aws-sdk-bedrockagentcorecontrol 1.59.0 → 1.60.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a913aa5532331ed8794af0cf7d9154d34e6393e7f4b979e09a59c341a689b1a
-  data.tar.gz: af36f8bfdbbf44e8c02e848489ca6cf69f85e158af0a168327f330e9639d60bb
+  metadata.gz: 76c93b241282c73f955a3dd25c91269ebe615f0b96313d74cf53e4e271c4723b
+  data.tar.gz: 61c04223d203169715e243bdf91391220ef4f03f7eefbcf8d93364f7853b90ac
 SHA512:
-  metadata.gz: 77cd9e1a7a9909d76e7b6fb7acba91ab41ae85e46494c260baf1a4817a45c9e74d0e6b338a91aad984e56c01a3ba41f6b21360ec7e2ce4b41f94e7f80a3f92b7
-  data.tar.gz: 7677c03a3ccd9712ca87342338ba43116ba7f3405e472d47935e743695e7f685bf9a1fd0f7fb2997258fe5b749b6f5bbe74f9968233aabffcab04bb1488dcb18
+  metadata.gz: 7e7f7a28f6ad18d1cf94dfd5611b918b6948ff35edb40b295040ede79aa8580947ce207b8312eb6005065de21d3677c31010c63b5931a3990162db60d8659aa2
+  data.tar.gz: 1d1a61a1a422ebae870d9b9f062a1f6a954250fbc55ad79ab1a844b0579aeefd8f179170b2763bf781c846ac7fcc293b44af7330b7f995912fab075dd667135d

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.60.0 (2026-07-28)
+------------------
+
+* Feature - AgentCore Identity now supports Private Key JWT client authentication for OAuth 2.0 credential providers. Agents can authenticate to identity provider token endpoints with a JWT client assertion signed by a customer-managed AWS KMS asymmetric key, eliminating the need for client secrets.
+
 1.59.0 (2026-07-23)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.59.0
+1.60.0

data/lib/aws-sdk-bedrockagentcorecontrol/client.rb

@@ -3592,7 +3592,21 @@ module Aws::BedrockAgentCoreControl
     #             actor_token_scopes: ["ScopeType"],
     #           },
     #         },
-    #         client_authentication_method: "CLIENT_SECRET_BASIC", # accepts CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, AWS_IAM_ID_TOKEN_JWT
+    #         client_authentication_method: "CLIENT_SECRET_BASIC", # accepts CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, AWS_IAM_ID_TOKEN_JWT, PRIVATE_KEY_JWT
+    #         private_key_jwt_config: {
+    #           private_key_source: {
+    #             kms_key_source: {
+    #               kms_key_arn: "KmsKeyArn", # required
+    #             },
+    #           },
+    #           signing_algorithm: "RS256", # accepts RS256, PS256, ES256
+    #           additional_header_claims: {
+    #             "AdditionalClaimName" => "AdditionalClaimValue",
+    #           },
+    #           additional_payload_claims: {
+    #             "AdditionalClaimName" => "AdditionalClaimValue",
+    #           },
+    #         },
     #         private_endpoint: {
     #           self_managed_lattice_resource: {
     #             resource_configuration_identifier: "ResourceConfigurationIdentifier",
@@ -3728,6 +3742,11 @@ module Aws::BedrockAgentCoreControl
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.oauth_discovery.authorization_server_metadata.token_endpoint_auth_methods #=> Array
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.oauth_discovery.authorization_server_metadata.token_endpoint_auth_methods[0] #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.client_id #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.grant_type #=> String, one of "TOKEN_EXCHANGE", "JWT_AUTHORIZATION_GRANT"
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_content #=> String, one of "NONE", "M2M", "AWS_IAM_ID_TOKEN_JWT"
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes #=> Array
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes[0] #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.client_authentication_method #=> String, one of "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST", "AWS_IAM_ID_TOKEN_JWT", "PRIVATE_KEY_JWT"
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.self_managed_lattice_resource.resource_configuration_identifier #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.managed_vpc_resource.vpc_identifier #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.managed_vpc_resource.subnet_ids #=> Array
@@ -3750,11 +3769,12 @@ module Aws::BedrockAgentCoreControl
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint_overrides[0].private_endpoint.managed_vpc_resource.tags #=> Hash
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint_overrides[0].private_endpoint.managed_vpc_resource.tags["TagKey"] #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint_overrides[0].private_endpoint.managed_vpc_resource.routing_domain #=> String
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.grant_type #=> String, one of "TOKEN_EXCHANGE", "JWT_AUTHORIZATION_GRANT"
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_content #=> String, one of "NONE", "M2M", "AWS_IAM_ID_TOKEN_JWT"
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes #=> Array
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes[0] #=> String
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.client_authentication_method #=> String, one of "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST", "AWS_IAM_ID_TOKEN_JWT"
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.private_key_source.kms_key_source.kms_key_arn #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.signing_algorithm #=> String, one of "RS256", "PS256", "ES256"
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.additional_header_claims #=> Hash
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.additional_header_claims["AdditionalClaimName"] #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.additional_payload_claims #=> Hash
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.additional_payload_claims["AdditionalClaimName"] #=> String
     #   resp.oauth2_provider_config_output.google_oauth_2_provider_config.oauth_discovery.discovery_url #=> String
     #   resp.oauth2_provider_config_output.google_oauth_2_provider_config.oauth_discovery.authorization_server_metadata.issuer #=> String
     #   resp.oauth2_provider_config_output.google_oauth_2_provider_config.oauth_discovery.authorization_server_metadata.authorization_endpoint #=> String
@@ -7549,6 +7569,11 @@ module Aws::BedrockAgentCoreControl
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.oauth_discovery.authorization_server_metadata.token_endpoint_auth_methods #=> Array
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.oauth_discovery.authorization_server_metadata.token_endpoint_auth_methods[0] #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.client_id #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.grant_type #=> String, one of "TOKEN_EXCHANGE", "JWT_AUTHORIZATION_GRANT"
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_content #=> String, one of "NONE", "M2M", "AWS_IAM_ID_TOKEN_JWT"
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes #=> Array
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes[0] #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.client_authentication_method #=> String, one of "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST", "AWS_IAM_ID_TOKEN_JWT", "PRIVATE_KEY_JWT"
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.self_managed_lattice_resource.resource_configuration_identifier #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.managed_vpc_resource.vpc_identifier #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.managed_vpc_resource.subnet_ids #=> Array
@@ -7571,11 +7596,12 @@ module Aws::BedrockAgentCoreControl
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint_overrides[0].private_endpoint.managed_vpc_resource.tags #=> Hash
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint_overrides[0].private_endpoint.managed_vpc_resource.tags["TagKey"] #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint_overrides[0].private_endpoint.managed_vpc_resource.routing_domain #=> String
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.grant_type #=> String, one of "TOKEN_EXCHANGE", "JWT_AUTHORIZATION_GRANT"
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_content #=> String, one of "NONE", "M2M", "AWS_IAM_ID_TOKEN_JWT"
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes #=> Array
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes[0] #=> String
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.client_authentication_method #=> String, one of "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST", "AWS_IAM_ID_TOKEN_JWT"
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.private_key_source.kms_key_source.kms_key_arn #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.signing_algorithm #=> String, one of "RS256", "PS256", "ES256"
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.additional_header_claims #=> Hash
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.additional_header_claims["AdditionalClaimName"] #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.additional_payload_claims #=> Hash
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.additional_payload_claims["AdditionalClaimName"] #=> String
     #   resp.oauth2_provider_config_output.google_oauth_2_provider_config.oauth_discovery.discovery_url #=> String
     #   resp.oauth2_provider_config_output.google_oauth_2_provider_config.oauth_discovery.authorization_server_metadata.issuer #=> String
     #   resp.oauth2_provider_config_output.google_oauth_2_provider_config.oauth_discovery.authorization_server_metadata.authorization_endpoint #=> String
@@ -13722,7 +13748,21 @@ module Aws::BedrockAgentCoreControl
     #             actor_token_scopes: ["ScopeType"],
     #           },
     #         },
-    #         client_authentication_method: "CLIENT_SECRET_BASIC", # accepts CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, AWS_IAM_ID_TOKEN_JWT
+    #         client_authentication_method: "CLIENT_SECRET_BASIC", # accepts CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, AWS_IAM_ID_TOKEN_JWT, PRIVATE_KEY_JWT
+    #         private_key_jwt_config: {
+    #           private_key_source: {
+    #             kms_key_source: {
+    #               kms_key_arn: "KmsKeyArn", # required
+    #             },
+    #           },
+    #           signing_algorithm: "RS256", # accepts RS256, PS256, ES256
+    #           additional_header_claims: {
+    #             "AdditionalClaimName" => "AdditionalClaimValue",
+    #           },
+    #           additional_payload_claims: {
+    #             "AdditionalClaimName" => "AdditionalClaimValue",
+    #           },
+    #         },
     #         private_endpoint: {
     #           self_managed_lattice_resource: {
     #             resource_configuration_identifier: "ResourceConfigurationIdentifier",
@@ -13856,6 +13896,11 @@ module Aws::BedrockAgentCoreControl
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.oauth_discovery.authorization_server_metadata.token_endpoint_auth_methods #=> Array
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.oauth_discovery.authorization_server_metadata.token_endpoint_auth_methods[0] #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.client_id #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.grant_type #=> String, one of "TOKEN_EXCHANGE", "JWT_AUTHORIZATION_GRANT"
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_content #=> String, one of "NONE", "M2M", "AWS_IAM_ID_TOKEN_JWT"
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes #=> Array
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes[0] #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.client_authentication_method #=> String, one of "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST", "AWS_IAM_ID_TOKEN_JWT", "PRIVATE_KEY_JWT"
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.self_managed_lattice_resource.resource_configuration_identifier #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.managed_vpc_resource.vpc_identifier #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint.managed_vpc_resource.subnet_ids #=> Array
@@ -13878,11 +13923,12 @@ module Aws::BedrockAgentCoreControl
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint_overrides[0].private_endpoint.managed_vpc_resource.tags #=> Hash
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint_overrides[0].private_endpoint.managed_vpc_resource.tags["TagKey"] #=> String
     #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_endpoint_overrides[0].private_endpoint.managed_vpc_resource.routing_domain #=> String
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.grant_type #=> String, one of "TOKEN_EXCHANGE", "JWT_AUTHORIZATION_GRANT"
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_content #=> String, one of "NONE", "M2M", "AWS_IAM_ID_TOKEN_JWT"
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes #=> Array
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.on_behalf_of_token_exchange_config.token_exchange_grant_type_config.actor_token_scopes[0] #=> String
-    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.client_authentication_method #=> String, one of "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST", "AWS_IAM_ID_TOKEN_JWT"
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.private_key_source.kms_key_source.kms_key_arn #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.signing_algorithm #=> String, one of "RS256", "PS256", "ES256"
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.additional_header_claims #=> Hash
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.additional_header_claims["AdditionalClaimName"] #=> String
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.additional_payload_claims #=> Hash
+    #   resp.oauth2_provider_config_output.custom_oauth_2_provider_config.private_key_jwt_config.additional_payload_claims["AdditionalClaimName"] #=> String
     #   resp.oauth2_provider_config_output.google_oauth_2_provider_config.oauth_discovery.discovery_url #=> String
     #   resp.oauth2_provider_config_output.google_oauth_2_provider_config.oauth_discovery.authorization_server_metadata.issuer #=> String
     #   resp.oauth2_provider_config_output.google_oauth_2_provider_config.oauth_discovery.authorization_server_metadata.authorization_endpoint #=> String
@@ -15079,7 +15125,7 @@ module Aws::BedrockAgentCoreControl
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-bedrockagentcorecontrol'
-      context[:gem_version] = '1.59.0'
+      context[:gem_version] = '1.60.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-bedrockagentcorecontrol/client_api.rb

@@ -21,6 +21,9 @@ module Aws::BedrockAgentCoreControl
     ActorTokenContentType = Shapes::StringShape.new(name: 'ActorTokenContentType')
     AddDatasetExamplesRequest = Shapes::StructureShape.new(name: 'AddDatasetExamplesRequest')
     AddDatasetExamplesResponse = Shapes::StructureShape.new(name: 'AddDatasetExamplesResponse')
+    AdditionalClaimName = Shapes::StringShape.new(name: 'AdditionalClaimName')
+    AdditionalClaimValue = Shapes::StringShape.new(name: 'AdditionalClaimValue')
+    AdditionalClaims = Shapes::MapShape.new(name: 'AdditionalClaims')
     AdditionalModelRequestFields = Shapes::DocumentShape.new(name: 'AdditionalModelRequestFields', document: true)
     AdvertisedScopeMappingType = Shapes::MapShape.new(name: 'AdvertisedScopeMappingType')
     AgentCardDefinition = Shapes::StructureShape.new(name: 'AgentCardDefinition')
@@ -639,6 +642,7 @@ module Aws::BedrockAgentCoreControl
     KinesisResourceContentConfigurationsList = Shapes::ListShape.new(name: 'KinesisResourceContentConfigurationsList')
     KmsConfiguration = Shapes::StructureShape.new(name: 'KmsConfiguration')
     KmsKeyArn = Shapes::StringShape.new(name: 'KmsKeyArn')
+    KmsKeySourceType = Shapes::StructureShape.new(name: 'KmsKeySourceType')
     LambdaArn = Shapes::StringShape.new(name: 'LambdaArn')
     LambdaEvaluatorConfig = Shapes::StructureShape.new(name: 'LambdaEvaluatorConfig')
     LambdaEvaluatorConfigLambdaTimeoutInSecondsInteger = Shapes::IntegerShape.new(name: 'LambdaEvaluatorConfigLambdaTimeoutInSecondsInteger')
@@ -908,6 +912,8 @@ module Aws::BedrockAgentCoreControl
     PrivateEndpointOverride = Shapes::StructureShape.new(name: 'PrivateEndpointOverride')
     PrivateEndpointOverrideDomain = Shapes::StringShape.new(name: 'PrivateEndpointOverrideDomain')
     PrivateEndpointOverrides = Shapes::ListShape.new(name: 'PrivateEndpointOverrides')
+    PrivateKeyJwtConfig = Shapes::StructureShape.new(name: 'PrivateKeyJwtConfig')
+    PrivateKeySource = Shapes::UnionShape.new(name: 'PrivateKeySource')
     Prompt = Shapes::StringShape.new(name: 'Prompt')
     ProtocolConfiguration = Shapes::StructureShape.new(name: 'ProtocolConfiguration')
     ProviderPrefix = Shapes::StructureShape.new(name: 'ProviderPrefix')
@@ -1028,6 +1034,7 @@ module Aws::BedrockAgentCoreControl
     SessionStorageConfiguration = Shapes::StructureShape.new(name: 'SessionStorageConfiguration')
     SetTokenVaultCMKRequest = Shapes::StructureShape.new(name: 'SetTokenVaultCMKRequest')
     SetTokenVaultCMKResponse = Shapes::StructureShape.new(name: 'SetTokenVaultCMKResponse')
+    SigningAlgorithm = Shapes::StringShape.new(name: 'SigningAlgorithm')
     SkillDefinition = Shapes::StructureShape.new(name: 'SkillDefinition')
     SkillMdDefinition = Shapes::StructureShape.new(name: 'SkillMdDefinition')
     SlackOauth2ProviderConfigInput = Shapes::StructureShape.new(name: 'SlackOauth2ProviderConfigInput')
@@ -1270,6 +1277,9 @@ module Aws::BedrockAgentCoreControl
     AddDatasetExamplesResponse.add_member(:example_ids, Shapes::ShapeRef.new(shape: ExampleIdList, required: true, location_name: "exampleIds"))
     AddDatasetExamplesResponse.struct_class = Types::AddDatasetExamplesResponse
 
+    AdditionalClaims.key = Shapes::ShapeRef.new(shape: AdditionalClaimName)
+    AdditionalClaims.value = Shapes::ShapeRef.new(shape: AdditionalClaimValue)
+
     AdvertisedScopeMappingType.key = Shapes::ShapeRef.new(shape: AllowedScopeType)
     AdvertisedScopeMappingType.value = Shapes::ShapeRef.new(shape: AllowedScopeType)
 
@@ -2225,16 +2235,18 @@ module Aws::BedrockAgentCoreControl
     CustomOauth2ProviderConfigInput.add_member(:client_secret_source, Shapes::ShapeRef.new(shape: SecretSourceType, location_name: "clientSecretSource"))
     CustomOauth2ProviderConfigInput.add_member(:on_behalf_of_token_exchange_config, Shapes::ShapeRef.new(shape: OnBehalfOfTokenExchangeConfigType, location_name: "onBehalfOfTokenExchangeConfig"))
     CustomOauth2ProviderConfigInput.add_member(:client_authentication_method, Shapes::ShapeRef.new(shape: ClientAuthenticationMethodType, location_name: "clientAuthenticationMethod"))
+    CustomOauth2ProviderConfigInput.add_member(:private_key_jwt_config, Shapes::ShapeRef.new(shape: PrivateKeyJwtConfig, location_name: "privateKeyJwtConfig"))
     CustomOauth2ProviderConfigInput.add_member(:private_endpoint, Shapes::ShapeRef.new(shape: PrivateEndpoint, location_name: "privateEndpoint"))
     CustomOauth2ProviderConfigInput.add_member(:private_endpoint_overrides, Shapes::ShapeRef.new(shape: PrivateEndpointOverrides, location_name: "privateEndpointOverrides"))
     CustomOauth2ProviderConfigInput.struct_class = Types::CustomOauth2ProviderConfigInput
 
     CustomOauth2ProviderConfigOutput.add_member(:oauth_discovery, Shapes::ShapeRef.new(shape: Oauth2Discovery, required: true, location_name: "oauthDiscovery"))
     CustomOauth2ProviderConfigOutput.add_member(:client_id, Shapes::ShapeRef.new(shape: ClientIdType, location_name: "clientId"))
-    CustomOauth2ProviderConfigOutput.add_member(:private_endpoint, Shapes::ShapeRef.new(shape: PrivateEndpoint, location_name: "privateEndpoint"))
-    CustomOauth2ProviderConfigOutput.add_member(:private_endpoint_overrides, Shapes::ShapeRef.new(shape: PrivateEndpointOverrides, location_name: "privateEndpointOverrides"))
     CustomOauth2ProviderConfigOutput.add_member(:on_behalf_of_token_exchange_config, Shapes::ShapeRef.new(shape: OnBehalfOfTokenExchangeConfigType, location_name: "onBehalfOfTokenExchangeConfig"))
     CustomOauth2ProviderConfigOutput.add_member(:client_authentication_method, Shapes::ShapeRef.new(shape: ClientAuthenticationMethodType, location_name: "clientAuthenticationMethod"))
+    CustomOauth2ProviderConfigOutput.add_member(:private_endpoint, Shapes::ShapeRef.new(shape: PrivateEndpoint, location_name: "privateEndpoint"))
+    CustomOauth2ProviderConfigOutput.add_member(:private_endpoint_overrides, Shapes::ShapeRef.new(shape: PrivateEndpointOverrides, location_name: "privateEndpointOverrides"))
+    CustomOauth2ProviderConfigOutput.add_member(:private_key_jwt_config, Shapes::ShapeRef.new(shape: PrivateKeyJwtConfig, location_name: "privateKeyJwtConfig"))
     CustomOauth2ProviderConfigOutput.struct_class = Types::CustomOauth2ProviderConfigOutput
 
     CustomParameterMap.key = Shapes::ShapeRef.new(shape: String)
@@ -3691,6 +3703,9 @@ module Aws::BedrockAgentCoreControl
     KmsConfiguration.add_member(:kms_key_arn, Shapes::ShapeRef.new(shape: KmsKeyArn, location_name: "kmsKeyArn"))
     KmsConfiguration.struct_class = Types::KmsConfiguration
 
+    KmsKeySourceType.add_member(:kms_key_arn, Shapes::ShapeRef.new(shape: KmsKeyArn, required: true, location_name: "kmsKeyArn"))
+    KmsKeySourceType.struct_class = Types::KmsKeySourceType
+
     LambdaEvaluatorConfig.add_member(:lambda_arn, Shapes::ShapeRef.new(shape: LambdaArn, required: true, location_name: "lambdaArn"))
     LambdaEvaluatorConfig.add_member(:lambda_timeout_in_seconds, Shapes::ShapeRef.new(shape: LambdaEvaluatorConfigLambdaTimeoutInSecondsInteger, location_name: "lambdaTimeoutInSeconds"))
     LambdaEvaluatorConfig.struct_class = Types::LambdaEvaluatorConfig
@@ -4570,6 +4585,18 @@ module Aws::BedrockAgentCoreControl
 
     PrivateEndpointOverrides.member = Shapes::ShapeRef.new(shape: PrivateEndpointOverride)
 
+    PrivateKeyJwtConfig.add_member(:private_key_source, Shapes::ShapeRef.new(shape: PrivateKeySource, location_name: "privateKeySource"))
+    PrivateKeyJwtConfig.add_member(:signing_algorithm, Shapes::ShapeRef.new(shape: SigningAlgorithm, location_name: "signingAlgorithm"))
+    PrivateKeyJwtConfig.add_member(:additional_header_claims, Shapes::ShapeRef.new(shape: AdditionalClaims, location_name: "additionalHeaderClaims"))
+    PrivateKeyJwtConfig.add_member(:additional_payload_claims, Shapes::ShapeRef.new(shape: AdditionalClaims, location_name: "additionalPayloadClaims"))
+    PrivateKeyJwtConfig.struct_class = Types::PrivateKeyJwtConfig
+
+    PrivateKeySource.add_member(:kms_key_source, Shapes::ShapeRef.new(shape: KmsKeySourceType, location_name: "kmsKeySource"))
+    PrivateKeySource.add_member(:unknown, Shapes::ShapeRef.new(shape: nil, location_name: 'unknown'))
+    PrivateKeySource.add_member_subclass(:kms_key_source, Types::PrivateKeySource::KmsKeySource)
+    PrivateKeySource.add_member_subclass(:unknown, Types::PrivateKeySource::Unknown)
+    PrivateKeySource.struct_class = Types::PrivateKeySource
+
     ProtocolConfiguration.add_member(:server_protocol, Shapes::ShapeRef.new(shape: ServerProtocol, required: true, location_name: "serverProtocol"))
     ProtocolConfiguration.struct_class = Types::ProtocolConfiguration
 

data/lib/aws-sdk-bedrockagentcorecontrol/types.rb

@@ -4869,6 +4869,13 @@ module Aws::BedrockAgentCoreControl
     #   token endpoint.
     #   @return [String]
     #
+    # @!attribute [rw] private_key_jwt_config
+    #   Configuration for private\_key\_jwt client authentication (RFC
+    #   7523). On Create: privateKeySource and signingAlgorithm are required
+    #   (enforced server-side). On Update: all fields are optional — only
+    #   provided fields are updated.
+    #   @return [Types::PrivateKeyJwtConfig]
+    #
     # @!attribute [rw] private_endpoint
     #   The default private endpoint for the custom OAuth2 provider,
     #   enabling secure connectivity through a VPC Lattice resource
@@ -4890,6 +4897,7 @@ module Aws::BedrockAgentCoreControl
       :client_secret_source,
       :on_behalf_of_token_exchange_config,
       :client_authentication_method,
+      :private_key_jwt_config,
       :private_endpoint,
       :private_endpoint_overrides)
       SENSITIVE = [:client_secret]
@@ -4906,6 +4914,15 @@ module Aws::BedrockAgentCoreControl
     #   The client ID for the custom OAuth2 provider.
     #   @return [String]
     #
+    # @!attribute [rw] on_behalf_of_token_exchange_config
+    #   The configuration for on-behalf-of token exchange.
+    #   @return [Types::OnBehalfOfTokenExchangeConfigType]
+    #
+    # @!attribute [rw] client_authentication_method
+    #   The client authentication method used when authenticating with the
+    #   token endpoint.
+    #   @return [String]
+    #
     # @!attribute [rw] private_endpoint
     #   The default private endpoint for the custom OAuth2 provider,
     #   enabling secure connectivity through a VPC Lattice resource
@@ -4917,24 +4934,23 @@ module Aws::BedrockAgentCoreControl
     #   configuration.
     #   @return [Array<Types::PrivateEndpointOverride>]
     #
-    # @!attribute [rw] on_behalf_of_token_exchange_config
-    #   The configuration for on-behalf-of token exchange.
-    #   @return [Types::OnBehalfOfTokenExchangeConfigType]
-    #
-    # @!attribute [rw] client_authentication_method
-    #   The client authentication method used when authenticating with the
-    #   token endpoint.
-    #   @return [String]
+    # @!attribute [rw] private_key_jwt_config
+    #   Configuration for private\_key\_jwt client authentication (RFC
+    #   7523). On Create: privateKeySource and signingAlgorithm are required
+    #   (enforced server-side). On Update: all fields are optional — only
+    #   provided fields are updated.
+    #   @return [Types::PrivateKeyJwtConfig]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/CustomOauth2ProviderConfigOutput AWS API Documentation
     #
     class CustomOauth2ProviderConfigOutput < Struct.new(
       :oauth_discovery,
       :client_id,
+      :on_behalf_of_token_exchange_config,
+      :client_authentication_method,
       :private_endpoint,
       :private_endpoint_overrides,
-      :on_behalf_of_token_exchange_config,
-      :client_authentication_method)
+      :private_key_jwt_config)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -11641,6 +11657,23 @@ module Aws::BedrockAgentCoreControl
       include Aws::Structure
     end
 
+    # Contains the KMS key configuration for a JWT client assertion.
+    #
+    # @!attribute [rw] kms_key_arn
+    #   The Amazon Resource Name (ARN) of the KMS key used to sign the JWT
+    #   client assertion. The key must be an asymmetric key with key usage
+    #   SIGN\_VERIFY and a key spec compatible with the configured signing
+    #   algorithm.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/KmsKeySourceType AWS API Documentation
+    #
+    class KmsKeySourceType < Struct.new(
+      :kms_key_arn)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Configuration for a Lambda function used as a code-based evaluator.
     #
     # @!attribute [rw] lambda_arn
@@ -15760,6 +15793,67 @@ module Aws::BedrockAgentCoreControl
       include Aws::Structure
     end
 
+    # Configuration for private\_key\_jwt client authentication (RFC 7523).
+    # On Create: privateKeySource and signingAlgorithm are required
+    # (enforced server-side). On Update: all fields are optional — only
+    # provided fields are updated.
+    #
+    # @!attribute [rw] private_key_source
+    #   The private key source for the JWT client assertion.
+    #   @return [Types::PrivateKeySource]
+    #
+    # @!attribute [rw] signing_algorithm
+    #   The algorithm used to sign the JWT client assertion. Valid values
+    #   are `RS256`, `PS256`, and `ES256`.
+    #   @return [String]
+    #
+    # @!attribute [rw] additional_header_claims
+    #   A map of additional claims to include in the JWT client assertion
+    #   header. Standard header claims such as `alg` and `typ` cannot be
+    #   added.
+    #   @return [Hash<String,String>]
+    #
+    # @!attribute [rw] additional_payload_claims
+    #   A map of additional claims to include in the JWT client assertion
+    #   payload. Payload claims generated by the service, such as `iss`,
+    #   `sub`, `jti`, and `exp`, cannot be added.
+    #   @return [Hash<String,String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/PrivateKeyJwtConfig AWS API Documentation
+    #
+    class PrivateKeyJwtConfig < Struct.new(
+      :private_key_source,
+      :signing_algorithm,
+      :additional_header_claims,
+      :additional_payload_claims)
+      SENSITIVE = [:additional_header_claims, :additional_payload_claims]
+      include Aws::Structure
+    end
+
+    # Contains the private key source configuration for a JWT client
+    # assertion.
+    #
+    # @note PrivateKeySource is a union - when making an API calls you must set exactly one of the members.
+    #
+    # @note PrivateKeySource is a union - when returned from an API call exactly one value will be set and the returned type will be a subclass of PrivateKeySource corresponding to the set member.
+    #
+    # @!attribute [rw] kms_key_source
+    #   The KMS key source for the JWT client assertion.
+    #   @return [Types::KmsKeySourceType]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/PrivateKeySource AWS API Documentation
+    #
+    class PrivateKeySource < Struct.new(
+      :kms_key_source,
+      :unknown)
+      SENSITIVE = []
+      include Aws::Structure
+      include Aws::Structure::Union
+
+      class KmsKeySource < PrivateKeySource; end
+      class Unknown < PrivateKeySource; end
+    end
+
     # The protocol configuration for an agent runtime. This structure
     # defines how the agent runtime communicates with clients.
     #

data/lib/aws-sdk-bedrockagentcorecontrol.rb

@@ -55,7 +55,7 @@ module Aws::BedrockAgentCoreControl
   autoload :EndpointProvider, 'aws-sdk-bedrockagentcorecontrol/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-bedrockagentcorecontrol/endpoints'
 
-  GEM_VERSION = '1.59.0'
+  GEM_VERSION = '1.60.0'
 
 end
 

data/sig/params.rbs

@@ -871,6 +871,17 @@ module Aws
       }?
     }
 
+      type private_key_jwt_config = {
+      private_key_source: {
+        kms_key_source: {
+          kms_key_arn: ::String
+        }?
+      }?,
+      signing_algorithm: ("RS256" | "PS256" | "ES256")?,
+      additional_header_claims: Hash[::String, ::String]?,
+      additional_payload_claims: Hash[::String, ::String]?
+    }
+
       type custom_oauth_2_provider_config_input = {
       oauth_discovery: Params::oauth_2_discovery,
       client_id: ::String?,
@@ -887,7 +898,8 @@ module Aws
           actor_token_scopes: Array[::String]?
         }?
       }?,
-      client_authentication_method: ("CLIENT_SECRET_BASIC" | "CLIENT_SECRET_POST" | "AWS_IAM_ID_TOKEN_JWT")?,
+      client_authentication_method: ("CLIENT_SECRET_BASIC" | "CLIENT_SECRET_POST" | "AWS_IAM_ID_TOKEN_JWT" | "PRIVATE_KEY_JWT")?,
+      private_key_jwt_config: Params::private_key_jwt_config?,
       private_endpoint: Params::private_endpoint?,
       private_endpoint_overrides: Array[
         Params::private_endpoint_override

data/sig/types.rbs

@@ -1255,7 +1255,8 @@ module Aws::BedrockAgentCoreControl
       attr_accessor client_secret_config: Types::SecretReference
       attr_accessor client_secret_source: ("MANAGED" | "EXTERNAL")
       attr_accessor on_behalf_of_token_exchange_config: Types::OnBehalfOfTokenExchangeConfigType
-      attr_accessor client_authentication_method: ("CLIENT_SECRET_BASIC" | "CLIENT_SECRET_POST" | "AWS_IAM_ID_TOKEN_JWT")
+      attr_accessor client_authentication_method: ("CLIENT_SECRET_BASIC" | "CLIENT_SECRET_POST" | "AWS_IAM_ID_TOKEN_JWT" | "PRIVATE_KEY_JWT")
+      attr_accessor private_key_jwt_config: Types::PrivateKeyJwtConfig
       attr_accessor private_endpoint: Types::PrivateEndpoint
       attr_accessor private_endpoint_overrides: ::Array[Types::PrivateEndpointOverride]
       SENSITIVE: [:client_secret]
@@ -1264,10 +1265,11 @@ module Aws::BedrockAgentCoreControl
     class CustomOauth2ProviderConfigOutput
       attr_accessor oauth_discovery: Types::Oauth2Discovery
       attr_accessor client_id: ::String
+      attr_accessor on_behalf_of_token_exchange_config: Types::OnBehalfOfTokenExchangeConfigType
+      attr_accessor client_authentication_method: ("CLIENT_SECRET_BASIC" | "CLIENT_SECRET_POST" | "AWS_IAM_ID_TOKEN_JWT" | "PRIVATE_KEY_JWT")
       attr_accessor private_endpoint: Types::PrivateEndpoint
       attr_accessor private_endpoint_overrides: ::Array[Types::PrivateEndpointOverride]
-      attr_accessor on_behalf_of_token_exchange_config: Types::OnBehalfOfTokenExchangeConfigType
-      attr_accessor client_authentication_method: ("CLIENT_SECRET_BASIC" | "CLIENT_SECRET_POST" | "AWS_IAM_ID_TOKEN_JWT")
+      attr_accessor private_key_jwt_config: Types::PrivateKeyJwtConfig
       SENSITIVE: []
     end
 
@@ -3187,6 +3189,11 @@ module Aws::BedrockAgentCoreControl
       SENSITIVE: []
     end
 
+    class KmsKeySourceType
+      attr_accessor kms_key_arn: ::String
+      SENSITIVE: []
+    end
+
     class LambdaEvaluatorConfig
       attr_accessor lambda_arn: ::String
       attr_accessor lambda_timeout_in_seconds: ::Integer
@@ -4370,6 +4377,25 @@ module Aws::BedrockAgentCoreControl
       SENSITIVE: []
     end
 
+    class PrivateKeyJwtConfig
+      attr_accessor private_key_source: Types::PrivateKeySource
+      attr_accessor signing_algorithm: ("RS256" | "PS256" | "ES256")
+      attr_accessor additional_header_claims: ::Hash[::String, ::String]
+      attr_accessor additional_payload_claims: ::Hash[::String, ::String]
+      SENSITIVE: []
+    end
+
+    class PrivateKeySource
+      attr_accessor kms_key_source: Types::KmsKeySourceType
+      attr_accessor unknown: untyped
+      SENSITIVE: []
+
+      class KmsKeySource < PrivateKeySource
+      end
+      class Unknown < PrivateKeySource
+      end
+    end
+
     class ProtocolConfiguration
       attr_accessor server_protocol: ("MCP" | "HTTP" | "A2A" | "AGUI")
       SENSITIVE: []

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-bedrockagentcorecontrol
 version: !ruby/object:Gem::Version
-  version: 1.59.0
+  version: 1.60.0
 platform: ruby
 authors:
 - Amazon Web Services