTarget",
    gateway_target_name="my-lambda-target",
    description="Target for Lambda function integration",
    gateway=gateway,
    lambda_function=lambda_function,
    tool_schema=agentcore.ToolSchema.from_local_asset(
        path.join(__dirname, "schemas", "my-tool-schema.json"))
)

Attributes

authorizer_configuration

The authorizer configuration for the gateway.

Default:

  • A default authorizer will be created using Cognito

description

Optional description for the gateway Valid characters are a-z, A-Z, 0-9, _ (underscore), - (hyphen) and spaces The description can have up to 200 characters.

Default:

  • No description

exception_level

The verbosity of exception messages Use DEBUG mode to see granular exception messages from a Gateway.

Default:

  • Exception messages are sanitized for presentation to end users

gateway_name

The name of the gateway Valid characters are a-z, A-Z, 0-9, _ (underscore) and - (hyphen) The name must be unique within your account.

Default:

  • auto generate

interceptor_configurations

Interceptor configurations for the gateway.

Interceptors allow you to run custom code during each gateway invocation:

  • REQUEST interceptors execute before the gateway calls the target

  • RESPONSE interceptors execute after the target responds

A gateway can have at most one REQUEST interceptor and one RESPONSE interceptor.

Default:

  • No interceptors

See:

https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-interceptors.html

kms_key

The AWS KMS key used to encrypt data associated with the gateway.

Default:

  • No encryption

policy_engine_configuration

The policy engine configuration for this gateway.

When provided, the specified policy engine will be associated with this gateway. All agent requests through this gateway will be evaluated against the Cedar policies defined in the policy engine.

Default:

  • No policy engine (requests are not subject to Cedar policy authorization)

protocol_configuration

The protocol configuration for the gateway.

Default:

  • A default protocol configuration will be created using MCP with following params

supportedVersions: [MCPProtocolVersion.MCP_2025_03_26], searchType: McpGatewaySearchType.SEMANTIC, instructions: “Default gateway to connect to external MCP tools”,

role

The IAM role that provides permissions for the gateway to access AWS services.

Default:

  • A new role will be created

tags

value pairs of tags to apply to this Gateway resource.

Default:

  • No tags

Type:

Tags for the gateway A list of key