@aws-cdk/aws-bedrock-agentcore-alpha 2.225.0-alpha.0 → 2.227.0-alpha.0

package/agentcore/gateway/outbound-auth/credential-provider.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GatewayCredentialProvider = exports.CredentialProviderType = void 0;
+const jsiiDeprecationWarnings = require("../../../.warnings.jsii.js");
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const api_key_1 = require("./api-key");
+const iam_role_1 = require("./iam-role");
+const oauth_1 = require("./oauth");
+/******************************************************************************
+ *                                 Enums
+ *****************************************************************************/
+/**
+ * Credential provider types supported by gateway target
+ */
+var CredentialProviderType;
+(function (CredentialProviderType) {
+    /**
+     * API Key authentication
+     */
+    CredentialProviderType["API_KEY"] = "API_KEY";
+    /**
+     * OAuth authentication
+     */
+    CredentialProviderType["OAUTH"] = "OAUTH";
+    /**
+     * IAM role authentication
+     */
+    CredentialProviderType["GATEWAY_IAM_ROLE"] = "GATEWAY_IAM_ROLE";
+})(CredentialProviderType || (exports.CredentialProviderType = CredentialProviderType = {}));
+/**
+ * Factory class for creating different Gateway Credential Providers
+ */
+class GatewayCredentialProvider {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCredentialProvider", version: "2.227.0-alpha.0" };
+    /**
+     * Create an API key credential provider from Identity ARN
+     * Use this method when you have the Identity ARN as a string
+     * @param props - The configuration properties for the API key credential provider
+     * @returns ICredentialProviderConfig configured for API key authentication
+     */
+    static fromApiKeyIdentityArn(props) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_ApiKeyCredentialProviderProps(props);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, this.fromApiKeyIdentityArn);
+            }
+            throw error;
+        }
+        return new api_key_1.ApiKeyCredentialProviderConfiguration(props);
+    }
+    /**
+     * Create an OAuth credential provider from Identity ARN
+     * Use this method when you have the Identity ARN as a string
+     * @param props - The configuration properties for the OAuth credential provider
+     * @returns ICredentialProviderConfig configured for OAuth authentication
+     */
+    static fromOauthIdentityArn(props) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_OAuthConfiguration(props);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, this.fromOauthIdentityArn);
+            }
+            throw error;
+        }
+        return new oauth_1.OAuthCredentialProviderConfiguration(props);
+    }
+    /**
+     * Create an IAM role credential provider
+     * @returns IIamRoleCredentialProvider configured for IAM role authentication
+     */
+    static fromIamRole() {
+        return new iam_role_1.GatewayIamRoleCredentialProviderConfig();
+    }
+}
+exports.GatewayCredentialProvider = GatewayCredentialProvider;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3JlZGVudGlhbC1wcm92aWRlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImNyZWRlbnRpYWwtcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFFQSx1Q0FBaUc7QUFDakcseUNBQW9FO0FBQ3BFLG1DQUFtRjtBQUduRjs7K0VBRStFO0FBQy9FOztHQUVHO0FBQ0gsSUFBWSxzQkFlWDtBQWZELFdBQVksc0JBQXNCO0lBQ2hDOztPQUVHO0lBQ0gsNkNBQW1CLENBQUE7SUFFbkI7O09BRUc7SUFDSCx5Q0FBZSxDQUFBO0lBRWY7O09BRUc7SUFDSCwrREFBcUMsQ0FBQTtBQUN2QyxDQUFDLEVBZlcsc0JBQXNCLHNDQUF0QixzQkFBc0IsUUFlakM7QUEyQkQ7O0dBRUc7QUFDSCxNQUFzQix5QkFBeUI7O0lBQzdDOzs7OztPQUtHO0lBQ0ksTUFBTSxDQUFDLHFCQUFxQixDQUFDLEtBQW9DOzs7Ozs7Ozs7O1FBQ3RFLE9BQU8sSUFBSSwrQ0FBcUMsQ0FBQyxLQUFLLENBQUMsQ0FBQztLQUN6RDtJQUVEOzs7OztPQUtHO0lBQ0ksTUFBTSxDQUFDLG9CQUFvQixDQUFDLEtBQXlCOzs7Ozs7Ozs7O1FBQzFELE9BQU8sSUFBSSw0Q0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztLQUN4RDtJQUVEOzs7T0FHRztJQUNJLE1BQU0sQ0FBQyxXQUFXO1FBQ3ZCLE9BQU8sSUFBSSxpREFBc0MsRUFBRSxDQUFDO0tBQ3JEOztBQTNCSCw4REE0QkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBJUmVzb2x2YWJsZSB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCB7IENmbkdhdGV3YXlUYXJnZXQgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtYmVkcm9ja2FnZW50Y29yZSc7XG5pbXBvcnQgeyBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJDb25maWd1cmF0aW9uLCBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJQcm9wcyB9IGZyb20gJy4vYXBpLWtleSc7XG5pbXBvcnQgeyBHYXRld2F5SWFtUm9sZUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB9IGZyb20gJy4vaWFtLXJvbGUnO1xuaW1wb3J0IHsgT0F1dGhDb25maWd1cmF0aW9uLCBPQXV0aENyZWRlbnRpYWxQcm92aWRlckNvbmZpZ3VyYXRpb24gfSBmcm9tICcuL29hdXRoJztcbmltcG9ydCB7IEdyYW50LCBJUm9sZSB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVudW1zXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG4vKipcbiAqIENyZWRlbnRpYWwgcHJvdmlkZXIgdHlwZXMgc3VwcG9ydGVkIGJ5IGdhdGV3YXkgdGFyZ2V0XG4gKi9cbmV4cG9ydCBlbnVtIENyZWRlbnRpYWxQcm92aWRlclR5cGUge1xuICAvKipcbiAgICogQVBJIEtleSBhdXRoZW50aWNhdGlvblxuICAgKi9cbiAgQVBJX0tFWSA9ICdBUElfS0VZJyxcblxuICAvKipcbiAgICogT0F1dGggYXV0aGVudGljYXRpb25cbiAgICovXG4gIE9BVVRIID0gJ09BVVRIJyxcblxuICAvKipcbiAgICogSUFNIHJvbGUgYXV0aGVudGljYXRpb25cbiAgICovXG4gIEdBVEVXQVlfSUFNX1JPTEUgPSAnR0FURVdBWV9JQU1fUk9MRScsXG59XG5cbi8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiAqICAgICAgICAgICAgICAgICAgICAgICBDcmVkZW50aWFsIFByb3ZpZGVyXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbi8qKlxuICogQWJzdHJhY3QgaW50ZXJmYWNlIGZvciBnYXRld2F5IGNyZWRlbnRpYWwgcHJvdmlkZXIgY29uZmlndXJhdGlvblxuICovXG5leHBvcnQgaW50ZXJmYWNlIElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcge1xuICAvKipcbiAgICogVGhlIGNyZWRlbnRpYWwgcHJvdmlkZXIgdHlwZVxuICAgKi9cbiAgcmVhZG9ubHkgY3JlZGVudGlhbFByb3ZpZGVyVHlwZTogQ3JlZGVudGlhbFByb3ZpZGVyVHlwZTtcblxuICAvKipcbiAgICogUmVuZGVycyBhcyBDRk4gUHJvcGVydHlcbiAgICogIEBpbnRlcm5hbFxuICAgKi9cbiAgX3JlbmRlcigpOiBDZm5HYXRld2F5VGFyZ2V0LkNyZWRlbnRpYWxQcm92aWRlckNvbmZpZ3VyYXRpb25Qcm9wZXJ0eSB8IElSZXNvbHZhYmxlO1xuXG4gIC8qKlxuICAgKiBHcmFudCB0aGUgcm9sZSB0aGUgcGVybWlzc2lvbnNcbiAgICovXG4gIGdyYW50TmVlZGVkUGVybWlzc2lvbnNUb1JvbGUocm9sZTogSVJvbGUpOiBHcmFudCB8IHVuZGVmaW5lZDtcbn1cblxuLyoqXG4gKiBGYWN0b3J5IGNsYXNzIGZvciBjcmVhdGluZyBkaWZmZXJlbnQgR2F0ZXdheSBDcmVkZW50aWFsIFByb3ZpZGVyc1xuICovXG5leHBvcnQgYWJzdHJhY3QgY2xhc3MgR2F0ZXdheUNyZWRlbnRpYWxQcm92aWRlciB7XG4gIC8qKlxuICAgKiBDcmVhdGUgYW4gQVBJIGtleSBjcmVkZW50aWFsIHByb3ZpZGVyIGZyb20gSWRlbnRpdHkgQVJOXG4gICAqIFVzZSB0aGlzIG1ldGhvZCB3aGVuIHlvdSBoYXZlIHRoZSBJZGVudGl0eSBBUk4gYXMgYSBzdHJpbmdcbiAgICogQHBhcmFtIHByb3BzIC0gVGhlIGNvbmZpZ3VyYXRpb24gcHJvcGVydGllcyBmb3IgdGhlIEFQSSBrZXkgY3JlZGVudGlhbCBwcm92aWRlclxuICAgKiBAcmV0dXJucyBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIGNvbmZpZ3VyZWQgZm9yIEFQSSBrZXkgYXV0aGVudGljYXRpb25cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgZnJvbUFwaUtleUlkZW50aXR5QXJuKHByb3BzOiBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJQcm9wcyk6IElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcge1xuICAgIHJldHVybiBuZXcgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvbihwcm9wcyk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGFuIE9BdXRoIGNyZWRlbnRpYWwgcHJvdmlkZXIgZnJvbSBJZGVudGl0eSBBUk5cbiAgICogVXNlIHRoaXMgbWV0aG9kIHdoZW4geW91IGhhdmUgdGhlIElkZW50aXR5IEFSTiBhcyBhIHN0cmluZ1xuICAgKiBAcGFyYW0gcHJvcHMgLSBUaGUgY29uZmlndXJhdGlvbiBwcm9wZXJ0aWVzIGZvciB0aGUgT0F1dGggY3JlZGVudGlhbCBwcm92aWRlclxuICAgKiBAcmV0dXJucyBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIGNvbmZpZ3VyZWQgZm9yIE9BdXRoIGF1dGhlbnRpY2F0aW9uXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIGZyb21PYXV0aElkZW50aXR5QXJuKHByb3BzOiBPQXV0aENvbmZpZ3VyYXRpb24pOiBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIHtcbiAgICByZXR1cm4gbmV3IE9BdXRoQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvbihwcm9wcyk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGFuIElBTSByb2xlIGNyZWRlbnRpYWwgcHJvdmlkZXJcbiAgICogQHJldHVybnMgSUlhbVJvbGVDcmVkZW50aWFsUHJvdmlkZXIgY29uZmlndXJlZCBmb3IgSUFNIHJvbGUgYXV0aGVudGljYXRpb25cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgZnJvbUlhbVJvbGUoKTogSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB7XG4gICAgcmV0dXJuIG5ldyBHYXRld2F5SWFtUm9sZUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZygpO1xuICB9XG59XG4iXX0=

package/agentcore/gateway/outbound-auth/iam-role.d.ts

@@ -0,0 +1,28 @@
+/******************************************************************************
+ *                                 IAM Role
+ *****************************************************************************/
+import { Grant, IRole } from 'aws-cdk-lib/aws-iam';
+import { CredentialProviderType, ICredentialProviderConfig } from './credential-provider';
+/**
+ * Gateway IAM Role credential provider configuration implementation
+ * Can be used with Lambda and Smithy targets
+ * @internal
+ */
+export declare class GatewayIamRoleCredentialProviderConfig implements ICredentialProviderConfig {
+    readonly credentialProviderType = CredentialProviderType.GATEWAY_IAM_ROLE;
+    constructor();
+    /**
+     * @internal
+     */
+    _render(): any;
+    /**
+     * No-op for IAM role authentication - no additional permissions are required.
+     * When using IAM role authentication for outbound calls, the gateway uses its own execution
+     * role to authenticate with the target endpoint. Unlike API Key and OAuth credential providers
+     * which require permissions to access external credential stores (Secrets Manager, Token Vault),
+     * IAM role authentication leverages AWS IAM's native authentication without additional resources.
+     * @param role The gateway's execution role (unused - no credential provider permissions needed)
+     * @returns undefined - no additional credential provider permissions to grant
+     */
+    grantNeededPermissionsToRole(role: IRole): Grant | undefined;
+}

package/agentcore/gateway/outbound-auth/iam-role.js

@@ -0,0 +1,40 @@
+"use strict";
+/******************************************************************************
+ *                                 IAM Role
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GatewayIamRoleCredentialProviderConfig = void 0;
+const credential_provider_1 = require("./credential-provider");
+/**
+ * Gateway IAM Role credential provider configuration implementation
+ * Can be used with Lambda and Smithy targets
+ * @internal
+ */
+class GatewayIamRoleCredentialProviderConfig {
+    credentialProviderType = credential_provider_1.CredentialProviderType.GATEWAY_IAM_ROLE;
+    constructor() { }
+    /**
+     * @internal
+     */
+    _render() {
+        return {
+            credentialProviderType: this.credentialProviderType,
+        };
+    }
+    /**
+     * No-op for IAM role authentication - no additional permissions are required.
+     * When using IAM role authentication for outbound calls, the gateway uses its own execution
+     * role to authenticate with the target endpoint. Unlike API Key and OAuth credential providers
+     * which require permissions to access external credential stores (Secrets Manager, Token Vault),
+     * IAM role authentication leverages AWS IAM's native authentication without additional resources.
+     * @param role The gateway's execution role (unused - no credential provider permissions needed)
+     * @returns undefined - no additional credential provider permissions to grant
+     */
+    grantNeededPermissionsToRole(role) {
+        if (role) {
+        }
+        return undefined;
+    }
+}
+exports.GatewayIamRoleCredentialProviderConfig = GatewayIamRoleCredentialProviderConfig;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWFtLXJvbGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJpYW0tcm9sZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQ0E7OytFQUUrRTs7O0FBRy9FLCtEQUEwRjtBQUUxRjs7OztHQUlHO0FBQ0gsTUFBYSxzQ0FBc0M7SUFDakMsc0JBQXNCLEdBQUcsNENBQXNCLENBQUMsZ0JBQWdCLENBQUM7SUFFakYsaUJBQWdCO0lBRWhCOztPQUVHO0lBQ0gsT0FBTztRQUNMLE9BQU87WUFDTCxzQkFBc0IsRUFBRSxJQUFJLENBQUMsc0JBQXNCO1NBQ3BELENBQUM7S0FDSDtJQUVEOzs7Ozs7OztPQVFHO0lBQ0gsNEJBQTRCLENBQUMsSUFBVztRQUN0QyxJQUFJLElBQUksRUFBRSxDQUFDO1FBQ1gsQ0FBQztRQUNELE9BQU8sU0FBUyxDQUFDO0tBQ2xCO0NBQ0Y7QUE1QkQsd0ZBNEJDIiwic291cmNlc0NvbnRlbnQiOlsiXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElBTSBSb2xlXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbmltcG9ydCB7IEdyYW50LCBJUm9sZSB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0IHsgQ3JlZGVudGlhbFByb3ZpZGVyVHlwZSwgSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB9IGZyb20gJy4vY3JlZGVudGlhbC1wcm92aWRlcic7XG5cbi8qKlxuICogR2F0ZXdheSBJQU0gUm9sZSBjcmVkZW50aWFsIHByb3ZpZGVyIGNvbmZpZ3VyYXRpb24gaW1wbGVtZW50YXRpb25cbiAqIENhbiBiZSB1c2VkIHdpdGggTGFtYmRhIGFuZCBTbWl0aHkgdGFyZ2V0c1xuICogQGludGVybmFsXG4gKi9cbmV4cG9ydCBjbGFzcyBHYXRld2F5SWFtUm9sZUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyBpbXBsZW1lbnRzIElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcge1xuICBwdWJsaWMgcmVhZG9ubHkgY3JlZGVudGlhbFByb3ZpZGVyVHlwZSA9IENyZWRlbnRpYWxQcm92aWRlclR5cGUuR0FURVdBWV9JQU1fUk9MRTtcblxuICBjb25zdHJ1Y3RvcigpIHt9XG5cbiAgLyoqXG4gICAqIEBpbnRlcm5hbFxuICAgKi9cbiAgX3JlbmRlcigpOiBhbnkge1xuICAgIHJldHVybiB7XG4gICAgICBjcmVkZW50aWFsUHJvdmlkZXJUeXBlOiB0aGlzLmNyZWRlbnRpYWxQcm92aWRlclR5cGUsXG4gICAgfTtcbiAgfVxuXG4gIC8qKlxuICAgKiBOby1vcCBmb3IgSUFNIHJvbGUgYXV0aGVudGljYXRpb24gLSBubyBhZGRpdGlvbmFsIHBlcm1pc3Npb25zIGFyZSByZXF1aXJlZC5cbiAgICogV2hlbiB1c2luZyBJQU0gcm9sZSBhdXRoZW50aWNhdGlvbiBmb3Igb3V0Ym91bmQgY2FsbHMsIHRoZSBnYXRld2F5IHVzZXMgaXRzIG93biBleGVjdXRpb25cbiAgICogcm9sZSB0byBhdXRoZW50aWNhdGUgd2l0aCB0aGUgdGFyZ2V0IGVuZHBvaW50LiBVbmxpa2UgQVBJIEtleSBhbmQgT0F1dGggY3JlZGVudGlhbCBwcm92aWRlcnNcbiAgICogd2hpY2ggcmVxdWlyZSBwZXJtaXNzaW9ucyB0byBhY2Nlc3MgZXh0ZXJuYWwgY3JlZGVudGlhbCBzdG9yZXMgKFNlY3JldHMgTWFuYWdlciwgVG9rZW4gVmF1bHQpLFxuICAgKiBJQU0gcm9sZSBhdXRoZW50aWNhdGlvbiBsZXZlcmFnZXMgQVdTIElBTSdzIG5hdGl2ZSBhdXRoZW50aWNhdGlvbiB3aXRob3V0IGFkZGl0aW9uYWwgcmVzb3VyY2VzLlxuICAgKiBAcGFyYW0gcm9sZSBUaGUgZ2F0ZXdheSdzIGV4ZWN1dGlvbiByb2xlICh1bnVzZWQgLSBubyBjcmVkZW50aWFsIHByb3ZpZGVyIHBlcm1pc3Npb25zIG5lZWRlZClcbiAgICogQHJldHVybnMgdW5kZWZpbmVkIC0gbm8gYWRkaXRpb25hbCBjcmVkZW50aWFsIHByb3ZpZGVyIHBlcm1pc3Npb25zIHRvIGdyYW50XG4gICAqL1xuICBncmFudE5lZWRlZFBlcm1pc3Npb25zVG9Sb2xlKHJvbGU6IElSb2xlKTogR3JhbnQgfCB1bmRlZmluZWQge1xuICAgIGlmIChyb2xlKSB7XG4gICAgfVxuICAgIHJldHVybiB1bmRlZmluZWQ7XG4gIH1cbn1cbiJdfQ==

package/agentcore/gateway/outbound-auth/oauth.d.ts

@@ -0,0 +1,80 @@
+import { Grant, IRole } from 'aws-cdk-lib/aws-iam';
+import { CredentialProviderType, ICredentialProviderConfig } from './credential-provider';
+/******************************************************************************
+ *                                OAuth
+ *****************************************************************************/
+/**
+ * OAuth configuration
+ */
+export interface OAuthConfiguration {
+    /**
+     * The OAuth credential provider ARN.
+     * This is returned when creating the OAuth credential provider via Console or API.
+     * Format: arn:aws:bedrock-agentcore:region:account:token-vault/id/oauth2credentialprovider/name
+     * Required: Yes
+     */
+    readonly providerArn: string;
+    /**
+     * The ARN of the Secrets Manager secret containing OAuth credentials (client ID and secret).
+     * This is returned when creating the OAuth credential provider via Console or API.
+     * Format: arn:aws:secretsmanager:region:account:secret:name
+     * Required: Yes
+     */
+    readonly secretArn: string;
+    /**
+     * The OAuth scopes for the credential provider.
+     * These scopes define the level of access requested from the OAuth provider.
+     *
+     * Array Members: Minimum number of 0 items. Maximum number of 100 items.
+     * Length Constraints: Minimum length of 1. Maximum length of 64.
+     * Required: Yes
+     */
+    readonly scopes: string[];
+    /**
+     * The custom parameters for the OAuth credential provider.
+     * These parameters provide additional configuration for the OAuth authentication process.
+     *
+     * Map Entries: Maximum number of 10 items.
+     * Key Length Constraints: Minimum length of 1. Maximum length of 256.
+     * Value Length Constraints: Minimum length of 1. Maximum length of 2048.
+     * Required: No
+     */
+    /**
+     * Custom parameters for the OAuth flow
+     * @default - No custom parameters
+     */
+    readonly customParameters?: Record<string, string>;
+}
+/**
+ * OAuth credential provider configuration implementation
+ * Can be used with OpenAPI targets
+ * @internal
+ */
+export declare class OAuthCredentialProviderConfiguration implements ICredentialProviderConfig {
+    readonly credentialProviderType = CredentialProviderType.OAUTH;
+    /**
+     * The ARN of the OAuth provider
+     */
+    readonly providerArn: string;
+    /**
+     * The ARN of the Secrets Manager secret
+     */
+    readonly secretArn: string;
+    /**
+     * The OAuth scopes to request
+     */
+    readonly scopes: string[];
+    /**
+     * Custom parameters for the OAuth flow
+     */
+    readonly customParameters?: Record<string, string>;
+    constructor(configuration: OAuthConfiguration);
+    /**
+     * Grant the needed permissions to the role for OAuth authentication
+     */
+    grantNeededPermissionsToRole(role: IRole): Grant | undefined;
+    /**
+     * @internal
+     */
+    _render(): any;
+}

package/agentcore/gateway/outbound-auth/oauth.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthCredentialProviderConfiguration = void 0;
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const credential_provider_1 = require("./credential-provider");
+const perms_1 = require("../perms");
+/**
+ * OAuth credential provider configuration implementation
+ * Can be used with OpenAPI targets
+ * @internal
+ */
+class OAuthCredentialProviderConfiguration {
+    credentialProviderType = credential_provider_1.CredentialProviderType.OAUTH;
+    /**
+     * The ARN of the OAuth provider
+     */
+    providerArn;
+    /**
+     * The ARN of the Secrets Manager secret
+     */
+    secretArn;
+    /**
+     * The OAuth scopes to request
+     */
+    scopes;
+    /**
+     * Custom parameters for the OAuth flow
+     */
+    customParameters;
+    constructor(configuration) {
+        this.providerArn = configuration.providerArn;
+        this.secretArn = configuration.secretArn;
+        this.scopes = configuration.scopes;
+        this.customParameters = configuration.customParameters;
+    }
+    /**
+     * Grant the needed permissions to the role for OAuth authentication
+     */
+    grantNeededPermissionsToRole(role) {
+        const statements = [
+            new aws_iam_1.PolicyStatement({
+                actions: [
+                    ...perms_1.GatewayPerms.GATEWAY_OAUTH_PERMS,
+                    ...perms_1.GatewayPerms.GATEWAY_WORKLOAD_IDENTITY_PERMS,
+                ],
+                resources: [this.providerArn],
+            }),
+            new aws_iam_1.PolicyStatement({
+                actions: perms_1.GatewayPerms.SECRETS_PERMS,
+                resources: [this.secretArn],
+            }),
+        ];
+        return aws_iam_1.Grant.addToPrincipal({
+            grantee: role,
+            actions: statements.flatMap(s => s.actions),
+            resourceArns: statements.flatMap(s => s.resources),
+        });
+    }
+    /**
+     * @internal
+     */
+    _render() {
+        return {
+            credentialProviderType: this.credentialProviderType,
+            credentialProvider: {
+                oauthCredentialProvider: {
+                    providerArn: this.providerArn,
+                    scopes: this.scopes,
+                    customParameters: this.customParameters,
+                },
+            },
+        };
+    }
+}
+exports.OAuthCredentialProviderConfiguration = OAuthCredentialProviderConfiguration;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2F1dGguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJvYXV0aC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxpREFBb0U7QUFDcEUsK0RBQTBGO0FBQzFGLG9DQUF3QztBQW9EeEM7Ozs7R0FJRztBQUNILE1BQWEsb0NBQW9DO0lBQy9CLHNCQUFzQixHQUFHLDRDQUFzQixDQUFDLEtBQUssQ0FBQztJQUN0RTs7T0FFRztJQUNhLFdBQVcsQ0FBUztJQUNwQzs7T0FFRztJQUNhLFNBQVMsQ0FBUztJQUNsQzs7T0FFRztJQUNhLE1BQU0sQ0FBVztJQUNqQzs7T0FFRztJQUNhLGdCQUFnQixDQUEwQjtJQUUxRCxZQUFZLGFBQWlDO1FBQzNDLElBQUksQ0FBQyxXQUFXLEdBQUcsYUFBYSxDQUFDLFdBQVcsQ0FBQztRQUM3QyxJQUFJLENBQUMsU0FBUyxHQUFHLGFBQWEsQ0FBQyxTQUFTLENBQUM7UUFDekMsSUFBSSxDQUFDLE1BQU0sR0FBRyxhQUFhLENBQUMsTUFBTSxDQUFDO1FBQ25DLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxhQUFhLENBQUMsZ0JBQWdCLENBQUM7S0FDeEQ7SUFFRDs7T0FFRztJQUNILDRCQUE0QixDQUFDLElBQVc7UUFDdEMsTUFBTSxVQUFVLEdBQUc7WUFDakIsSUFBSSx5QkFBZSxDQUFDO2dCQUNsQixPQUFPLEVBQUU7b0JBQ1AsR0FBRyxvQkFBWSxDQUFDLG1CQUFtQjtvQkFDbkMsR0FBRyxvQkFBWSxDQUFDLCtCQUErQjtpQkFDaEQ7Z0JBQ0QsU0FBUyxFQUFFLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQzthQUM5QixDQUFDO1lBQ0YsSUFBSSx5QkFBZSxDQUFDO2dCQUNsQixPQUFPLEVBQUUsb0JBQVksQ0FBQyxhQUFhO2dCQUNuQyxTQUFTLEVBQUUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO2FBQzVCLENBQUM7U0FDSCxDQUFDO1FBRUYsT0FBTyxlQUFLLENBQUMsY0FBYyxDQUFDO1lBQzFCLE9BQU8sRUFBRSxJQUFJO1lBQ2IsT0FBTyxFQUFFLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDO1lBQzNDLFlBQVksRUFBRSxVQUFVLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztTQUNuRCxDQUFDLENBQUM7S0FDSjtJQUVEOztPQUVHO0lBQ0gsT0FBTztRQUNMLE9BQU87WUFDTCxzQkFBc0IsRUFBRSxJQUFJLENBQUMsc0JBQXNCO1lBQ25ELGtCQUFrQixFQUFFO2dCQUNsQix1QkFBdUIsRUFBRTtvQkFDdkIsV0FBVyxFQUFFLElBQUksQ0FBQyxXQUFXO29CQUM3QixNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU07b0JBQ25CLGdCQUFnQixFQUFFLElBQUksQ0FBQyxnQkFBZ0I7aUJBQ3hDO2FBQ0Y7U0FDRixDQUFDO0tBQ0g7Q0FDRjtBQWxFRCxvRkFrRUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBHcmFudCwgSVJvbGUsIFBvbGljeVN0YXRlbWVudCB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0IHsgQ3JlZGVudGlhbFByb3ZpZGVyVHlwZSwgSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB9IGZyb20gJy4vY3JlZGVudGlhbC1wcm92aWRlcic7XG5pbXBvcnQgeyBHYXRld2F5UGVybXMgfSBmcm9tICcuLi9wZXJtcyc7XG5cbi8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiAqICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPQXV0aFxuICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqL1xuXG4vKipcbiAqIE9BdXRoIGNvbmZpZ3VyYXRpb25cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBPQXV0aENvbmZpZ3VyYXRpb24ge1xuICAvKipcbiAgICogVGhlIE9BdXRoIGNyZWRlbnRpYWwgcHJvdmlkZXIgQVJOLlxuICAgKiBUaGlzIGlzIHJldHVybmVkIHdoZW4gY3JlYXRpbmcgdGhlIE9BdXRoIGNyZWRlbnRpYWwgcHJvdmlkZXIgdmlhIENvbnNvbGUgb3IgQVBJLlxuICAgKiBGb3JtYXQ6IGFybjphd3M6YmVkcm9jay1hZ2VudGNvcmU6cmVnaW9uOmFjY291bnQ6dG9rZW4tdmF1bHQvaWQvb2F1dGgyY3JlZGVudGlhbHByb3ZpZGVyL25hbWVcbiAgICogUmVxdWlyZWQ6IFllc1xuICAgKi9cbiAgcmVhZG9ubHkgcHJvdmlkZXJBcm46IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIEFSTiBvZiB0aGUgU2VjcmV0cyBNYW5hZ2VyIHNlY3JldCBjb250YWluaW5nIE9BdXRoIGNyZWRlbnRpYWxzIChjbGllbnQgSUQgYW5kIHNlY3JldCkuXG4gICAqIFRoaXMgaXMgcmV0dXJuZWQgd2hlbiBjcmVhdGluZyB0aGUgT0F1dGggY3JlZGVudGlhbCBwcm92aWRlciB2aWEgQ29uc29sZSBvciBBUEkuXG4gICAqIEZvcm1hdDogYXJuOmF3czpzZWNyZXRzbWFuYWdlcjpyZWdpb246YWNjb3VudDpzZWNyZXQ6bmFtZVxuICAgKiBSZXF1aXJlZDogWWVzXG4gICAqL1xuICByZWFkb25seSBzZWNyZXRBcm46IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIE9BdXRoIHNjb3BlcyBmb3IgdGhlIGNyZWRlbnRpYWwgcHJvdmlkZXIuXG4gICAqIFRoZXNlIHNjb3BlcyBkZWZpbmUgdGhlIGxldmVsIG9mIGFjY2VzcyByZXF1ZXN0ZWQgZnJvbSB0aGUgT0F1dGggcHJvdmlkZXIuXG4gICAqXG4gICAqIEFycmF5IE1lbWJlcnM6IE1pbmltdW0gbnVtYmVyIG9mIDAgaXRlbXMuIE1heGltdW0gbnVtYmVyIG9mIDEwMCBpdGVtcy5cbiAgICogTGVuZ3RoIENvbnN0cmFpbnRzOiBNaW5pbXVtIGxlbmd0aCBvZiAxLiBNYXhpbXVtIGxlbmd0aCBvZiA2NC5cbiAgICogUmVxdWlyZWQ6IFllc1xuICAgKi9cbiAgcmVhZG9ubHkgc2NvcGVzOiBzdHJpbmdbXTtcblxuICAvKipcbiAgICogVGhlIGN1c3RvbSBwYXJhbWV0ZXJzIGZvciB0aGUgT0F1dGggY3JlZGVudGlhbCBwcm92aWRlci5cbiAgICogVGhlc2UgcGFyYW1ldGVycyBwcm92aWRlIGFkZGl0aW9uYWwgY29uZmlndXJhdGlvbiBmb3IgdGhlIE9BdXRoIGF1dGhlbnRpY2F0aW9uIHByb2Nlc3MuXG4gICAqXG4gICAqIE1hcCBFbnRyaWVzOiBNYXhpbXVtIG51bWJlciBvZiAxMCBpdGVtcy5cbiAgICogS2V5IExlbmd0aCBDb25zdHJhaW50czogTWluaW11bSBsZW5ndGggb2YgMS4gTWF4aW11bSBsZW5ndGggb2YgMjU2LlxuICAgKiBWYWx1ZSBMZW5ndGggQ29uc3RyYWludHM6IE1pbmltdW0gbGVuZ3RoIG9mIDEuIE1heGltdW0gbGVuZ3RoIG9mIDIwNDguXG4gICAqIFJlcXVpcmVkOiBOb1xuICAgKi9cbiAgLyoqXG4gICAqIEN1c3RvbSBwYXJhbWV0ZXJzIGZvciB0aGUgT0F1dGggZmxvd1xuICAgKiBAZGVmYXVsdCAtIE5vIGN1c3RvbSBwYXJhbWV0ZXJzXG4gICAqL1xuICByZWFkb25seSBjdXN0b21QYXJhbWV0ZXJzPzogUmVjb3JkPHN0cmluZywgc3RyaW5nPjtcbn1cblxuLyoqXG4gKiBPQXV0aCBjcmVkZW50aWFsIHByb3ZpZGVyIGNvbmZpZ3VyYXRpb24gaW1wbGVtZW50YXRpb25cbiAqIENhbiBiZSB1c2VkIHdpdGggT3BlbkFQSSB0YXJnZXRzXG4gKiBAaW50ZXJuYWxcbiAqL1xuZXhwb3J0IGNsYXNzIE9BdXRoQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvbiBpbXBsZW1lbnRzIElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcge1xuICBwdWJsaWMgcmVhZG9ubHkgY3JlZGVudGlhbFByb3ZpZGVyVHlwZSA9IENyZWRlbnRpYWxQcm92aWRlclR5cGUuT0FVVEg7XG4gIC8qKlxuICAgKiBUaGUgQVJOIG9mIHRoZSBPQXV0aCBwcm92aWRlclxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IHByb3ZpZGVyQXJuOiBzdHJpbmc7XG4gIC8qKlxuICAgKiBUaGUgQVJOIG9mIHRoZSBTZWNyZXRzIE1hbmFnZXIgc2VjcmV0XG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgc2VjcmV0QXJuOiBzdHJpbmc7XG4gIC8qKlxuICAgKiBUaGUgT0F1dGggc2NvcGVzIHRvIHJlcXVlc3RcbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBzY29wZXM6IHN0cmluZ1tdO1xuICAvKipcbiAgICogQ3VzdG9tIHBhcmFtZXRlcnMgZm9yIHRoZSBPQXV0aCBmbG93XG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgY3VzdG9tUGFyYW1ldGVycz86IFJlY29yZDxzdHJpbmcsIHN0cmluZz47XG5cbiAgY29uc3RydWN0b3IoY29uZmlndXJhdGlvbjogT0F1dGhDb25maWd1cmF0aW9uKSB7XG4gICAgdGhpcy5wcm92aWRlckFybiA9IGNvbmZpZ3VyYXRpb24ucHJvdmlkZXJBcm47XG4gICAgdGhpcy5zZWNyZXRBcm4gPSBjb25maWd1cmF0aW9uLnNlY3JldEFybjtcbiAgICB0aGlzLnNjb3BlcyA9IGNvbmZpZ3VyYXRpb24uc2NvcGVzO1xuICAgIHRoaXMuY3VzdG9tUGFyYW1ldGVycyA9IGNvbmZpZ3VyYXRpb24uY3VzdG9tUGFyYW1ldGVycztcbiAgfVxuXG4gIC8qKlxuICAgKiBHcmFudCB0aGUgbmVlZGVkIHBlcm1pc3Npb25zIHRvIHRoZSByb2xlIGZvciBPQXV0aCBhdXRoZW50aWNhdGlvblxuICAgKi9cbiAgZ3JhbnROZWVkZWRQZXJtaXNzaW9uc1RvUm9sZShyb2xlOiBJUm9sZSk6IEdyYW50IHwgdW5kZWZpbmVkIHtcbiAgICBjb25zdCBzdGF0ZW1lbnRzID0gW1xuICAgICAgbmV3IFBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgIGFjdGlvbnM6IFtcbiAgICAgICAgICAuLi5HYXRld2F5UGVybXMuR0FURVdBWV9PQVVUSF9QRVJNUyxcbiAgICAgICAgICAuLi5HYXRld2F5UGVybXMuR0FURVdBWV9XT1JLTE9BRF9JREVOVElUWV9QRVJNUyxcbiAgICAgICAgXSxcbiAgICAgICAgcmVzb3VyY2VzOiBbdGhpcy5wcm92aWRlckFybl0sXG4gICAgICB9KSxcbiAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBhY3Rpb25zOiBHYXRld2F5UGVybXMuU0VDUkVUU19QRVJNUyxcbiAgICAgICAgcmVzb3VyY2VzOiBbdGhpcy5zZWNyZXRBcm5dLFxuICAgICAgfSksXG4gICAgXTtcblxuICAgIHJldHVybiBHcmFudC5hZGRUb1ByaW5jaXBhbCh7XG4gICAgICBncmFudGVlOiByb2xlLFxuICAgICAgYWN0aW9uczogc3RhdGVtZW50cy5mbGF0TWFwKHMgPT4gcy5hY3Rpb25zKSxcbiAgICAgIHJlc291cmNlQXJuczogc3RhdGVtZW50cy5mbGF0TWFwKHMgPT4gcy5yZXNvdXJjZXMpLFxuICAgIH0pO1xuICB9XG5cbiAgLyoqXG4gICAqIEBpbnRlcm5hbFxuICAgKi9cbiAgX3JlbmRlcigpOiBhbnkge1xuICAgIHJldHVybiB7XG4gICAgICBjcmVkZW50aWFsUHJvdmlkZXJUeXBlOiB0aGlzLmNyZWRlbnRpYWxQcm92aWRlclR5cGUsXG4gICAgICBjcmVkZW50aWFsUHJvdmlkZXI6IHtcbiAgICAgICAgb2F1dGhDcmVkZW50aWFsUHJvdmlkZXI6IHtcbiAgICAgICAgICBwcm92aWRlckFybjogdGhpcy5wcm92aWRlckFybixcbiAgICAgICAgICBzY29wZXM6IHRoaXMuc2NvcGVzLFxuICAgICAgICAgIGN1c3RvbVBhcmFtZXRlcnM6IHRoaXMuY3VzdG9tUGFyYW1ldGVycyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgfTtcbiAgfVxufVxuIl19

package/agentcore/gateway/perms.d.ts

@@ -0,0 +1,75 @@
+export declare namespace GatewayPerms {
+    /******************************************************************************
+     * Data Plane Permissions
+     *****************************************************************************/
+    /**
+     * Permissions to invoke the gateway
+     * Used by agents or other services that need to call the gateway
+     */
+    const INVOKE_PERMS: string[];
+    /******************************************************************************
+     * Execution Role Permissions
+     *****************************************************************************/
+    /**
+     * KMS permissions for encryption
+     * Required when using KMS keys for encryption
+     */
+    const KMS_KEY_PERMS: string[];
+    /**
+     * Assume role permission
+     * Required for the gateway service to assume the execution role
+     */
+    const ASSUME_ROLE: string[];
+    /**
+     * Outbound auth - Workload identity permissions
+     * Used to obtain access tokens for workload identity
+     */
+    const GATEWAY_WORKLOAD_IDENTITY_PERMS: string[];
+    /**
+     * Outbound auth - OAuth permissions
+     * Used to obtain OAuth tokens for target authentication
+     */
+    const GATEWAY_OAUTH_PERMS: string[];
+    /**
+     * Outbound auth - API Key permissions
+     * Used to retrieve API keys for target authentication
+     */
+    const GATEWAY_API_KEY_PERMS: string[];
+    /**
+     * Secrets Manager permissions
+     * Required for storing and retrieving API keys and OAuth credentials
+     */
+    const SECRETS_PERMS: string[];
+    /******************************************************************************
+     * Control Plane Permissions
+     *****************************************************************************/
+    /**
+     * Get permissions for gateway resources
+     */
+    const GET_PERMS: string[];
+    /**
+     * List permissions for gateway resources
+     */
+    const LIST_PERMS: string[];
+    /**
+     * Create permissions for gateway resources
+     */
+    const CREATE_PERMS: string[];
+    /**
+     * Update permissions for gateway resources
+     */
+    const UPDATE_PERMS: string[];
+    /**
+     * Delete permissions for gateway resources
+     */
+    const DELETE_PERMS: string[];
+    /**
+     * Combined manage permissions (create, update, delete)
+     */
+    const MANAGE_PERMS: string[];
+    /**
+     * Synchronization permissions for MCP server targets
+     * Used to refresh tool catalogs when MCP server tools change
+     */
+    const SYNC_PERMS: string[];
+}

package/agentcore/gateway/perms.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GatewayPerms = void 0;
+var GatewayPerms;
+(function (GatewayPerms) {
+    /******************************************************************************
+     * Data Plane Permissions
+     *****************************************************************************/
+    /**
+     * Permissions to invoke the gateway
+     * Used by agents or other services that need to call the gateway
+     */
+    GatewayPerms.INVOKE_PERMS = ['bedrock-agentcore:InvokeGateway'];
+    /******************************************************************************
+     * Execution Role Permissions
+     *****************************************************************************/
+    /**
+     * KMS permissions for encryption
+     * Required when using KMS keys for encryption
+     */
+    GatewayPerms.KMS_KEY_PERMS = [
+        'kms:GenerateDataKey',
+        'kms:GenerateDataKeyWithoutPlaintext',
+        'kms:GenerateDataKeyPair',
+        'kms:GenerateDataKeyPairWithoutPlaintext',
+        'kms:Decrypt',
+        'kms:Encrypt',
+        'kms:ReEncryptFrom',
+        'kms:ReEncryptTo',
+        'kms:CreateGrant',
+        'kms:DescribeKey',
+    ];
+    /**
+     * Assume role permission
+     * Required for the gateway service to assume the execution role
+     */
+    GatewayPerms.ASSUME_ROLE = ['sts:AssumeRole'];
+    /**
+     * Outbound auth - Workload identity permissions
+     * Used to obtain access tokens for workload identity
+     */
+    GatewayPerms.GATEWAY_WORKLOAD_IDENTITY_PERMS = [
+        'bedrock-agentcore:GetWorkloadAccessToken',
+    ];
+    /**
+     * Outbound auth - OAuth permissions
+     * Used to obtain OAuth tokens for target authentication
+     */
+    GatewayPerms.GATEWAY_OAUTH_PERMS = [
+        'bedrock-agentcore:GetResourceOauth2Token',
+    ];
+    /**
+     * Outbound auth - API Key permissions
+     * Used to retrieve API keys for target authentication
+     */
+    GatewayPerms.GATEWAY_API_KEY_PERMS = [
+        'bedrock-agentcore:GetResourceApiKey',
+    ];
+    /**
+     * Secrets Manager permissions
+     * Required for storing and retrieving API keys and OAuth credentials
+     */
+    GatewayPerms.SECRETS_PERMS = [
+        'secretsmanager:GetSecretValue',
+        'secretsmanager:DescribeSecret',
+    ];
+    /******************************************************************************
+     * Control Plane Permissions
+     *****************************************************************************/
+    /**
+     * Get permissions for gateway resources
+     */
+    GatewayPerms.GET_PERMS = ['bedrock-agentcore:GetGatewayTarget', 'bedrock-agentcore:GetGateway'];
+    /**
+     * List permissions for gateway resources
+     */
+    GatewayPerms.LIST_PERMS = [
+        'bedrock-agentcore:ListGateways',
+        'bedrock-agentcore:ListGatewayTargets',
+    ];
+    /**
+     * Create permissions for gateway resources
+     */
+    GatewayPerms.CREATE_PERMS = [
+        'bedrock-agentcore:CreateGateway',
+        'bedrock-agentcore:CreateGatewayTarget',
+    ];
+    /**
+     * Update permissions for gateway resources
+     */
+    GatewayPerms.UPDATE_PERMS = [
+        'bedrock-agentcore:UpdateGateway',
+        'bedrock-agentcore:UpdateGatewayTarget',
+    ];
+    /**
+     * Delete permissions for gateway resources
+     */
+    GatewayPerms.DELETE_PERMS = [
+        'bedrock-agentcore:DeleteGateway',
+        'bedrock-agentcore:DeleteGatewayTarget',
+    ];
+    /**
+     * Combined manage permissions (create, update, delete)
+     */
+    GatewayPerms.MANAGE_PERMS = [...new Set([...GatewayPerms.CREATE_PERMS, ...GatewayPerms.UPDATE_PERMS, ...GatewayPerms.DELETE_PERMS])];
+    /**
+     * Synchronization permissions for MCP server targets
+     * Used to refresh tool catalogs when MCP server tools change
+     */
+    GatewayPerms.SYNC_PERMS = ['bedrock-agentcore:SynchronizeGatewayTargets'];
+})(GatewayPerms || (exports.GatewayPerms = GatewayPerms = {}));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJwZXJtcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxJQUFpQixZQUFZLENBMkg1QjtBQTNIRCxXQUFpQixZQUFZO0lBRTNCOzttRkFFK0U7SUFFL0U7OztPQUdHO0lBQ1UseUJBQVksR0FBRyxDQUFDLGlDQUFpQyxDQUFDLENBQUM7SUFFaEU7O21GQUUrRTtJQUUvRTs7O09BR0c7SUFDVSwwQkFBYSxHQUFHO1FBQzNCLHFCQUFxQjtRQUNyQixxQ0FBcUM7UUFDckMseUJBQXlCO1FBQ3pCLHlDQUF5QztRQUN6QyxhQUFhO1FBQ2IsYUFBYTtRQUNiLG1CQUFtQjtRQUNuQixpQkFBaUI7UUFDakIsaUJBQWlCO1FBQ2pCLGlCQUFpQjtLQUNsQixDQUFDO0lBRUY7OztPQUdHO0lBQ1Usd0JBQVcsR0FBRyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFFOUM7OztPQUdHO0lBQ1UsNENBQStCLEdBQUc7UUFDN0MsMENBQTBDO0tBQzNDLENBQUM7SUFFRjs7O09BR0c7SUFDVSxnQ0FBbUIsR0FBRztRQUNqQywwQ0FBMEM7S0FDM0MsQ0FBQztJQUVGOzs7T0FHRztJQUNVLGtDQUFxQixHQUFHO1FBQ25DLHFDQUFxQztLQUN0QyxDQUFDO0lBRUY7OztPQUdHO0lBQ1UsMEJBQWEsR0FBRztRQUMzQiwrQkFBK0I7UUFDL0IsK0JBQStCO0tBQ2hDLENBQUM7SUFFRjs7bUZBRStFO0lBRS9FOztPQUVHO0lBQ1Usc0JBQVMsR0FBRyxDQUFDLG9DQUFvQyxFQUFFLDhCQUE4QixDQUFDLENBQUM7SUFFaEc7O09BRUc7SUFDVSx1QkFBVSxHQUFHO1FBQ3hCLGdDQUFnQztRQUNoQyxzQ0FBc0M7S0FDdkMsQ0FBQztJQUVGOztPQUVHO0lBQ1UseUJBQVksR0FBRztRQUMxQixpQ0FBaUM7UUFDakMsdUNBQXVDO0tBQ3hDLENBQUM7SUFFRjs7T0FFRztJQUNVLHlCQUFZLEdBQUc7UUFDMUIsaUNBQWlDO1FBQ2pDLHVDQUF1QztLQUN4QyxDQUFDO0lBRUY7O09BRUc7SUFDVSx5QkFBWSxHQUFHO1FBQzFCLGlDQUFpQztRQUNqQyx1Q0FBdUM7S0FDeEMsQ0FBQztJQUVGOztPQUVHO0lBQ1UseUJBQVksR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxHQUFHLGFBQUEsWUFBWSxFQUFFLEdBQUcsYUFBQSxZQUFZLEVBQUUsR0FBRyxhQUFBLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUU5Rjs7O09BR0c7SUFDVSx1QkFBVSxHQUFHLENBQUMsNkNBQTZDLENBQUMsQ0FBQztBQUM1RSxDQUFDLEVBM0hnQixZQUFZLDRCQUFaLFlBQVksUUEySDVCIiwic291cmNlc0NvbnRlbnQiOlsiZXhwb3J0IG5hbWVzcGFjZSBHYXRld2F5UGVybXMge1xuXG4gIC8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiAgICogRGF0YSBQbGFuZSBQZXJtaXNzaW9uc1xuICAgKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbiAgLyoqXG4gICAqIFBlcm1pc3Npb25zIHRvIGludm9rZSB0aGUgZ2F0ZXdheVxuICAgKiBVc2VkIGJ5IGFnZW50cyBvciBvdGhlciBzZXJ2aWNlcyB0aGF0IG5lZWQgdG8gY2FsbCB0aGUgZ2F0ZXdheVxuICAgKi9cbiAgZXhwb3J0IGNvbnN0IElOVk9LRV9QRVJNUyA9IFsnYmVkcm9jay1hZ2VudGNvcmU6SW52b2tlR2F0ZXdheSddO1xuXG4gIC8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiAgICogRXhlY3V0aW9uIFJvbGUgUGVybWlzc2lvbnNcbiAgICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqL1xuXG4gIC8qKlxuICAgKiBLTVMgcGVybWlzc2lvbnMgZm9yIGVuY3J5cHRpb25cbiAgICogUmVxdWlyZWQgd2hlbiB1c2luZyBLTVMga2V5cyBmb3IgZW5jcnlwdGlvblxuICAgKi9cbiAgZXhwb3J0IGNvbnN0IEtNU19LRVlfUEVSTVMgPSBbXG4gICAgJ2ttczpHZW5lcmF0ZURhdGFLZXknLFxuICAgICdrbXM6R2VuZXJhdGVEYXRhS2V5V2l0aG91dFBsYWludGV4dCcsXG4gICAgJ2ttczpHZW5lcmF0ZURhdGFLZXlQYWlyJyxcbiAgICAna21zOkdlbmVyYXRlRGF0YUtleVBhaXJXaXRob3V0UGxhaW50ZXh0JyxcbiAgICAna21zOkRlY3J5cHQnLFxuICAgICdrbXM6RW5jcnlwdCcsXG4gICAgJ2ttczpSZUVuY3J5cHRGcm9tJyxcbiAgICAna21zOlJlRW5jcnlwdFRvJyxcbiAgICAna21zOkNyZWF0ZUdyYW50JyxcbiAgICAna21zOkRlc2NyaWJlS2V5JyxcbiAgXTtcblxuICAvKipcbiAgICogQXNzdW1lIHJvbGUgcGVybWlzc2lvblxuICAgKiBSZXF1aXJlZCBmb3IgdGhlIGdhdGV3YXkgc2VydmljZSB0byBhc3N1bWUgdGhlIGV4ZWN1dGlvbiByb2xlXG4gICAqL1xuICBleHBvcnQgY29uc3QgQVNTVU1FX1JPTEUgPSBbJ3N0czpBc3N1bWVSb2xlJ107XG5cbiAgLyoqXG4gICAqIE91dGJvdW5kIGF1dGggLSBXb3JrbG9hZCBpZGVudGl0eSBwZXJtaXNzaW9uc1xuICAgKiBVc2VkIHRvIG9idGFpbiBhY2Nlc3MgdG9rZW5zIGZvciB3b3JrbG9hZCBpZGVudGl0eVxuICAgKi9cbiAgZXhwb3J0IGNvbnN0IEdBVEVXQVlfV09SS0xPQURfSURFTlRJVFlfUEVSTVMgPSBbXG4gICAgJ2JlZHJvY2stYWdlbnRjb3JlOkdldFdvcmtsb2FkQWNjZXNzVG9rZW4nLFxuICBdO1xuXG4gIC8qKlxuICAgKiBPdXRib3VuZCBhdXRoIC0gT0F1dGggcGVybWlzc2lvbnNcbiAgICogVXNlZCB0byBvYnRhaW4gT0F1dGggdG9rZW5zIGZvciB0YXJnZXQgYXV0aGVudGljYXRpb25cbiAgICovXG4gIGV4cG9ydCBjb25zdCBHQVRFV0FZX09BVVRIX1BFUk1TID0gW1xuICAgICdiZWRyb2NrLWFnZW50Y29yZTpHZXRSZXNvdXJjZU9hdXRoMlRva2VuJyxcbiAgXTtcblxuICAvKipcbiAgICogT3V0Ym91bmQgYXV0aCAtIEFQSSBLZXkgcGVybWlzc2lvbnNcbiAgICogVXNlZCB0byByZXRyaWV2ZSBBUEkga2V5cyBmb3IgdGFyZ2V0IGF1dGhlbnRpY2F0aW9uXG4gICAqL1xuICBleHBvcnQgY29uc3QgR0FURVdBWV9BUElfS0VZX1BFUk1TID0gW1xuICAgICdiZWRyb2NrLWFnZW50Y29yZTpHZXRSZXNvdXJjZUFwaUtleScsXG4gIF07XG5cbiAgLyoqXG4gICAqIFNlY3JldHMgTWFuYWdlciBwZXJtaXNzaW9uc1xuICAgKiBSZXF1aXJlZCBmb3Igc3RvcmluZyBhbmQgcmV0cmlldmluZyBBUEkga2V5cyBhbmQgT0F1dGggY3JlZGVudGlhbHNcbiAgICovXG4gIGV4cG9ydCBjb25zdCBTRUNSRVRTX1BFUk1TID0gW1xuICAgICdzZWNyZXRzbWFuYWdlcjpHZXRTZWNyZXRWYWx1ZScsXG4gICAgJ3NlY3JldHNtYW5hZ2VyOkRlc2NyaWJlU2VjcmV0JyxcbiAgXTtcblxuICAvKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gICAqIENvbnRyb2wgUGxhbmUgUGVybWlzc2lvbnNcbiAgICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqL1xuXG4gIC8qKlxuICAgKiBHZXQgcGVybWlzc2lvbnMgZm9yIGdhdGV3YXkgcmVzb3VyY2VzXG4gICAqL1xuICBleHBvcnQgY29uc3QgR0VUX1BFUk1TID0gWydiZWRyb2NrLWFnZW50Y29yZTpHZXRHYXRld2F5VGFyZ2V0JywgJ2JlZHJvY2stYWdlbnRjb3JlOkdldEdhdGV3YXknXTtcblxuICAvKipcbiAgICogTGlzdCBwZXJtaXNzaW9ucyBmb3IgZ2F0ZXdheSByZXNvdXJjZXNcbiAgICovXG4gIGV4cG9ydCBjb25zdCBMSVNUX1BFUk1TID0gW1xuICAgICdiZWRyb2NrLWFnZW50Y29yZTpMaXN0R2F0ZXdheXMnLFxuICAgICdiZWRyb2NrLWFnZW50Y29yZTpMaXN0R2F0ZXdheVRhcmdldHMnLFxuICBdO1xuXG4gIC8qKlxuICAgKiBDcmVhdGUgcGVybWlzc2lvbnMgZm9yIGdhdGV3YXkgcmVzb3VyY2VzXG4gICAqL1xuICBleHBvcnQgY29uc3QgQ1JFQVRFX1BFUk1TID0gW1xuICAgICdiZWRyb2NrLWFnZW50Y29yZTpDcmVhdGVHYXRld2F5JyxcbiAgICAnYmVkcm9jay1hZ2VudGNvcmU6Q3JlYXRlR2F0ZXdheVRhcmdldCcsXG4gIF07XG5cbiAgLyoqXG4gICAqIFVwZGF0ZSBwZXJtaXNzaW9ucyBmb3IgZ2F0ZXdheSByZXNvdXJjZXNcbiAgICovXG4gIGV4cG9ydCBjb25zdCBVUERBVEVfUEVSTVMgPSBbXG4gICAgJ2JlZHJvY2stYWdlbnRjb3JlOlVwZGF0ZUdhdGV3YXknLFxuICAgICdiZWRyb2NrLWFnZW50Y29yZTpVcGRhdGVHYXRld2F5VGFyZ2V0JyxcbiAgXTtcblxuICAvKipcbiAgICogRGVsZXRlIHBlcm1pc3Npb25zIGZvciBnYXRld2F5IHJlc291cmNlc1xuICAgKi9cbiAgZXhwb3J0IGNvbnN0IERFTEVURV9QRVJNUyA9IFtcbiAgICAnYmVkcm9jay1hZ2VudGNvcmU6RGVsZXRlR2F0ZXdheScsXG4gICAgJ2JlZHJvY2stYWdlbnRjb3JlOkRlbGV0ZUdhdGV3YXlUYXJnZXQnLFxuICBdO1xuXG4gIC8qKlxuICAgKiBDb21iaW5lZCBtYW5hZ2UgcGVybWlzc2lvbnMgKGNyZWF0ZSwgdXBkYXRlLCBkZWxldGUpXG4gICAqL1xuICBleHBvcnQgY29uc3QgTUFOQUdFX1BFUk1TID0gWy4uLm5ldyBTZXQoWy4uLkNSRUFURV9QRVJNUywgLi4uVVBEQVRFX1BFUk1TLCAuLi5ERUxFVEVfUEVSTVNdKV07XG5cbiAgLyoqXG4gICAqIFN5bmNocm9uaXphdGlvbiBwZXJtaXNzaW9ucyBmb3IgTUNQIHNlcnZlciB0YXJnZXRzXG4gICAqIFVzZWQgdG8gcmVmcmVzaCB0b29sIGNhdGFsb2dzIHdoZW4gTUNQIHNlcnZlciB0b29scyBjaGFuZ2VcbiAgICovXG4gIGV4cG9ydCBjb25zdCBTWU5DX1BFUk1TID0gWydiZWRyb2NrLWFnZW50Y29yZTpTeW5jaHJvbml6ZUdhdGV3YXlUYXJnZXRzJ107XG59XG4iXX0=

package/agentcore/gateway/protocol.d.ts

@@ -0,0 +1,121 @@
+import { CfnGateway } from 'aws-cdk-lib/aws-bedrockagentcore';
+/******************************************************************************
+ *                                 Enums
+ *****************************************************************************/
+/**
+ * The type of protocols
+ * @internal
+ */
+export declare enum GatewayProtocolType {
+    /**
+     * MCP (Model Context Protocol) protocol type.
+     */
+    MCP = "MCP"
+}
+/******************************************************************************
+ *                                Protocol Configuration
+ *****************************************************************************/
+/**
+ * Abstract interface for gateway protocol configuration
+ */
+export interface IGatewayProtocolConfig {
+    /**
+     * The protocol type
+     */
+    readonly protocolType: string;
+    /**
+     * Returns internal info as the CFN protocol configuration object
+     * @internal
+     */
+    _render(): any;
+}
+/**
+ * Factory class for instantiating Gateway Protocols
+ */
+export declare abstract class GatewayProtocol {
+    /**
+     * Create an MCP protocol configuration
+     * @param props - Optional MCP configuration properties
+     * @returns IGatewayProtocolConfig configured for MCP
+     */
+    static mcp(props?: McpConfiguration): IGatewayProtocolConfig;
+}
+/******************************************************************************
+ *                          MCP Protocol Configuration
+ *****************************************************************************/
+/**
+ * MCP protocol versions.
+ * The Model Context Protocol uses string-based version identifiers following the format YYYY-MM-DD,
+ * to indicate the last date backwards incompatible changes were made.
+ * Versions are available at https://github.com/modelcontextprotocol/modelcontextprotocol/releases
+ */
+export declare enum MCPProtocolVersion {
+    /**
+     * The latest version of the MCP protocol.
+     */
+    MCP_2025_06_18 = "2025-06-18",
+    /** MCP version 2025-03-26 */
+    MCP_2025_03_26 = "2025-03-26"
+}
+/**
+ * Search types supported by MCP gateway
+ */
+export declare enum McpGatewaySearchType {
+    /**
+     * Semantic search type.
+     * When semantic search is enabled, your gateway can search the tools via
+     * the gateway SDK based off of a natural language phrase.
+     */
+    SEMANTIC = "SEMANTIC"
+}
+/**
+ * MCP protocol configuration
+ * The configuration for the Model Context Protocol (MCP).
+ * This protocol enables communication between Amazon Bedrock Agent and external tools.
+ */
+export interface McpConfiguration {
+    /**
+     * The instructions for using the Model Context Protocol gateway.
+     * These instructions provide guidance on how to interact with the gateway.
+     *
+     * @default - No instructions provided
+     */
+    readonly instructions?: string;
+    /**
+     * The search type for the Model Context Protocol gateway.
+     * This field specifies how the gateway handles search operations.
+     *
+     * @default - No search type specified
+     */
+    readonly searchType?: McpGatewaySearchType;
+    /**
+     * The supported versions of the Model Context Protocol.
+     * This field specifies which versions of the protocol the gateway can use.
+     *
+     * @default - No specific versions specified
+     */
+    readonly supportedVersions?: MCPProtocolVersion[];
+}
+/**
+ * MCP (Model Context Protocol) configuration implementation
+ */
+export declare class McpProtocolConfiguration implements IGatewayProtocolConfig {
+    readonly protocolType: string;
+    /**
+     * The supported MCP protocol versions
+     */
+    readonly supportedVersions?: MCPProtocolVersion[];
+    /**
+     * The search type for the MCP gateway
+     */
+    readonly searchType?: string;
+    /**
+     * Instructions for using the MCP gateway
+     */
+    readonly instructions?: string;
+    constructor(props?: McpConfiguration);
+    /**
+     * @internal
+     */
+    _render(): CfnGateway.GatewayProtocolConfigurationProperty;
+}