@aws-cdk/aws-bedrock-agentcore-alpha 2.226.0-alpha.0 → 2.227.0-alpha.0

package/agentcore/gateway/inbound-auth/authorizer.d.ts

@@ -0,0 +1,121 @@
+import { IUserPoolClient, IUserPool } from 'aws-cdk-lib/aws-cognito';
+/******************************************************************************
+ *                                Authorizer Configuration
+ *****************************************************************************/
+/**
+ * Gateway authorizer type
+ */
+export declare enum GatewayAuthorizerType {
+    /** Custom JWT authorizer type */
+    CUSTOM_JWT = "CUSTOM_JWT",
+    /** AWS IAM authorizer type */
+    AWS_IAM = "AWS_IAM"
+}
+/**
+ * Abstract interface for gateway authorizer configuration
+ */
+export interface IGatewayAuthorizerConfig {
+    /**
+     * The authorizer type
+     */
+    readonly authorizerType: GatewayAuthorizerType;
+    /**
+     * The authorizer configuration in CFN format
+     * @internal
+     */
+    _render(): any;
+}
+/******************************************************************************
+ *                                  Custom JWT
+ *****************************************************************************/
+/**
+ * Custom JWT authorizer configuration
+ */
+export interface CustomJwtConfiguration {
+    /**
+     * This URL is used to fetch OpenID Connect configuration or authorization server metadata
+     * for validating incoming tokens.
+     *
+     * Pattern: .+/\.well-known/openid-configuration
+     * Required: Yes
+     */
+    readonly discoveryUrl: string;
+    /**
+     * Represents individual audience values that are validated in the incoming JWT token validation process.
+     * @default - No audience validation
+     */
+    readonly allowedAudience?: string[];
+    /**
+     * Represents individual client IDs that are validated in the incoming JWT token validation process.
+     * @default - No client ID validation
+     */
+    readonly allowedClients?: string[];
+}
+/**
+ * Custom JWT authorizer configuration implementation
+ */
+export declare class CustomJwtAuthorizer implements IGatewayAuthorizerConfig {
+    readonly authorizerType = GatewayAuthorizerType.CUSTOM_JWT;
+    private readonly discoveryUrl;
+    private readonly allowedAudience?;
+    private readonly allowedClients?;
+    constructor(config: CustomJwtConfiguration);
+    /**
+     * @internal
+     */
+    _render(): any;
+}
+/******************************************************************************
+ *                               AWS IAM
+ *****************************************************************************/
+/**
+ * AWS IAM authorizer configuration implementation
+ *
+ */
+export declare class IamAuthorizer implements IGatewayAuthorizerConfig {
+    readonly authorizerType = GatewayAuthorizerType.AWS_IAM;
+    /**
+     * @internal
+     */
+    _render(): any;
+}
+/******************************************************************************
+ *                               Factory
+ *****************************************************************************/
+export interface CognitoAuthorizerProps {
+    /**
+     * The Cognito User Pool to use for authentication
+     */
+    readonly userPool: IUserPool;
+    /**
+     * The allowed User Pool clients
+     * @default - All clients are allowed
+     */
+    readonly allowedClients?: IUserPoolClient[];
+    /**
+     * The allowed audiences for JWT validation
+     * @default - No audience validation
+     */
+    readonly allowedAudiences?: string[];
+}
+/**
+ * Factory class for creating Gateway Authorizers
+ */
+export declare abstract class GatewayAuthorizer {
+    /**
+     * AWS IAM authorizer instance
+     */
+    static usingAwsIam(): IGatewayAuthorizerConfig;
+    /**
+     * Create a custom JWT authorizer
+     * @param configuration - The JWT configuration
+     * @returns IGatewayAuthorizerConfig configured for custom JWT
+     */
+    static usingCustomJwt(configuration: CustomJwtConfiguration): IGatewayAuthorizerConfig;
+    /**
+     * Create a JWT authorizer from Cognito User Pool
+     * @param props - The Cognito configuration
+     * @returns CustomJwtAuthorizer configured for Cognito
+     */
+    static usingCognito(props: CognitoAuthorizerProps): IGatewayAuthorizerConfig;
+}

package/agentcore/gateway/inbound-auth/authorizer.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GatewayAuthorizer = exports.IamAuthorizer = exports.CustomJwtAuthorizer = exports.GatewayAuthorizerType = void 0;
+const jsiiDeprecationWarnings = require("../../../.warnings.jsii.js");
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const validation_helpers_1 = require("../validation-helpers");
+/******************************************************************************
+ *                                Authorizer Configuration
+ *****************************************************************************/
+/**
+ * Gateway authorizer type
+ */
+var GatewayAuthorizerType;
+(function (GatewayAuthorizerType) {
+    /** Custom JWT authorizer type */
+    GatewayAuthorizerType["CUSTOM_JWT"] = "CUSTOM_JWT";
+    /** AWS IAM authorizer type */
+    GatewayAuthorizerType["AWS_IAM"] = "AWS_IAM";
+})(GatewayAuthorizerType || (exports.GatewayAuthorizerType = GatewayAuthorizerType = {}));
+/**
+ * Custom JWT authorizer configuration implementation
+ */
+class CustomJwtAuthorizer {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.CustomJwtAuthorizer", version: "2.227.0-alpha.0" };
+    authorizerType = GatewayAuthorizerType.CUSTOM_JWT;
+    discoveryUrl;
+    allowedAudience;
+    allowedClients;
+    constructor(config) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_CustomJwtConfiguration(config);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, CustomJwtAuthorizer);
+            }
+            throw error;
+        }
+        this.discoveryUrl = config.discoveryUrl;
+        this.allowedAudience = config.allowedAudience;
+        this.allowedClients = config.allowedClients;
+    }
+    /**
+     * @internal
+     */
+    _render() {
+        return {
+            customJwtAuthorizer: {
+                discoveryUrl: this.discoveryUrl,
+                ...(this.allowedAudience && { allowedAudience: this.allowedAudience }),
+                ...(this.allowedClients && { allowedClients: this.allowedClients }),
+            },
+        };
+    }
+}
+exports.CustomJwtAuthorizer = CustomJwtAuthorizer;
+/******************************************************************************
+ *                               AWS IAM
+ *****************************************************************************/
+/**
+ * AWS IAM authorizer configuration implementation
+ *
+ */
+class IamAuthorizer {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.IamAuthorizer", version: "2.227.0-alpha.0" };
+    authorizerType = GatewayAuthorizerType.AWS_IAM;
+    /**
+     * @internal
+     */
+    _render() {
+        // AWS IAM authorizer doesn't need additional configuration
+        // Return null or undefined to indicate no configuration needed
+        return undefined;
+    }
+}
+exports.IamAuthorizer = IamAuthorizer;
+/**
+ * Factory class for creating Gateway Authorizers
+ */
+class GatewayAuthorizer {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayAuthorizer", version: "2.227.0-alpha.0" };
+    /**
+     * AWS IAM authorizer instance
+     */
+    static usingAwsIam() {
+        return new IamAuthorizer();
+    }
+    /**
+     * Create a custom JWT authorizer
+     * @param configuration - The JWT configuration
+     * @returns IGatewayAuthorizerConfig configured for custom JWT
+     */
+    static usingCustomJwt(configuration) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_CustomJwtConfiguration(configuration);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, this.usingCustomJwt);
+            }
+            throw error;
+        }
+        // At least one of allowedAudience or allowedClients must be defined for CUSTOM_JWT authorizer
+        if (!configuration.allowedAudience && !configuration.allowedClients) {
+            throw new validation_helpers_1.ValidationError('At least one of allowedAudience or allowedClients must be defined for CUSTOM_JWT authorizer');
+        }
+        return new CustomJwtAuthorizer(configuration);
+    }
+    /**
+     * Create a JWT authorizer from Cognito User Pool
+     * @param props - The Cognito configuration
+     * @returns CustomJwtAuthorizer configured for Cognito
+     */
+    static usingCognito(props) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_CognitoAuthorizerProps(props);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, this.usingCognito);
+            }
+            throw error;
+        }
+        const discoveryUrl = `https://cognito-idp.${props.userPool.env.region}.amazonaws.com/${props.userPool.userPoolId}/.well-known/openid-configuration`;
+        return new CustomJwtAuthorizer({
+            discoveryUrl: discoveryUrl,
+            allowedClients: props.allowedClients?.flatMap((client) => client.userPoolClientId),
+            allowedAudience: props.allowedAudiences,
+        });
+    }
+}
+exports.GatewayAuthorizer = GatewayAuthorizer;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImF1dGhvcml6ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFDQSw4REFBd0Q7QUFFeEQ7OytFQUUrRTtBQUUvRTs7R0FFRztBQUNILElBQVkscUJBS1g7QUFMRCxXQUFZLHFCQUFxQjtJQUMvQixpQ0FBaUM7SUFDakMsa0RBQXlCLENBQUE7SUFDekIsOEJBQThCO0lBQzlCLDRDQUFtQixDQUFBO0FBQ3JCLENBQUMsRUFMVyxxQkFBcUIscUNBQXJCLHFCQUFxQixRQUtoQztBQStDRDs7R0FFRztBQUNILE1BQWEsbUJBQW1COztJQUNkLGNBQWMsR0FBRyxxQkFBcUIsQ0FBQyxVQUFVLENBQUM7SUFDakQsWUFBWSxDQUFTO0lBQ3JCLGVBQWUsQ0FBWTtJQUMzQixjQUFjLENBQVk7SUFFM0MsWUFBWSxNQUE4Qjs7Ozs7OytDQU4vQixtQkFBbUI7Ozs7UUFPNUIsSUFBSSxDQUFDLFlBQVksR0FBRyxNQUFNLENBQUMsWUFBWSxDQUFDO1FBQ3hDLElBQUksQ0FBQyxlQUFlLEdBQUcsTUFBTSxDQUFDLGVBQWUsQ0FBQztRQUM5QyxJQUFJLENBQUMsY0FBYyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUM7S0FDN0M7SUFFRDs7T0FFRztJQUNJLE9BQU87UUFDWixPQUFPO1lBQ0wsbUJBQW1CLEVBQUU7Z0JBQ25CLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtnQkFDL0IsR0FBRyxDQUFDLElBQUksQ0FBQyxlQUFlLElBQUksRUFBRSxlQUFlLEVBQUUsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO2dCQUN0RSxHQUFHLENBQUMsSUFBSSxDQUFDLGNBQWMsSUFBSSxFQUFFLGNBQWMsRUFBRSxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7YUFDcEU7U0FDRixDQUFDO0tBQ0g7O0FBdkJILGtEQXdCQztBQUVEOzsrRUFFK0U7QUFFL0U7OztHQUdHO0FBQ0gsTUFBYSxhQUFhOztJQUNSLGNBQWMsR0FBRyxxQkFBcUIsQ0FBQyxPQUFPLENBQUM7SUFFL0Q7O09BRUc7SUFDSCxPQUFPO1FBQ0wsMkRBQTJEO1FBQzNELCtEQUErRDtRQUMvRCxPQUFPLFNBQVMsQ0FBQztLQUNsQjs7QUFWSCxzQ0FXQztBQXNCRDs7R0FFRztBQUNILE1BQXNCLGlCQUFpQjs7SUFDckM7O09BRUc7SUFDSSxNQUFNLENBQUMsV0FBVztRQUN2QixPQUFPLElBQUksYUFBYSxFQUFFLENBQUM7S0FDNUI7SUFFRDs7OztPQUlHO0lBQ0ksTUFBTSxDQUFDLGNBQWMsQ0FBQyxhQUFxQzs7Ozs7Ozs7OztRQUNoRSw4RkFBOEY7UUFDOUYsSUFBSSxDQUFDLGFBQWEsQ0FBQyxlQUFlLElBQUksQ0FBQyxhQUFhLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDcEUsTUFBTSxJQUFJLG9DQUFlLENBQUMsNkZBQTZGLENBQUMsQ0FBQztRQUMzSCxDQUFDO1FBQ0QsT0FBTyxJQUFJLG1CQUFtQixDQUFDLGFBQWEsQ0FBQyxDQUFDO0tBQy9DO0lBRUQ7Ozs7T0FJRztJQUNJLE1BQU0sQ0FBQyxZQUFZLENBQUMsS0FBNkI7Ozs7Ozs7Ozs7UUFDdEQsTUFBTSxZQUFZLEdBQUcsdUJBQXVCLEtBQUssQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLE1BQU0sa0JBQWtCLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBVSxtQ0FBbUMsQ0FBQztRQUVwSixPQUFPLElBQUksbUJBQW1CLENBQUM7WUFDN0IsWUFBWSxFQUFFLFlBQVk7WUFDMUIsY0FBYyxFQUFFLEtBQUssQ0FBQyxjQUFjLEVBQUUsT0FBTyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLENBQUM7WUFDbEYsZUFBZSxFQUFFLEtBQUssQ0FBQyxnQkFBZ0I7U0FDeEMsQ0FBQyxDQUFDO0tBQ0o7O0FBbENILDhDQW1DQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IElVc2VyUG9vbENsaWVudCwgSVVzZXJQb29sIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWNvZ25pdG8nO1xuaW1wb3J0IHsgVmFsaWRhdGlvbkVycm9yIH0gZnJvbSAnLi4vdmFsaWRhdGlvbi1oZWxwZXJzJztcblxuLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKlxuICogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEF1dGhvcml6ZXIgQ29uZmlndXJhdGlvblxuICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqL1xuXG4vKipcbiAqIEdhdGV3YXkgYXV0aG9yaXplciB0eXBlXG4gKi9cbmV4cG9ydCBlbnVtIEdhdGV3YXlBdXRob3JpemVyVHlwZSB7XG4gIC8qKiBDdXN0b20gSldUIGF1dGhvcml6ZXIgdHlwZSAqL1xuICBDVVNUT01fSldUID0gJ0NVU1RPTV9KV1QnLFxuICAvKiogQVdTIElBTSBhdXRob3JpemVyIHR5cGUgKi9cbiAgQVdTX0lBTSA9ICdBV1NfSUFNJyxcbn1cblxuLyoqXG4gKiBBYnN0cmFjdCBpbnRlcmZhY2UgZm9yIGdhdGV3YXkgYXV0aG9yaXplciBjb25maWd1cmF0aW9uXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgSUdhdGV3YXlBdXRob3JpemVyQ29uZmlnIHtcbiAgLyoqXG4gICAqIFRoZSBhdXRob3JpemVyIHR5cGVcbiAgICovXG4gIHJlYWRvbmx5IGF1dGhvcml6ZXJUeXBlOiBHYXRld2F5QXV0aG9yaXplclR5cGU7XG5cbiAgLyoqXG4gICAqIFRoZSBhdXRob3JpemVyIGNvbmZpZ3VyYXRpb24gaW4gQ0ZOIGZvcm1hdFxuICAgKiBAaW50ZXJuYWxcbiAgICovXG4gIF9yZW5kZXIoKTogYW55O1xufVxuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDdXN0b20gSldUXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG4vKipcbiAqIEN1c3RvbSBKV1QgYXV0aG9yaXplciBjb25maWd1cmF0aW9uXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQ3VzdG9tSnd0Q29uZmlndXJhdGlvbiB7XG4gIC8qKlxuICAgKiBUaGlzIFVSTCBpcyB1c2VkIHRvIGZldGNoIE9wZW5JRCBDb25uZWN0IGNvbmZpZ3VyYXRpb24gb3IgYXV0aG9yaXphdGlvbiBzZXJ2ZXIgbWV0YWRhdGFcbiAgICogZm9yIHZhbGlkYXRpbmcgaW5jb21pbmcgdG9rZW5zLlxuICAgKlxuICAgKiBQYXR0ZXJuOiAuKy9cXC53ZWxsLWtub3duL29wZW5pZC1jb25maWd1cmF0aW9uXG4gICAqIFJlcXVpcmVkOiBZZXNcbiAgICovXG4gIHJlYWRvbmx5IGRpc2NvdmVyeVVybDogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBSZXByZXNlbnRzIGluZGl2aWR1YWwgYXVkaWVuY2UgdmFsdWVzIHRoYXQgYXJlIHZhbGlkYXRlZCBpbiB0aGUgaW5jb21pbmcgSldUIHRva2VuIHZhbGlkYXRpb24gcHJvY2Vzcy5cbiAgICogQGRlZmF1bHQgLSBObyBhdWRpZW5jZSB2YWxpZGF0aW9uXG4gICAqL1xuICByZWFkb25seSBhbGxvd2VkQXVkaWVuY2U/OiBzdHJpbmdbXTtcblxuICAvKipcbiAgICogUmVwcmVzZW50cyBpbmRpdmlkdWFsIGNsaWVudCBJRHMgdGhhdCBhcmUgdmFsaWRhdGVkIGluIHRoZSBpbmNvbWluZyBKV1QgdG9rZW4gdmFsaWRhdGlvbiBwcm9jZXNzLlxuICAgKiBAZGVmYXVsdCAtIE5vIGNsaWVudCBJRCB2YWxpZGF0aW9uXG4gICAqL1xuICByZWFkb25seSBhbGxvd2VkQ2xpZW50cz86IHN0cmluZ1tdO1xufVxuXG4vKipcbiAqIEN1c3RvbSBKV1QgYXV0aG9yaXplciBjb25maWd1cmF0aW9uIGltcGxlbWVudGF0aW9uXG4gKi9cbmV4cG9ydCBjbGFzcyBDdXN0b21Kd3RBdXRob3JpemVyIGltcGxlbWVudHMgSUdhdGV3YXlBdXRob3JpemVyQ29uZmlnIHtcbiAgcHVibGljIHJlYWRvbmx5IGF1dGhvcml6ZXJUeXBlID0gR2F0ZXdheUF1dGhvcml6ZXJUeXBlLkNVU1RPTV9KV1Q7XG4gIHByaXZhdGUgcmVhZG9ubHkgZGlzY292ZXJ5VXJsOiBzdHJpbmc7XG4gIHByaXZhdGUgcmVhZG9ubHkgYWxsb3dlZEF1ZGllbmNlPzogc3RyaW5nW107XG4gIHByaXZhdGUgcmVhZG9ubHkgYWxsb3dlZENsaWVudHM/OiBzdHJpbmdbXTtcblxuICBjb25zdHJ1Y3Rvcihjb25maWc6IEN1c3RvbUp3dENvbmZpZ3VyYXRpb24pIHtcbiAgICB0aGlzLmRpc2NvdmVyeVVybCA9IGNvbmZpZy5kaXNjb3ZlcnlVcmw7XG4gICAgdGhpcy5hbGxvd2VkQXVkaWVuY2UgPSBjb25maWcuYWxsb3dlZEF1ZGllbmNlO1xuICAgIHRoaXMuYWxsb3dlZENsaWVudHMgPSBjb25maWcuYWxsb3dlZENsaWVudHM7XG4gIH1cblxuICAvKipcbiAgICogQGludGVybmFsXG4gICAqL1xuICBwdWJsaWMgX3JlbmRlcigpOiBhbnkge1xuICAgIHJldHVybiB7XG4gICAgICBjdXN0b21Kd3RBdXRob3JpemVyOiB7XG4gICAgICAgIGRpc2NvdmVyeVVybDogdGhpcy5kaXNjb3ZlcnlVcmwsXG4gICAgICAgIC4uLih0aGlzLmFsbG93ZWRBdWRpZW5jZSAmJiB7IGFsbG93ZWRBdWRpZW5jZTogdGhpcy5hbGxvd2VkQXVkaWVuY2UgfSksXG4gICAgICAgIC4uLih0aGlzLmFsbG93ZWRDbGllbnRzICYmIHsgYWxsb3dlZENsaWVudHM6IHRoaXMuYWxsb3dlZENsaWVudHMgfSksXG4gICAgICB9LFxuICAgIH07XG4gIH1cbn1cblxuLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKlxuICogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQVdTIElBTVxuICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqL1xuXG4vKipcbiAqIEFXUyBJQU0gYXV0aG9yaXplciBjb25maWd1cmF0aW9uIGltcGxlbWVudGF0aW9uXG4gKlxuICovXG5leHBvcnQgY2xhc3MgSWFtQXV0aG9yaXplciBpbXBsZW1lbnRzIElHYXRld2F5QXV0aG9yaXplckNvbmZpZyB7XG4gIHB1YmxpYyByZWFkb25seSBhdXRob3JpemVyVHlwZSA9IEdhdGV3YXlBdXRob3JpemVyVHlwZS5BV1NfSUFNO1xuXG4gIC8qKlxuICAgKiBAaW50ZXJuYWxcbiAgICovXG4gIF9yZW5kZXIoKTogYW55IHtcbiAgICAvLyBBV1MgSUFNIGF1dGhvcml6ZXIgZG9lc24ndCBuZWVkIGFkZGl0aW9uYWwgY29uZmlndXJhdGlvblxuICAgIC8vIFJldHVybiBudWxsIG9yIHVuZGVmaW5lZCB0byBpbmRpY2F0ZSBubyBjb25maWd1cmF0aW9uIG5lZWRlZFxuICAgIHJldHVybiB1bmRlZmluZWQ7XG4gIH1cbn1cblxuLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKlxuICogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRmFjdG9yeVxuICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqL1xuXG5leHBvcnQgaW50ZXJmYWNlIENvZ25pdG9BdXRob3JpemVyUHJvcHMge1xuICAvKipcbiAgICogVGhlIENvZ25pdG8gVXNlciBQb29sIHRvIHVzZSBmb3IgYXV0aGVudGljYXRpb25cbiAgICovXG4gIHJlYWRvbmx5IHVzZXJQb29sOiBJVXNlclBvb2w7XG4gIC8qKlxuICAgKiBUaGUgYWxsb3dlZCBVc2VyIFBvb2wgY2xpZW50c1xuICAgKiBAZGVmYXVsdCAtIEFsbCBjbGllbnRzIGFyZSBhbGxvd2VkXG4gICAqL1xuICByZWFkb25seSBhbGxvd2VkQ2xpZW50cz86IElVc2VyUG9vbENsaWVudFtdO1xuICAvKipcbiAgICogVGhlIGFsbG93ZWQgYXVkaWVuY2VzIGZvciBKV1QgdmFsaWRhdGlvblxuICAgKiBAZGVmYXVsdCAtIE5vIGF1ZGllbmNlIHZhbGlkYXRpb25cbiAgICovXG4gIHJlYWRvbmx5IGFsbG93ZWRBdWRpZW5jZXM/OiBzdHJpbmdbXTtcbn1cbi8qKlxuICogRmFjdG9yeSBjbGFzcyBmb3IgY3JlYXRpbmcgR2F0ZXdheSBBdXRob3JpemVyc1xuICovXG5leHBvcnQgYWJzdHJhY3QgY2xhc3MgR2F0ZXdheUF1dGhvcml6ZXIge1xuICAvKipcbiAgICogQVdTIElBTSBhdXRob3JpemVyIGluc3RhbmNlXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHVzaW5nQXdzSWFtKCk6IElHYXRld2F5QXV0aG9yaXplckNvbmZpZyB7XG4gICAgcmV0dXJuIG5ldyBJYW1BdXRob3JpemVyKCk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGEgY3VzdG9tIEpXVCBhdXRob3JpemVyXG4gICAqIEBwYXJhbSBjb25maWd1cmF0aW9uIC0gVGhlIEpXVCBjb25maWd1cmF0aW9uXG4gICAqIEByZXR1cm5zIElHYXRld2F5QXV0aG9yaXplckNvbmZpZyBjb25maWd1cmVkIGZvciBjdXN0b20gSldUXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHVzaW5nQ3VzdG9tSnd0KGNvbmZpZ3VyYXRpb246IEN1c3RvbUp3dENvbmZpZ3VyYXRpb24pOiBJR2F0ZXdheUF1dGhvcml6ZXJDb25maWcge1xuICAgIC8vIEF0IGxlYXN0IG9uZSBvZiBhbGxvd2VkQXVkaWVuY2Ugb3IgYWxsb3dlZENsaWVudHMgbXVzdCBiZSBkZWZpbmVkIGZvciBDVVNUT01fSldUIGF1dGhvcml6ZXJcbiAgICBpZiAoIWNvbmZpZ3VyYXRpb24uYWxsb3dlZEF1ZGllbmNlICYmICFjb25maWd1cmF0aW9uLmFsbG93ZWRDbGllbnRzKSB7XG4gICAgICB0aHJvdyBuZXcgVmFsaWRhdGlvbkVycm9yKCdBdCBsZWFzdCBvbmUgb2YgYWxsb3dlZEF1ZGllbmNlIG9yIGFsbG93ZWRDbGllbnRzIG11c3QgYmUgZGVmaW5lZCBmb3IgQ1VTVE9NX0pXVCBhdXRob3JpemVyJyk7XG4gICAgfVxuICAgIHJldHVybiBuZXcgQ3VzdG9tSnd0QXV0aG9yaXplcihjb25maWd1cmF0aW9uKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBDcmVhdGUgYSBKV1QgYXV0aG9yaXplciBmcm9tIENvZ25pdG8gVXNlciBQb29sXG4gICAqIEBwYXJhbSBwcm9wcyAtIFRoZSBDb2duaXRvIGNvbmZpZ3VyYXRpb25cbiAgICogQHJldHVybnMgQ3VzdG9tSnd0QXV0aG9yaXplciBjb25maWd1cmVkIGZvciBDb2duaXRvXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHVzaW5nQ29nbml0byhwcm9wczogQ29nbml0b0F1dGhvcml6ZXJQcm9wcyk6IElHYXRld2F5QXV0aG9yaXplckNvbmZpZyB7XG4gICAgY29uc3QgZGlzY292ZXJ5VXJsID0gYGh0dHBzOi8vY29nbml0by1pZHAuJHtwcm9wcy51c2VyUG9vbC5lbnYucmVnaW9ufS5hbWF6b25hd3MuY29tLyR7cHJvcHMudXNlclBvb2wudXNlclBvb2xJZH0vLndlbGwta25vd24vb3BlbmlkLWNvbmZpZ3VyYXRpb25gO1xuXG4gICAgcmV0dXJuIG5ldyBDdXN0b21Kd3RBdXRob3JpemVyKHtcbiAgICAgIGRpc2NvdmVyeVVybDogZGlzY292ZXJ5VXJsLFxuICAgICAgYWxsb3dlZENsaWVudHM6IHByb3BzLmFsbG93ZWRDbGllbnRzPy5mbGF0TWFwKChjbGllbnQpID0+IGNsaWVudC51c2VyUG9vbENsaWVudElkKSxcbiAgICAgIGFsbG93ZWRBdWRpZW5jZTogcHJvcHMuYWxsb3dlZEF1ZGllbmNlcyxcbiAgICB9KTtcbiAgfVxufVxuIl19

package/agentcore/gateway/outbound-auth/api-key.d.ts

@@ -0,0 +1,117 @@
+import { Grant, IRole } from 'aws-cdk-lib/aws-iam';
+import { CredentialProviderType, ICredentialProviderConfig } from './credential-provider';
+/******************************************************************************
+ *                                 API KEY
+ *****************************************************************************/
+/**
+ * API Key additional configuration
+ */
+export interface ApiKeyAdditionalConfiguration {
+    /**
+     * The name of the credential parameter for the API key.
+     * This parameter name is used when sending the API key to the target endpoint.
+     *
+     * Length Constraints: Minimum length of 1. Maximum length of 64.
+     * @default - 'Authorization' for HEADER, 'api_key' for QUERY_PARAMETER
+     */
+    readonly credentialParameterName?: string;
+    /**
+     * The prefix for the API key credential.
+     * This prefix is added to the API key when sending it to the target endpoint.
+     *
+     * Length Constraints: Minimum length of 1. Maximum length of 64.
+     * @default - 'Bearer ' for HEADER, no prefix for QUERY_PARAMETER
+     */
+    readonly credentialPrefix?: string;
+}
+/**
+ * API Key credential location type
+ * @internal
+ */
+export declare enum ApiKeyCredentialLocationType {
+    HEADER = "HEADER",
+    QUERY_PARAMETER = "QUERY_PARAMETER"
+}
+/**
+ * API Key location within the request
+ */
+export declare class ApiKeyCredentialLocation {
+    /**
+     * Create a header-based API key credential location
+     * @param config - Optional configuration for the credential location
+     * @returns ApiKeyCredentialLocation configured for header placement
+     */
+    static header(config?: ApiKeyAdditionalConfiguration): ApiKeyCredentialLocation;
+    /**
+     * Create a query parameter-based API key credential location
+     * @param config - Optional configuration for the credential location
+     * @returns ApiKeyCredentialLocation configured for query parameter placement
+     */
+    static queryParameter(config?: ApiKeyAdditionalConfiguration): ApiKeyCredentialLocation;
+    /**
+     * The name of the credential parameter
+     */
+    readonly credentialParameterName: string;
+    /**
+     * The prefix for the credential value
+     */
+    readonly credentialPrefix?: string;
+    /**
+     * The type of credential location (HEADER or QUERY_PARAMETER)
+     */
+    readonly credentialLocationType: string;
+    private constructor();
+}
+/**
+ * API Key configuration
+ */
+export interface ApiKeyCredentialProviderProps {
+    /**
+     * The API key credential provider ARN.
+     * This is returned when creating the API key credential provider via Console or API.
+     * Format: arn:aws:bedrock-agentcore:region:account:token-vault/id/apikeycredentialprovider/name
+     */
+    readonly providerArn: string;
+    /**
+     * The ARN of the Secrets Manager secret containing the API key.
+     * This is returned when creating the API key credential provider via Console or API.
+     * Format: arn:aws:secretsmanager:region:account:secret:name
+     */
+    readonly secretArn: string;
+    /**
+     * The location of the API key credential.
+     * This field specifies where in the request the API key should be placed.
+     *
+     * @default - HEADER
+     */
+    readonly credentialLocation?: ApiKeyCredentialLocation;
+}
+/**
+ * API Key credential provider configuration implementation
+ * Can be used with OpenAPI targets
+ * @internal
+ */
+export declare class ApiKeyCredentialProviderConfiguration implements ICredentialProviderConfig {
+    readonly credentialProviderType = CredentialProviderType.API_KEY;
+    /**
+     * The ARN of the API key provider
+     */
+    readonly providerArn: string;
+    /**
+     * The ARN of the Secrets Manager secret
+     */
+    readonly secretArn: string;
+    /**
+     * The location configuration for the API key credential
+     */
+    readonly credentialLocation: ApiKeyCredentialLocation;
+    constructor(configuration: ApiKeyCredentialProviderProps);
+    /**
+     * Grant the needed permissions to the role for API key authentication
+     */
+    grantNeededPermissionsToRole(role: IRole): Grant | undefined;
+    /**
+     * @internal
+     */
+    _render(): any;
+}

package/agentcore/gateway/outbound-auth/api-key.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyCredentialProviderConfiguration = exports.ApiKeyCredentialLocation = exports.ApiKeyCredentialLocationType = void 0;
+const jsiiDeprecationWarnings = require("../../../.warnings.jsii.js");
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const credential_provider_1 = require("./credential-provider");
+const perms_1 = require("../perms");
+/**
+ * API Key credential location type
+ * @internal
+ */
+var ApiKeyCredentialLocationType;
+(function (ApiKeyCredentialLocationType) {
+    ApiKeyCredentialLocationType["HEADER"] = "HEADER";
+    ApiKeyCredentialLocationType["QUERY_PARAMETER"] = "QUERY_PARAMETER";
+})(ApiKeyCredentialLocationType || (exports.ApiKeyCredentialLocationType = ApiKeyCredentialLocationType = {}));
+/**
+ * API Key location within the request
+ */
+class ApiKeyCredentialLocation {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialLocation", version: "2.227.0-alpha.0" };
+    /**
+     * Create a header-based API key credential location
+     * @param config - Optional configuration for the credential location
+     * @returns ApiKeyCredentialLocation configured for header placement
+     */
+    static header(config) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_ApiKeyAdditionalConfiguration(config);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, this.header);
+            }
+            throw error;
+        }
+        return new ApiKeyCredentialLocation(ApiKeyCredentialLocationType.HEADER, config?.credentialParameterName ?? 'Authorization', config?.credentialPrefix ?? 'Bearer ');
+    }
+    /**
+     * Create a query parameter-based API key credential location
+     * @param config - Optional configuration for the credential location
+     * @returns ApiKeyCredentialLocation configured for query parameter placement
+     */
+    static queryParameter(config) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_ApiKeyAdditionalConfiguration(config);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, this.queryParameter);
+            }
+            throw error;
+        }
+        return new ApiKeyCredentialLocation(ApiKeyCredentialLocationType.QUERY_PARAMETER, config?.credentialParameterName ?? 'api_key', config?.credentialPrefix);
+    }
+    /**
+     * The name of the credential parameter
+     */
+    credentialParameterName;
+    /**
+     * The prefix for the credential value
+     */
+    credentialPrefix;
+    /**
+     * The type of credential location (HEADER or QUERY_PARAMETER)
+     */
+    credentialLocationType;
+    constructor(credentialLocationType, credentialParameterName, credentialPrefix) {
+        this.credentialLocationType = credentialLocationType;
+        this.credentialParameterName = credentialParameterName;
+        this.credentialPrefix = credentialPrefix;
+    }
+}
+exports.ApiKeyCredentialLocation = ApiKeyCredentialLocation;
+/**
+ * API Key credential provider configuration implementation
+ * Can be used with OpenAPI targets
+ * @internal
+ */
+class ApiKeyCredentialProviderConfiguration {
+    credentialProviderType = credential_provider_1.CredentialProviderType.API_KEY;
+    /**
+     * The ARN of the API key provider
+     */
+    providerArn;
+    /**
+     * The ARN of the Secrets Manager secret
+     */
+    secretArn;
+    /**
+     * The location configuration for the API key credential
+     */
+    credentialLocation;
+    constructor(configuration) {
+        this.providerArn = configuration.providerArn;
+        this.secretArn = configuration.secretArn;
+        this.credentialLocation = configuration.credentialLocation ?? ApiKeyCredentialLocation.header();
+    }
+    /**
+     * Grant the needed permissions to the role for API key authentication
+     */
+    grantNeededPermissionsToRole(role) {
+        const statements = [
+            new aws_iam_1.PolicyStatement({
+                actions: [
+                    ...perms_1.GatewayPerms.GATEWAY_API_KEY_PERMS,
+                    ...perms_1.GatewayPerms.GATEWAY_WORKLOAD_IDENTITY_PERMS,
+                ],
+                resources: [this.providerArn],
+            }),
+            new aws_iam_1.PolicyStatement({
+                actions: perms_1.GatewayPerms.SECRETS_PERMS,
+                resources: [this.secretArn],
+            }),
+        ];
+        return aws_iam_1.Grant.addToPrincipal({
+            grantee: role,
+            actions: statements.flatMap(s => s.actions),
+            resourceArns: statements.flatMap(s => s.resources),
+        });
+    }
+    /**
+     * @internal
+     */
+    _render() {
+        return {
+            credentialProviderType: this.credentialProviderType,
+            credentialProvider: {
+                apiKeyCredentialProvider: {
+                    providerArn: this.providerArn,
+                    credentialLocation: this.credentialLocation.credentialLocationType,
+                    credentialParameterName: this.credentialLocation.credentialParameterName,
+                    credentialPrefix: this.credentialLocation.credentialPrefix,
+                },
+            },
+        };
+    }
+}
+exports.ApiKeyCredentialProviderConfiguration = ApiKeyCredentialProviderConfiguration;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImFwaS1rZXkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSxpREFBb0U7QUFDcEUsK0RBQTBGO0FBQzFGLG9DQUF3QztBQTZCeEM7OztHQUdHO0FBQ0gsSUFBWSw0QkFHWDtBQUhELFdBQVksNEJBQTRCO0lBQ3RDLGlEQUFpQixDQUFBO0lBQ2pCLG1FQUFtQyxDQUFBO0FBQ3JDLENBQUMsRUFIVyw0QkFBNEIsNENBQTVCLDRCQUE0QixRQUd2QztBQUVEOztHQUVHO0FBQ0gsTUFBYSx3QkFBd0I7O0lBQ25DOzs7O09BSUc7SUFDSSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQXNDOzs7Ozs7Ozs7O1FBQ3pELE9BQU8sSUFBSSx3QkFBd0IsQ0FDakMsNEJBQTRCLENBQUMsTUFBTSxFQUNuQyxNQUFNLEVBQUUsdUJBQXVCLElBQUksZUFBZSxFQUNsRCxNQUFNLEVBQUUsZ0JBQWdCLElBQUksU0FBUyxDQUN0QyxDQUFDO0tBQ0g7SUFFRDs7OztPQUlHO0lBQ0ksTUFBTSxDQUFDLGNBQWMsQ0FBQyxNQUFzQzs7Ozs7Ozs7OztRQUNqRSxPQUFPLElBQUksd0JBQXdCLENBQ2pDLDRCQUE0QixDQUFDLGVBQWUsRUFDNUMsTUFBTSxFQUFFLHVCQUF1QixJQUFJLFNBQVMsRUFDNUMsTUFBTSxFQUFFLGdCQUFnQixDQUN6QixDQUFDO0tBQ0g7SUFFRDs7T0FFRztJQUNhLHVCQUF1QixDQUFTO0lBQ2hEOztPQUVHO0lBQ2EsZ0JBQWdCLENBQVU7SUFDMUM7O09BRUc7SUFDYSxzQkFBc0IsQ0FBUztJQUUvQyxZQUNFLHNCQUE4QixFQUM5Qix1QkFBK0IsRUFDL0IsZ0JBQXlCO1FBRXpCLElBQUksQ0FBQyxzQkFBc0IsR0FBRyxzQkFBc0IsQ0FBQztRQUNyRCxJQUFJLENBQUMsdUJBQXVCLEdBQUcsdUJBQXVCLENBQUM7UUFDdkQsSUFBSSxDQUFDLGdCQUFnQixHQUFHLGdCQUFnQixDQUFDO0tBQzFDOztBQWhESCw0REFpREM7QUE2QkQ7Ozs7R0FJRztBQUNILE1BQWEscUNBQXFDO0lBQ2hDLHNCQUFzQixHQUFHLDRDQUFzQixDQUFDLE9BQU8sQ0FBQztJQUN4RTs7T0FFRztJQUNhLFdBQVcsQ0FBUztJQUNwQzs7T0FFRztJQUNhLFNBQVMsQ0FBUztJQUNsQzs7T0FFRztJQUNhLGtCQUFrQixDQUEyQjtJQUU3RCxZQUFZLGFBQTRDO1FBQ3RELElBQUksQ0FBQyxXQUFXLEdBQUcsYUFBYSxDQUFDLFdBQVcsQ0FBQztRQUM3QyxJQUFJLENBQUMsU0FBUyxHQUFHLGFBQWEsQ0FBQyxTQUFTLENBQUM7UUFDekMsSUFBSSxDQUFDLGtCQUFrQixHQUFHLGFBQWEsQ0FBQyxrQkFBa0IsSUFBSSx3QkFBd0IsQ0FBQyxNQUFNLEVBQUUsQ0FBQztLQUNqRztJQUVEOztPQUVHO0lBQ0gsNEJBQTRCLENBQUMsSUFBVztRQUN0QyxNQUFNLFVBQVUsR0FBRztZQUNqQixJQUFJLHlCQUFlLENBQUM7Z0JBQ2xCLE9BQU8sRUFBRTtvQkFDUCxHQUFHLG9CQUFZLENBQUMscUJBQXFCO29CQUNyQyxHQUFHLG9CQUFZLENBQUMsK0JBQStCO2lCQUNoRDtnQkFDRCxTQUFTLEVBQUUsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDO2FBQzlCLENBQUM7WUFDRixJQUFJLHlCQUFlLENBQUM7Z0JBQ2xCLE9BQU8sRUFBRSxvQkFBWSxDQUFDLGFBQWE7Z0JBQ25DLFNBQVMsRUFBRSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7YUFDNUIsQ0FBQztTQUNILENBQUM7UUFFRixPQUFPLGVBQUssQ0FBQyxjQUFjLENBQUM7WUFDMUIsT0FBTyxFQUFFLElBQUk7WUFDYixPQUFPLEVBQUUsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUM7WUFDM0MsWUFBWSxFQUFFLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1NBQ25ELENBQUMsQ0FBQztLQUNKO0lBRUQ7O09BRUc7SUFDSCxPQUFPO1FBQ0wsT0FBTztZQUNMLHNCQUFzQixFQUFFLElBQUksQ0FBQyxzQkFBc0I7WUFDbkQsa0JBQWtCLEVBQUU7Z0JBQ2xCLHdCQUF3QixFQUFFO29CQUN4QixXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7b0JBQzdCLGtCQUFrQixFQUFFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxzQkFBc0I7b0JBQ2xFLHVCQUF1QixFQUFFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyx1QkFBdUI7b0JBQ3hFLGdCQUFnQixFQUFFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxnQkFBZ0I7aUJBQzNEO2FBQ0Y7U0FDRixDQUFDO0tBQ0g7Q0FDRjtBQTlERCxzRkE4REMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBHcmFudCwgSVJvbGUsIFBvbGljeVN0YXRlbWVudCB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0IHsgQ3JlZGVudGlhbFByb3ZpZGVyVHlwZSwgSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB9IGZyb20gJy4vY3JlZGVudGlhbC1wcm92aWRlcic7XG5pbXBvcnQgeyBHYXRld2F5UGVybXMgfSBmcm9tICcuLi9wZXJtcyc7XG5cbi8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiAqICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQVBJIEtFWVxuICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqL1xuLyoqXG4gKiBBUEkgS2V5IGFkZGl0aW9uYWwgY29uZmlndXJhdGlvblxuICovXG5leHBvcnQgaW50ZXJmYWNlIEFwaUtleUFkZGl0aW9uYWxDb25maWd1cmF0aW9uIHtcblxuICAvKipcbiAgICogVGhlIG5hbWUgb2YgdGhlIGNyZWRlbnRpYWwgcGFyYW1ldGVyIGZvciB0aGUgQVBJIGtleS5cbiAgICogVGhpcyBwYXJhbWV0ZXIgbmFtZSBpcyB1c2VkIHdoZW4gc2VuZGluZyB0aGUgQVBJIGtleSB0byB0aGUgdGFyZ2V0IGVuZHBvaW50LlxuICAgKlxuICAgKiBMZW5ndGggQ29uc3RyYWludHM6IE1pbmltdW0gbGVuZ3RoIG9mIDEuIE1heGltdW0gbGVuZ3RoIG9mIDY0LlxuICAgKiBAZGVmYXVsdCAtICdBdXRob3JpemF0aW9uJyBmb3IgSEVBREVSLCAnYXBpX2tleScgZm9yIFFVRVJZX1BBUkFNRVRFUlxuICAgKi9cbiAgcmVhZG9ubHkgY3JlZGVudGlhbFBhcmFtZXRlck5hbWU/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSBwcmVmaXggZm9yIHRoZSBBUEkga2V5IGNyZWRlbnRpYWwuXG4gICAqIFRoaXMgcHJlZml4IGlzIGFkZGVkIHRvIHRoZSBBUEkga2V5IHdoZW4gc2VuZGluZyBpdCB0byB0aGUgdGFyZ2V0IGVuZHBvaW50LlxuICAgKlxuICAgKiBMZW5ndGggQ29uc3RyYWludHM6IE1pbmltdW0gbGVuZ3RoIG9mIDEuIE1heGltdW0gbGVuZ3RoIG9mIDY0LlxuICAgKiBAZGVmYXVsdCAtICdCZWFyZXIgJyBmb3IgSEVBREVSLCBubyBwcmVmaXggZm9yIFFVRVJZX1BBUkFNRVRFUlxuICAgKi9cbiAgcmVhZG9ubHkgY3JlZGVudGlhbFByZWZpeD86IHN0cmluZztcbn1cblxuLyoqXG4gKiBBUEkgS2V5IGNyZWRlbnRpYWwgbG9jYXRpb24gdHlwZVxuICogQGludGVybmFsXG4gKi9cbmV4cG9ydCBlbnVtIEFwaUtleUNyZWRlbnRpYWxMb2NhdGlvblR5cGUge1xuICBIRUFERVIgPSAnSEVBREVSJyxcbiAgUVVFUllfUEFSQU1FVEVSID0gJ1FVRVJZX1BBUkFNRVRFUicsXG59XG5cbi8qKlxuICogQVBJIEtleSBsb2NhdGlvbiB3aXRoaW4gdGhlIHJlcXVlc3RcbiAqL1xuZXhwb3J0IGNsYXNzIEFwaUtleUNyZWRlbnRpYWxMb2NhdGlvbiB7XG4gIC8qKlxuICAgKiBDcmVhdGUgYSBoZWFkZXItYmFzZWQgQVBJIGtleSBjcmVkZW50aWFsIGxvY2F0aW9uXG4gICAqIEBwYXJhbSBjb25maWcgLSBPcHRpb25hbCBjb25maWd1cmF0aW9uIGZvciB0aGUgY3JlZGVudGlhbCBsb2NhdGlvblxuICAgKiBAcmV0dXJucyBBcGlLZXlDcmVkZW50aWFsTG9jYXRpb24gY29uZmlndXJlZCBmb3IgaGVhZGVyIHBsYWNlbWVudFxuICAgKi9cbiAgcHVibGljIHN0YXRpYyBoZWFkZXIoY29uZmlnPzogQXBpS2V5QWRkaXRpb25hbENvbmZpZ3VyYXRpb24pIHtcbiAgICByZXR1cm4gbmV3IEFwaUtleUNyZWRlbnRpYWxMb2NhdGlvbihcbiAgICAgIEFwaUtleUNyZWRlbnRpYWxMb2NhdGlvblR5cGUuSEVBREVSLFxuICAgICAgY29uZmlnPy5jcmVkZW50aWFsUGFyYW1ldGVyTmFtZSA/PyAnQXV0aG9yaXphdGlvbicsXG4gICAgICBjb25maWc/LmNyZWRlbnRpYWxQcmVmaXggPz8gJ0JlYXJlciAnLFxuICAgICk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGEgcXVlcnkgcGFyYW1ldGVyLWJhc2VkIEFQSSBrZXkgY3JlZGVudGlhbCBsb2NhdGlvblxuICAgKiBAcGFyYW0gY29uZmlnIC0gT3B0aW9uYWwgY29uZmlndXJhdGlvbiBmb3IgdGhlIGNyZWRlbnRpYWwgbG9jYXRpb25cbiAgICogQHJldHVybnMgQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uIGNvbmZpZ3VyZWQgZm9yIHF1ZXJ5IHBhcmFtZXRlciBwbGFjZW1lbnRcbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgcXVlcnlQYXJhbWV0ZXIoY29uZmlnPzogQXBpS2V5QWRkaXRpb25hbENvbmZpZ3VyYXRpb24pIHtcbiAgICByZXR1cm4gbmV3IEFwaUtleUNyZWRlbnRpYWxMb2NhdGlvbihcbiAgICAgIEFwaUtleUNyZWRlbnRpYWxMb2NhdGlvblR5cGUuUVVFUllfUEFSQU1FVEVSLFxuICAgICAgY29uZmlnPy5jcmVkZW50aWFsUGFyYW1ldGVyTmFtZSA/PyAnYXBpX2tleScsXG4gICAgICBjb25maWc/LmNyZWRlbnRpYWxQcmVmaXgsXG4gICAgKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBUaGUgbmFtZSBvZiB0aGUgY3JlZGVudGlhbCBwYXJhbWV0ZXJcbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBjcmVkZW50aWFsUGFyYW1ldGVyTmFtZTogc3RyaW5nO1xuICAvKipcbiAgICogVGhlIHByZWZpeCBmb3IgdGhlIGNyZWRlbnRpYWwgdmFsdWVcbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBjcmVkZW50aWFsUHJlZml4Pzogc3RyaW5nO1xuICAvKipcbiAgICogVGhlIHR5cGUgb2YgY3JlZGVudGlhbCBsb2NhdGlvbiAoSEVBREVSIG9yIFFVRVJZX1BBUkFNRVRFUilcbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBjcmVkZW50aWFsTG9jYXRpb25UeXBlOiBzdHJpbmc7XG5cbiAgcHJpdmF0ZSBjb25zdHJ1Y3RvcihcbiAgICBjcmVkZW50aWFsTG9jYXRpb25UeXBlOiBzdHJpbmcsXG4gICAgY3JlZGVudGlhbFBhcmFtZXRlck5hbWU6IHN0cmluZyxcbiAgICBjcmVkZW50aWFsUHJlZml4Pzogc3RyaW5nLFxuICApIHtcbiAgICB0aGlzLmNyZWRlbnRpYWxMb2NhdGlvblR5cGUgPSBjcmVkZW50aWFsTG9jYXRpb25UeXBlO1xuICAgIHRoaXMuY3JlZGVudGlhbFBhcmFtZXRlck5hbWUgPSBjcmVkZW50aWFsUGFyYW1ldGVyTmFtZTtcbiAgICB0aGlzLmNyZWRlbnRpYWxQcmVmaXggPSBjcmVkZW50aWFsUHJlZml4O1xuICB9XG59XG5cbi8qKlxuICogQVBJIEtleSBjb25maWd1cmF0aW9uXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyUHJvcHMge1xuICAvKipcbiAgICogVGhlIEFQSSBrZXkgY3JlZGVudGlhbCBwcm92aWRlciBBUk4uXG4gICAqIFRoaXMgaXMgcmV0dXJuZWQgd2hlbiBjcmVhdGluZyB0aGUgQVBJIGtleSBjcmVkZW50aWFsIHByb3ZpZGVyIHZpYSBDb25zb2xlIG9yIEFQSS5cbiAgICogRm9ybWF0OiBhcm46YXdzOmJlZHJvY2stYWdlbnRjb3JlOnJlZ2lvbjphY2NvdW50OnRva2VuLXZhdWx0L2lkL2FwaWtleWNyZWRlbnRpYWxwcm92aWRlci9uYW1lXG4gICAqL1xuICByZWFkb25seSBwcm92aWRlckFybjogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgQVJOIG9mIHRoZSBTZWNyZXRzIE1hbmFnZXIgc2VjcmV0IGNvbnRhaW5pbmcgdGhlIEFQSSBrZXkuXG4gICAqIFRoaXMgaXMgcmV0dXJuZWQgd2hlbiBjcmVhdGluZyB0aGUgQVBJIGtleSBjcmVkZW50aWFsIHByb3ZpZGVyIHZpYSBDb25zb2xlIG9yIEFQSS5cbiAgICogRm9ybWF0OiBhcm46YXdzOnNlY3JldHNtYW5hZ2VyOnJlZ2lvbjphY2NvdW50OnNlY3JldDpuYW1lXG4gICAqL1xuICByZWFkb25seSBzZWNyZXRBcm46IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIGxvY2F0aW9uIG9mIHRoZSBBUEkga2V5IGNyZWRlbnRpYWwuXG4gICAqIFRoaXMgZmllbGQgc3BlY2lmaWVzIHdoZXJlIGluIHRoZSByZXF1ZXN0IHRoZSBBUEkga2V5IHNob3VsZCBiZSBwbGFjZWQuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gSEVBREVSXG4gICAqL1xuICByZWFkb25seSBjcmVkZW50aWFsTG9jYXRpb24/OiBBcGlLZXlDcmVkZW50aWFsTG9jYXRpb247XG59XG5cbi8qKlxuICogQVBJIEtleSBjcmVkZW50aWFsIHByb3ZpZGVyIGNvbmZpZ3VyYXRpb24gaW1wbGVtZW50YXRpb25cbiAqIENhbiBiZSB1c2VkIHdpdGggT3BlbkFQSSB0YXJnZXRzXG4gKiBAaW50ZXJuYWxcbiAqL1xuZXhwb3J0IGNsYXNzIEFwaUtleUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZ3VyYXRpb24gaW1wbGVtZW50cyBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIHtcbiAgcHVibGljIHJlYWRvbmx5IGNyZWRlbnRpYWxQcm92aWRlclR5cGUgPSBDcmVkZW50aWFsUHJvdmlkZXJUeXBlLkFQSV9LRVk7XG4gIC8qKlxuICAgKiBUaGUgQVJOIG9mIHRoZSBBUEkga2V5IHByb3ZpZGVyXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgcHJvdmlkZXJBcm46IHN0cmluZztcbiAgLyoqXG4gICAqIFRoZSBBUk4gb2YgdGhlIFNlY3JldHMgTWFuYWdlciBzZWNyZXRcbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBzZWNyZXRBcm46IHN0cmluZztcbiAgLyoqXG4gICAqIFRoZSBsb2NhdGlvbiBjb25maWd1cmF0aW9uIGZvciB0aGUgQVBJIGtleSBjcmVkZW50aWFsXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgY3JlZGVudGlhbExvY2F0aW9uOiBBcGlLZXlDcmVkZW50aWFsTG9jYXRpb247XG5cbiAgY29uc3RydWN0b3IoY29uZmlndXJhdGlvbjogQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyUHJvcHMpIHtcbiAgICB0aGlzLnByb3ZpZGVyQXJuID0gY29uZmlndXJhdGlvbi5wcm92aWRlckFybjtcbiAgICB0aGlzLnNlY3JldEFybiA9IGNvbmZpZ3VyYXRpb24uc2VjcmV0QXJuO1xuICAgIHRoaXMuY3JlZGVudGlhbExvY2F0aW9uID0gY29uZmlndXJhdGlvbi5jcmVkZW50aWFsTG9jYXRpb24gPz8gQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uLmhlYWRlcigpO1xuICB9XG5cbiAgLyoqXG4gICAqIEdyYW50IHRoZSBuZWVkZWQgcGVybWlzc2lvbnMgdG8gdGhlIHJvbGUgZm9yIEFQSSBrZXkgYXV0aGVudGljYXRpb25cbiAgICovXG4gIGdyYW50TmVlZGVkUGVybWlzc2lvbnNUb1JvbGUocm9sZTogSVJvbGUpOiBHcmFudCB8IHVuZGVmaW5lZCB7XG4gICAgY29uc3Qgc3RhdGVtZW50cyA9IFtcbiAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBhY3Rpb25zOiBbXG4gICAgICAgICAgLi4uR2F0ZXdheVBlcm1zLkdBVEVXQVlfQVBJX0tFWV9QRVJNUyxcbiAgICAgICAgICAuLi5HYXRld2F5UGVybXMuR0FURVdBWV9XT1JLTE9BRF9JREVOVElUWV9QRVJNUyxcbiAgICAgICAgXSxcbiAgICAgICAgcmVzb3VyY2VzOiBbdGhpcy5wcm92aWRlckFybl0sXG4gICAgICB9KSxcbiAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBhY3Rpb25zOiBHYXRld2F5UGVybXMuU0VDUkVUU19QRVJNUyxcbiAgICAgICAgcmVzb3VyY2VzOiBbdGhpcy5zZWNyZXRBcm5dLFxuICAgICAgfSksXG4gICAgXTtcblxuICAgIHJldHVybiBHcmFudC5hZGRUb1ByaW5jaXBhbCh7XG4gICAgICBncmFudGVlOiByb2xlLFxuICAgICAgYWN0aW9uczogc3RhdGVtZW50cy5mbGF0TWFwKHMgPT4gcy5hY3Rpb25zKSxcbiAgICAgIHJlc291cmNlQXJuczogc3RhdGVtZW50cy5mbGF0TWFwKHMgPT4gcy5yZXNvdXJjZXMpLFxuICAgIH0pO1xuICB9XG5cbiAgLyoqXG4gICAqIEBpbnRlcm5hbFxuICAgKi9cbiAgX3JlbmRlcigpOiBhbnkge1xuICAgIHJldHVybiB7XG4gICAgICBjcmVkZW50aWFsUHJvdmlkZXJUeXBlOiB0aGlzLmNyZWRlbnRpYWxQcm92aWRlclR5cGUsXG4gICAgICBjcmVkZW50aWFsUHJvdmlkZXI6IHtcbiAgICAgICAgYXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyOiB7XG4gICAgICAgICAgcHJvdmlkZXJBcm46IHRoaXMucHJvdmlkZXJBcm4sXG4gICAgICAgICAgY3JlZGVudGlhbExvY2F0aW9uOiB0aGlzLmNyZWRlbnRpYWxMb2NhdGlvbi5jcmVkZW50aWFsTG9jYXRpb25UeXBlLFxuICAgICAgICAgIGNyZWRlbnRpYWxQYXJhbWV0ZXJOYW1lOiB0aGlzLmNyZWRlbnRpYWxMb2NhdGlvbi5jcmVkZW50aWFsUGFyYW1ldGVyTmFtZSxcbiAgICAgICAgICBjcmVkZW50aWFsUHJlZml4OiB0aGlzLmNyZWRlbnRpYWxMb2NhdGlvbi5jcmVkZW50aWFsUHJlZml4LFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICB9O1xuICB9XG59XG4iXX0=

package/agentcore/gateway/outbound-auth/credential-provider.d.ts

@@ -0,0 +1,70 @@
+import { IResolvable } from 'aws-cdk-lib';
+import { CfnGatewayTarget } from 'aws-cdk-lib/aws-bedrockagentcore';
+import { ApiKeyCredentialProviderProps } from './api-key';
+import { OAuthConfiguration } from './oauth';
+import { Grant, IRole } from 'aws-cdk-lib/aws-iam';
+/******************************************************************************
+ *                                 Enums
+ *****************************************************************************/
+/**
+ * Credential provider types supported by gateway target
+ */
+export declare enum CredentialProviderType {
+    /**
+     * API Key authentication
+     */
+    API_KEY = "API_KEY",
+    /**
+     * OAuth authentication
+     */
+    OAUTH = "OAUTH",
+    /**
+     * IAM role authentication
+     */
+    GATEWAY_IAM_ROLE = "GATEWAY_IAM_ROLE"
+}
+/******************************************************************************
+ *                       Credential Provider
+ *****************************************************************************/
+/**
+ * Abstract interface for gateway credential provider configuration
+ */
+export interface ICredentialProviderConfig {
+    /**
+     * The credential provider type
+     */
+    readonly credentialProviderType: CredentialProviderType;
+    /**
+     * Renders as CFN Property
+     *  @internal
+     */
+    _render(): CfnGatewayTarget.CredentialProviderConfigurationProperty | IResolvable;
+    /**
+     * Grant the role the permissions
+     */
+    grantNeededPermissionsToRole(role: IRole): Grant | undefined;
+}
+/**
+ * Factory class for creating different Gateway Credential Providers
+ */
+export declare abstract class GatewayCredentialProvider {
+    /**
+     * Create an API key credential provider from Identity ARN
+     * Use this method when you have the Identity ARN as a string
+     * @param props - The configuration properties for the API key credential provider
+     * @returns ICredentialProviderConfig configured for API key authentication
+     */
+    static fromApiKeyIdentityArn(props: ApiKeyCredentialProviderProps): ICredentialProviderConfig;
+    /**
+     * Create an OAuth credential provider from Identity ARN
+     * Use this method when you have the Identity ARN as a string
+     * @param props - The configuration properties for the OAuth credential provider
+     * @returns ICredentialProviderConfig configured for OAuth authentication
+     */
+    static fromOauthIdentityArn(props: OAuthConfiguration): ICredentialProviderConfig;
+    /**
+     * Create an IAM role credential provider
+     * @returns IIamRoleCredentialProvider configured for IAM role authentication
+     */
+    static fromIamRole(): ICredentialProviderConfig;
+}