@aws-cdk/aws-bedrock-agentcore-alpha 2.231.0-alpha.0 → 2.232.0-alpha.0

package/README.md

@@ -249,6 +249,41 @@ const runtimeInstance = new agentcore.Runtime(this, "MyAgentRuntime", {
 });
 ```
 
+#### Option 4: Use an ECR container image URI
+
+Reference an ECR container image directly by its URI. This is useful when you have a pre-existing ECR image URI from CloudFormation parameters or cross-stack references. No IAM permissions are automatically granted - you must ensure the runtime has ECR pull permissions.
+
+```typescript fixture=default
+// Direct URI reference
+const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromImageUri(
+  "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-agent:v1.0.0"
+);
+
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifact,
+});
+```
+
+You can also use CloudFormation parameters or references:
+
+```typescript fixture=default
+// Using a CloudFormation parameter
+const imageUriParam = new cdk.CfnParameter(this, "ImageUri", {
+  type: "String",
+  description: "Container image URI for the agent runtime",
+});
+
+const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromImageUri(
+  imageUriParam.valueAsString
+);
+
+const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
+  runtimeName: "myAgent",
+  agentRuntimeArtifact: agentRuntimeArtifact,
+});
+```
+
 ### Granting Permissions to Invoke Bedrock Models or Inference Profiles
 
 To grant the runtime permissions to invoke Bedrock models or inference profiles:

package/eslint-suppressions.json

@@ -0,0 +1,2 @@
+{
+}

package/lib/gateway/gateway-base.d.ts

@@ -284,9 +284,4 @@ export declare abstract class GatewayBase extends Resource implements IGateway {
      * Return a metric containing the number of requests served by each target type for this gateway.
      */
     metricTargetType(targetType: string, props?: MetricOptions): Metric;
-    /**
-     * Internal method to create a metric.
-     * @internal
-     */
-    private configureMetric;
 }

package/lib/gateway/gateway-base.js

@@ -25,7 +25,7 @@ var GatewayExceptionLevel;
  *                                Base Class
  *****************************************************************************/
 class GatewayBase extends aws_cdk_lib_1.Resource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayBase", version: "2.231.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayBase", version: "2.232.0-alpha.0" };
     constructor(scope, id) {
         super(scope, id);
     }

package/lib/gateway/gateway.d.ts

@@ -340,44 +340,4 @@ export declare class Gateway extends GatewayBase {
      * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-target-MCPservers.html
      */
     addMcpServerTarget(id: string, props: AddMcpServerTargetOptions): GatewayTarget;
-    /**
-     * Creates the service role for the gateway to assume
-     *
-     * The service role starts with minimal permissions. Additional permissions
-     * are added automatically when targets are configured:
-     * - KMS encryption: Automatically grants encrypt/decrypt permissions
-     *
-     * For other target types, manually grant permissions using standard CDK grant methods:
-     * @internal
-     */
-    private createGatewayRole;
-    /**
-     * Validates the gateway name format
-     * Pattern: ^([0-9a-zA-Z][-]?){1,100}$
-     * Max length: 48 characters
-     * @param name The gateway name to validate
-     * @throws Error if the name is invalid
-     * @internal
-     */
-    private validateGatewayName;
-    /**
-     * Validates the description format
-     * Max length: 200 characters
-     * @param description The description to validate
-     * @throws Error if validation fails
-     * @internal
-     */
-    private validateDescription;
-    /**
-     * Creates a default Cognito authorizer for the gateway
-     * Provisions a Cognito User Pool and configures JWT authentication
-     * @internal
-     */
-    private createDefaultCognitoAuthorizerConfig;
-    /**
-     * Creates a default MCP protocol configuration for the gateway
-     * Provides sensible defaults for MCP protocol settings
-     * @internal
-     */
-    private createDefaultMcpProtocolConfiguration;
 }

package/lib/gateway/gateway.js

@@ -87,7 +87,7 @@ let Gateway = (() => {
             Gateway = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.Gateway", version: "2.231.0-alpha.0" };
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.Gateway", version: "2.232.0-alpha.0" };
         /** Uniquely identifies this class. */
         static PROPERTY_INJECTION_ID = '@aws-cdk.aws-bedrock-agentcore-alpha.Gateway';
         /**

package/lib/gateway/inbound-auth/authorizer.d.ts

@@ -19,11 +19,6 @@ export interface IGatewayAuthorizerConfig {
      * The authorizer type
      */
     readonly authorizerType: GatewayAuthorizerType;
-    /**
-     * The authorizer configuration in CFN format
-     * @internal
-     */
-    _render(): any;
 }
 /******************************************************************************
  *                                  Custom JWT
@@ -60,10 +55,6 @@ export declare class CustomJwtAuthorizer implements IGatewayAuthorizerConfig {
     private readonly allowedAudience?;
     private readonly allowedClients?;
     constructor(config: CustomJwtConfiguration);
-    /**
-     * @internal
-     */
-    _render(): any;
 }
 /******************************************************************************
  *                               AWS IAM
@@ -74,10 +65,6 @@ export declare class CustomJwtAuthorizer implements IGatewayAuthorizerConfig {
  */
 export declare class IamAuthorizer implements IGatewayAuthorizerConfig {
     readonly authorizerType = GatewayAuthorizerType.AWS_IAM;
-    /**
-     * @internal
-     */
-    _render(): any;
 }
 /******************************************************************************
  *                               Factory

package/lib/gateway/inbound-auth/authorizer.js

@@ -21,7 +21,7 @@ var GatewayAuthorizerType;
  * Custom JWT authorizer configuration implementation
  */
 class CustomJwtAuthorizer {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.CustomJwtAuthorizer", version: "2.231.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.CustomJwtAuthorizer", version: "2.232.0-alpha.0" };
     authorizerType = GatewayAuthorizerType.CUSTOM_JWT;
     discoveryUrl;
     allowedAudience;
@@ -62,7 +62,7 @@ exports.CustomJwtAuthorizer = CustomJwtAuthorizer;
  *
  */
 class IamAuthorizer {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.IamAuthorizer", version: "2.231.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.IamAuthorizer", version: "2.232.0-alpha.0" };
     authorizerType = GatewayAuthorizerType.AWS_IAM;
     /**
      * @internal
@@ -78,7 +78,7 @@ exports.IamAuthorizer = IamAuthorizer;
  * Factory class for creating Gateway Authorizers
  */
 class GatewayAuthorizer {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayAuthorizer", version: "2.231.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayAuthorizer", version: "2.232.0-alpha.0" };
     /**
      * AWS IAM authorizer instance
      */

package/lib/gateway/outbound-auth/api-key.d.ts

@@ -1,5 +1,3 @@
-import { Grant, IRole } from 'aws-cdk-lib/aws-iam';
-import { CredentialProviderType, ICredentialProviderConfig } from './credential-provider';
 /******************************************************************************
  *                                 API KEY
  *****************************************************************************/
@@ -24,14 +22,6 @@ export interface ApiKeyAdditionalConfiguration {
      */
     readonly credentialPrefix?: string;
 }
-/**
- * API Key credential location type
- * @internal
- */
-export declare enum ApiKeyCredentialLocationType {
-    HEADER = "HEADER",
-    QUERY_PARAMETER = "QUERY_PARAMETER"
-}
 /**
  * API Key location within the request
  */
@@ -86,32 +76,3 @@ export interface ApiKeyCredentialProviderProps {
      */
     readonly credentialLocation?: ApiKeyCredentialLocation;
 }
-/**
- * API Key credential provider configuration implementation
- * Can be used with OpenAPI targets
- * @internal
- */
-export declare class ApiKeyCredentialProviderConfiguration implements ICredentialProviderConfig {
-    readonly credentialProviderType = CredentialProviderType.API_KEY;
-    /**
-     * The ARN of the API key provider
-     */
-    readonly providerArn: string;
-    /**
-     * The ARN of the Secrets Manager secret
-     */
-    readonly secretArn: string;
-    /**
-     * The location configuration for the API key credential
-     */
-    readonly credentialLocation: ApiKeyCredentialLocation;
-    constructor(configuration: ApiKeyCredentialProviderProps);
-    /**
-     * Grant the needed permissions to the role for API key authentication
-     */
-    grantNeededPermissionsToRole(role: IRole): Grant | undefined;
-    /**
-     * @internal
-     */
-    _render(): any;
-}

package/lib/gateway/outbound-auth/api-key.js

@@ -19,7 +19,7 @@ var ApiKeyCredentialLocationType;
  * API Key location within the request
  */
 class ApiKeyCredentialLocation {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialLocation", version: "2.231.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialLocation", version: "2.232.0-alpha.0" };
     /**
      * Create a header-based API key credential location
      * @param config - Optional configuration for the credential location

package/lib/gateway/outbound-auth/credential-provider.d.ts

@@ -1,8 +1,6 @@
-import { IResolvable } from 'aws-cdk-lib';
-import { CfnGatewayTarget } from 'aws-cdk-lib/aws-bedrockagentcore';
+import { Grant, IRole } from 'aws-cdk-lib/aws-iam';
 import { ApiKeyCredentialProviderProps } from './api-key';
 import { OAuthConfiguration } from './oauth';
-import { Grant, IRole } from 'aws-cdk-lib/aws-iam';
 /******************************************************************************
  *                                 Enums
  *****************************************************************************/
@@ -34,11 +32,6 @@ export interface ICredentialProviderConfig {
      * The credential provider type
      */
     readonly credentialProviderType: CredentialProviderType;
-    /**
-     * Renders as CFN Property
-     *  @internal
-     */
-    _render(): CfnGatewayTarget.CredentialProviderConfigurationProperty | IResolvable;
     /**
      * Grant the role the permissions
      */

package/lib/gateway/outbound-auth/credential-provider.js

@@ -31,7 +31,7 @@ var CredentialProviderType;
  * Factory class for creating different Gateway Credential Providers
  */
 class GatewayCredentialProvider {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCredentialProvider", version: "2.231.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCredentialProvider", version: "2.232.0-alpha.0" };
     /**
      * Create an API key credential provider from Identity ARN
      * Use this method when you have the Identity ARN as a string
@@ -77,4 +77,4 @@ class GatewayCredentialProvider {
     }
 }
 exports.GatewayCredentialProvider = GatewayCredentialProvider;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3JlZGVudGlhbC1wcm92aWRlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImNyZWRlbnRpYWwtcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFFQSx1Q0FBaUc7QUFDakcseUNBQW9FO0FBQ3BFLG1DQUFtRjtBQUduRjs7K0VBRStFO0FBQy9FOztHQUVHO0FBQ0gsSUFBWSxzQkFlWDtBQWZELFdBQVksc0JBQXNCO0lBQ2hDOztPQUVHO0lBQ0gsNkNBQW1CLENBQUE7SUFFbkI7O09BRUc7SUFDSCx5Q0FBZSxDQUFBO0lBRWY7O09BRUc7SUFDSCwrREFBcUMsQ0FBQTtBQUN2QyxDQUFDLEVBZlcsc0JBQXNCLHNDQUF0QixzQkFBc0IsUUFlakM7QUEyQkQ7O0dBRUc7QUFDSCxNQUFzQix5QkFBeUI7O0lBQzdDOzs7OztPQUtHO0lBQ0ksTUFBTSxDQUFDLHFCQUFxQixDQUFDLEtBQW9DOzs7Ozs7Ozs7O1FBQ3RFLE9BQU8sSUFBSSwrQ0FBcUMsQ0FBQyxLQUFLLENBQUMsQ0FBQztLQUN6RDtJQUVEOzs7OztPQUtHO0lBQ0ksTUFBTSxDQUFDLG9CQUFvQixDQUFDLEtBQXlCOzs7Ozs7Ozs7O1FBQzFELE9BQU8sSUFBSSw0Q0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztLQUN4RDtJQUVEOzs7T0FHRztJQUNJLE1BQU0sQ0FBQyxXQUFXO1FBQ3ZCLE9BQU8sSUFBSSxpREFBc0MsRUFBRSxDQUFDO0tBQ3JEOztBQTNCSCw4REE0QkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBJUmVzb2x2YWJsZSB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCB7IENmbkdhdGV3YXlUYXJnZXQgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtYmVkcm9ja2FnZW50Y29yZSc7XG5pbXBvcnQgeyBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJDb25maWd1cmF0aW9uLCBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJQcm9wcyB9IGZyb20gJy4vYXBpLWtleSc7XG5pbXBvcnQgeyBHYXRld2F5SWFtUm9sZUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB9IGZyb20gJy4vaWFtLXJvbGUnO1xuaW1wb3J0IHsgT0F1dGhDb25maWd1cmF0aW9uLCBPQXV0aENyZWRlbnRpYWxQcm92aWRlckNvbmZpZ3VyYXRpb24gfSBmcm9tICcuL29hdXRoJztcbmltcG9ydCB7IEdyYW50LCBJUm9sZSB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVudW1zXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG4vKipcbiAqIENyZWRlbnRpYWwgcHJvdmlkZXIgdHlwZXMgc3VwcG9ydGVkIGJ5IGdhdGV3YXkgdGFyZ2V0XG4gKi9cbmV4cG9ydCBlbnVtIENyZWRlbnRpYWxQcm92aWRlclR5cGUge1xuICAvKipcbiAgICogQVBJIEtleSBhdXRoZW50aWNhdGlvblxuICAgKi9cbiAgQVBJX0tFWSA9ICdBUElfS0VZJyxcblxuICAvKipcbiAgICogT0F1dGggYXV0aGVudGljYXRpb25cbiAgICovXG4gIE9BVVRIID0gJ09BVVRIJyxcblxuICAvKipcbiAgICogSUFNIHJvbGUgYXV0aGVudGljYXRpb25cbiAgICovXG4gIEdBVEVXQVlfSUFNX1JPTEUgPSAnR0FURVdBWV9JQU1fUk9MRScsXG59XG5cbi8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiAqICAgICAgICAgICAgICAgICAgICAgICBDcmVkZW50aWFsIFByb3ZpZGVyXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbi8qKlxuICogQWJzdHJhY3QgaW50ZXJmYWNlIGZvciBnYXRld2F5IGNyZWRlbnRpYWwgcHJvdmlkZXIgY29uZmlndXJhdGlvblxuICovXG5leHBvcnQgaW50ZXJmYWNlIElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcge1xuICAvKipcbiAgICogVGhlIGNyZWRlbnRpYWwgcHJvdmlkZXIgdHlwZVxuICAgKi9cbiAgcmVhZG9ubHkgY3JlZGVudGlhbFByb3ZpZGVyVHlwZTogQ3JlZGVudGlhbFByb3ZpZGVyVHlwZTtcblxuICAvKipcbiAgICogUmVuZGVycyBhcyBDRk4gUHJvcGVydHlcbiAgICogIEBpbnRlcm5hbFxuICAgKi9cbiAgX3JlbmRlcigpOiBDZm5HYXRld2F5VGFyZ2V0LkNyZWRlbnRpYWxQcm92aWRlckNvbmZpZ3VyYXRpb25Qcm9wZXJ0eSB8IElSZXNvbHZhYmxlO1xuXG4gIC8qKlxuICAgKiBHcmFudCB0aGUgcm9sZSB0aGUgcGVybWlzc2lvbnNcbiAgICovXG4gIGdyYW50TmVlZGVkUGVybWlzc2lvbnNUb1JvbGUocm9sZTogSVJvbGUpOiBHcmFudCB8IHVuZGVmaW5lZDtcbn1cblxuLyoqXG4gKiBGYWN0b3J5IGNsYXNzIGZvciBjcmVhdGluZyBkaWZmZXJlbnQgR2F0ZXdheSBDcmVkZW50aWFsIFByb3ZpZGVyc1xuICovXG5leHBvcnQgYWJzdHJhY3QgY2xhc3MgR2F0ZXdheUNyZWRlbnRpYWxQcm92aWRlciB7XG4gIC8qKlxuICAgKiBDcmVhdGUgYW4gQVBJIGtleSBjcmVkZW50aWFsIHByb3ZpZGVyIGZyb20gSWRlbnRpdHkgQVJOXG4gICAqIFVzZSB0aGlzIG1ldGhvZCB3aGVuIHlvdSBoYXZlIHRoZSBJZGVudGl0eSBBUk4gYXMgYSBzdHJpbmdcbiAgICogQHBhcmFtIHByb3BzIC0gVGhlIGNvbmZpZ3VyYXRpb24gcHJvcGVydGllcyBmb3IgdGhlIEFQSSBrZXkgY3JlZGVudGlhbCBwcm92aWRlclxuICAgKiBAcmV0dXJucyBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIGNvbmZpZ3VyZWQgZm9yIEFQSSBrZXkgYXV0aGVudGljYXRpb25cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgZnJvbUFwaUtleUlkZW50aXR5QXJuKHByb3BzOiBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJQcm9wcyk6IElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcge1xuICAgIHJldHVybiBuZXcgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvbihwcm9wcyk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGFuIE9BdXRoIGNyZWRlbnRpYWwgcHJvdmlkZXIgZnJvbSBJZGVudGl0eSBBUk5cbiAgICogVXNlIHRoaXMgbWV0aG9kIHdoZW4geW91IGhhdmUgdGhlIElkZW50aXR5IEFSTiBhcyBhIHN0cmluZ1xuICAgKiBAcGFyYW0gcHJvcHMgLSBUaGUgY29uZmlndXJhdGlvbiBwcm9wZXJ0aWVzIGZvciB0aGUgT0F1dGggY3JlZGVudGlhbCBwcm92aWRlclxuICAgKiBAcmV0dXJucyBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIGNvbmZpZ3VyZWQgZm9yIE9BdXRoIGF1dGhlbnRpY2F0aW9uXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIGZyb21PYXV0aElkZW50aXR5QXJuKHByb3BzOiBPQXV0aENvbmZpZ3VyYXRpb24pOiBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIHtcbiAgICByZXR1cm4gbmV3IE9BdXRoQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvbihwcm9wcyk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGFuIElBTSByb2xlIGNyZWRlbnRpYWwgcHJvdmlkZXJcbiAgICogQHJldHVybnMgSUlhbVJvbGVDcmVkZW50aWFsUHJvdmlkZXIgY29uZmlndXJlZCBmb3IgSUFNIHJvbGUgYXV0aGVudGljYXRpb25cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgZnJvbUlhbVJvbGUoKTogSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB7XG4gICAgcmV0dXJuIG5ldyBHYXRld2F5SWFtUm9sZUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZygpO1xuICB9XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3JlZGVudGlhbC1wcm92aWRlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImNyZWRlbnRpYWwtcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFHQSx1Q0FBaUc7QUFDakcseUNBQW9FO0FBQ3BFLG1DQUFtRjtBQUVuRjs7K0VBRStFO0FBQy9FOztHQUVHO0FBQ0gsSUFBWSxzQkFlWDtBQWZELFdBQVksc0JBQXNCO0lBQ2hDOztPQUVHO0lBQ0gsNkNBQW1CLENBQUE7SUFFbkI7O09BRUc7SUFDSCx5Q0FBZSxDQUFBO0lBRWY7O09BRUc7SUFDSCwrREFBcUMsQ0FBQTtBQUN2QyxDQUFDLEVBZlcsc0JBQXNCLHNDQUF0QixzQkFBc0IsUUFlakM7QUEyQkQ7O0dBRUc7QUFDSCxNQUFzQix5QkFBeUI7O0lBQzdDOzs7OztPQUtHO0lBQ0ksTUFBTSxDQUFDLHFCQUFxQixDQUFDLEtBQW9DOzs7Ozs7Ozs7O1FBQ3RFLE9BQU8sSUFBSSwrQ0FBcUMsQ0FBQyxLQUFLLENBQUMsQ0FBQztLQUN6RDtJQUVEOzs7OztPQUtHO0lBQ0ksTUFBTSxDQUFDLG9CQUFvQixDQUFDLEtBQXlCOzs7Ozs7Ozs7O1FBQzFELE9BQU8sSUFBSSw0Q0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztLQUN4RDtJQUVEOzs7T0FHRztJQUNJLE1BQU0sQ0FBQyxXQUFXO1FBQ3ZCLE9BQU8sSUFBSSxpREFBc0MsRUFBRSxDQUFDO0tBQ3JEOztBQTNCSCw4REE0QkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBJUmVzb2x2YWJsZSB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCB7IENmbkdhdGV3YXlUYXJnZXQgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtYmVkcm9ja2FnZW50Y29yZSc7XG5pbXBvcnQgeyBHcmFudCwgSVJvbGUgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IEFwaUtleUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZ3VyYXRpb24sIEFwaUtleUNyZWRlbnRpYWxQcm92aWRlclByb3BzIH0gZnJvbSAnLi9hcGkta2V5JztcbmltcG9ydCB7IEdhdGV3YXlJYW1Sb2xlQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIH0gZnJvbSAnLi9pYW0tcm9sZSc7XG5pbXBvcnQgeyBPQXV0aENvbmZpZ3VyYXRpb24sIE9BdXRoQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvbiB9IGZyb20gJy4vb2F1dGgnO1xuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVudW1zXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG4vKipcbiAqIENyZWRlbnRpYWwgcHJvdmlkZXIgdHlwZXMgc3VwcG9ydGVkIGJ5IGdhdGV3YXkgdGFyZ2V0XG4gKi9cbmV4cG9ydCBlbnVtIENyZWRlbnRpYWxQcm92aWRlclR5cGUge1xuICAvKipcbiAgICogQVBJIEtleSBhdXRoZW50aWNhdGlvblxuICAgKi9cbiAgQVBJX0tFWSA9ICdBUElfS0VZJyxcblxuICAvKipcbiAgICogT0F1dGggYXV0aGVudGljYXRpb25cbiAgICovXG4gIE9BVVRIID0gJ09BVVRIJyxcblxuICAvKipcbiAgICogSUFNIHJvbGUgYXV0aGVudGljYXRpb25cbiAgICovXG4gIEdBVEVXQVlfSUFNX1JPTEUgPSAnR0FURVdBWV9JQU1fUk9MRScsXG59XG5cbi8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiAqICAgICAgICAgICAgICAgICAgICAgICBDcmVkZW50aWFsIFByb3ZpZGVyXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbi8qKlxuICogQWJzdHJhY3QgaW50ZXJmYWNlIGZvciBnYXRld2F5IGNyZWRlbnRpYWwgcHJvdmlkZXIgY29uZmlndXJhdGlvblxuICovXG5leHBvcnQgaW50ZXJmYWNlIElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcge1xuICAvKipcbiAgICogVGhlIGNyZWRlbnRpYWwgcHJvdmlkZXIgdHlwZVxuICAgKi9cbiAgcmVhZG9ubHkgY3JlZGVudGlhbFByb3ZpZGVyVHlwZTogQ3JlZGVudGlhbFByb3ZpZGVyVHlwZTtcblxuICAvKipcbiAgICogUmVuZGVycyBhcyBDRk4gUHJvcGVydHlcbiAgICogIEBpbnRlcm5hbFxuICAgKi9cbiAgX3JlbmRlcigpOiBDZm5HYXRld2F5VGFyZ2V0LkNyZWRlbnRpYWxQcm92aWRlckNvbmZpZ3VyYXRpb25Qcm9wZXJ0eSB8IElSZXNvbHZhYmxlO1xuXG4gIC8qKlxuICAgKiBHcmFudCB0aGUgcm9sZSB0aGUgcGVybWlzc2lvbnNcbiAgICovXG4gIGdyYW50TmVlZGVkUGVybWlzc2lvbnNUb1JvbGUocm9sZTogSVJvbGUpOiBHcmFudCB8IHVuZGVmaW5lZDtcbn1cblxuLyoqXG4gKiBGYWN0b3J5IGNsYXNzIGZvciBjcmVhdGluZyBkaWZmZXJlbnQgR2F0ZXdheSBDcmVkZW50aWFsIFByb3ZpZGVyc1xuICovXG5leHBvcnQgYWJzdHJhY3QgY2xhc3MgR2F0ZXdheUNyZWRlbnRpYWxQcm92aWRlciB7XG4gIC8qKlxuICAgKiBDcmVhdGUgYW4gQVBJIGtleSBjcmVkZW50aWFsIHByb3ZpZGVyIGZyb20gSWRlbnRpdHkgQVJOXG4gICAqIFVzZSB0aGlzIG1ldGhvZCB3aGVuIHlvdSBoYXZlIHRoZSBJZGVudGl0eSBBUk4gYXMgYSBzdHJpbmdcbiAgICogQHBhcmFtIHByb3BzIC0gVGhlIGNvbmZpZ3VyYXRpb24gcHJvcGVydGllcyBmb3IgdGhlIEFQSSBrZXkgY3JlZGVudGlhbCBwcm92aWRlclxuICAgKiBAcmV0dXJucyBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIGNvbmZpZ3VyZWQgZm9yIEFQSSBrZXkgYXV0aGVudGljYXRpb25cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgZnJvbUFwaUtleUlkZW50aXR5QXJuKHByb3BzOiBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJQcm9wcyk6IElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcge1xuICAgIHJldHVybiBuZXcgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvbihwcm9wcyk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGFuIE9BdXRoIGNyZWRlbnRpYWwgcHJvdmlkZXIgZnJvbSBJZGVudGl0eSBBUk5cbiAgICogVXNlIHRoaXMgbWV0aG9kIHdoZW4geW91IGhhdmUgdGhlIElkZW50aXR5IEFSTiBhcyBhIHN0cmluZ1xuICAgKiBAcGFyYW0gcHJvcHMgLSBUaGUgY29uZmlndXJhdGlvbiBwcm9wZXJ0aWVzIGZvciB0aGUgT0F1dGggY3JlZGVudGlhbCBwcm92aWRlclxuICAgKiBAcmV0dXJucyBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIGNvbmZpZ3VyZWQgZm9yIE9BdXRoIGF1dGhlbnRpY2F0aW9uXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIGZyb21PYXV0aElkZW50aXR5QXJuKHByb3BzOiBPQXV0aENvbmZpZ3VyYXRpb24pOiBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIHtcbiAgICByZXR1cm4gbmV3IE9BdXRoQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvbihwcm9wcyk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGFuIElBTSByb2xlIGNyZWRlbnRpYWwgcHJvdmlkZXJcbiAgICogQHJldHVybnMgSUlhbVJvbGVDcmVkZW50aWFsUHJvdmlkZXIgY29uZmlndXJlZCBmb3IgSUFNIHJvbGUgYXV0aGVudGljYXRpb25cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgZnJvbUlhbVJvbGUoKTogSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB7XG4gICAgcmV0dXJuIG5ldyBHYXRld2F5SWFtUm9sZUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZygpO1xuICB9XG59XG4iXX0=

package/lib/gateway/outbound-auth/iam-role.d.ts

@@ -1,28 +1,4 @@
 /******************************************************************************
  *                                 IAM Role
  *****************************************************************************/
-import { Grant, IRole } from 'aws-cdk-lib/aws-iam';
-import { CredentialProviderType, ICredentialProviderConfig } from './credential-provider';
-/**
- * Gateway IAM Role credential provider configuration implementation
- * Can be used with Lambda and Smithy targets
- * @internal
- */
-export declare class GatewayIamRoleCredentialProviderConfig implements ICredentialProviderConfig {
-    readonly credentialProviderType = CredentialProviderType.GATEWAY_IAM_ROLE;
-    constructor();
-    /**
-     * @internal
-     */
-    _render(): any;
-    /**
-     * No-op for IAM role authentication - no additional permissions are required.
-     * When using IAM role authentication for outbound calls, the gateway uses its own execution
-     * role to authenticate with the target endpoint. Unlike API Key and OAuth credential providers
-     * which require permissions to access external credential stores (Secrets Manager, Token Vault),
-     * IAM role authentication leverages AWS IAM's native authentication without additional resources.
-     * @param role The gateway's execution role (unused - no credential provider permissions needed)
-     * @returns undefined - no additional credential provider permissions to grant
-     */
-    grantNeededPermissionsToRole(role: IRole): Grant | undefined;
-}
+export {};

package/lib/gateway/outbound-auth/oauth.d.ts

@@ -1,5 +1,3 @@
-import { Grant, IRole } from 'aws-cdk-lib/aws-iam';
-import { CredentialProviderType, ICredentialProviderConfig } from './credential-provider';
 /******************************************************************************
  *                                OAuth
  *****************************************************************************/
@@ -45,36 +43,3 @@ export interface OAuthConfiguration {
      */
     readonly customParameters?: Record<string, string>;
 }
-/**
- * OAuth credential provider configuration implementation
- * Can be used with OpenAPI targets
- * @internal
- */
-export declare class OAuthCredentialProviderConfiguration implements ICredentialProviderConfig {
-    readonly credentialProviderType = CredentialProviderType.OAUTH;
-    /**
-     * The ARN of the OAuth provider
-     */
-    readonly providerArn: string;
-    /**
-     * The ARN of the Secrets Manager secret
-     */
-    readonly secretArn: string;
-    /**
-     * The OAuth scopes to request
-     */
-    readonly scopes: string[];
-    /**
-     * Custom parameters for the OAuth flow
-     */
-    readonly customParameters?: Record<string, string>;
-    constructor(configuration: OAuthConfiguration);
-    /**
-     * Grant the needed permissions to the role for OAuth authentication
-     */
-    grantNeededPermissionsToRole(role: IRole): Grant | undefined;
-    /**
-     * @internal
-     */
-    _render(): any;
-}

package/lib/gateway/protocol.d.ts

@@ -1,17 +1,3 @@
-import { CfnGateway } from 'aws-cdk-lib/aws-bedrockagentcore';
-/******************************************************************************
- *                                 Enums
- *****************************************************************************/
-/**
- * The type of protocols
- * @internal
- */
-export declare enum GatewayProtocolType {
-    /**
-     * MCP (Model Context Protocol) protocol type.
-     */
-    MCP = "MCP"
-}
 /******************************************************************************
  *                                Protocol Configuration
  *****************************************************************************/
@@ -23,11 +9,6 @@ export interface IGatewayProtocolConfig {
      * The protocol type
      */
     readonly protocolType: string;
-    /**
-     * Returns internal info as the CFN protocol configuration object
-     * @internal
-     */
-    _render(): any;
 }
 /**
  * Factory class for instantiating Gateway Protocols
@@ -114,8 +95,4 @@ export declare class McpProtocolConfiguration implements IGatewayProtocolConfig
      */
     readonly instructions?: string;
     constructor(props?: McpConfiguration);
-    /**
-     * @internal
-     */
-    _render(): CfnGateway.GatewayProtocolConfigurationProperty;
 }

package/lib/gateway/protocol.js

@@ -21,7 +21,7 @@ var GatewayProtocolType;
  * Factory class for instantiating Gateway Protocols
  */
 class GatewayProtocol {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayProtocol", version: "2.231.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayProtocol", version: "2.232.0-alpha.0" };
     /**
      * Create an MCP protocol configuration
      * @param props - Optional MCP configuration properties
@@ -75,7 +75,7 @@ var McpGatewaySearchType;
  * MCP (Model Context Protocol) configuration implementation
  */
 class McpProtocolConfiguration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.McpProtocolConfiguration", version: "2.231.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.McpProtocolConfiguration", version: "2.232.0-alpha.0" };
     protocolType;
     /**
      * The supported MCP protocol versions

package/lib/gateway/targets/schema/api-schema.d.ts

@@ -42,11 +42,6 @@ export declare abstract class ApiSchema extends TargetSchema {
      */
     readonly bucketOwnerAccountId?: string;
     protected constructor(s3File?: Location, bucketOwnerAccountId?: string, inlineSchema?: string);
-    /**
-     * Format as CFN properties
-     * @internal This is an internal core function and should not be called directly.
-     */
-    abstract _render(): any;
 }
 /**
  * API Schema from a local asset.
@@ -59,11 +54,6 @@ export declare class AssetApiSchema extends ApiSchema {
     private readonly options;
     private asset?;
     constructor(path: string, options?: s3_assets.AssetOptions);
-    /**
-     * Gets the file path for internal validation purposes
-     * @internal
-     */
-    _getFilePath(): string;
     /**
      * Binds this API schema to a construct scope.
      * This method initializes the S3 asset if it hasn't been initialized yet.
@@ -72,11 +62,6 @@ export declare class AssetApiSchema extends ApiSchema {
      * @param scope - The construct scope to bind to
      */
     bind(scope: Construct): void;
-    /**
-     * Format as CFN properties
-     * @internal This is an internal core function and should not be called directly.
-     */
-    _render(): any;
     grantPermissionsToRole(role: IRole): void;
 }
 /**
@@ -87,10 +72,6 @@ export declare class AssetApiSchema extends ApiSchema {
 export declare class InlineApiSchema extends ApiSchema {
     private readonly schema;
     constructor(schema: string);
-    /**
-     * @internal This is an internal core function and should not be called directly.
-     */
-    _render(): any;
     grantPermissionsToRole(_role: IRole): void;
     bind(scope: Construct): void;
 }
@@ -101,10 +82,6 @@ export declare class S3ApiSchema extends ApiSchema {
     private readonly location;
     readonly bucketOwnerAccountId?: string | undefined;
     constructor(location: Location, bucketOwnerAccountId?: string | undefined);
-    /**
-     * @internal This is an internal core function and should not be called directly.
-     */
-    _render(): any;
     bind(scope: Construct): void;
     grantPermissionsToRole(role: IRole): void;
 }

package/lib/gateway/targets/schema/api-schema.js

@@ -24,7 +24,7 @@ class ApiSchemaError extends Error {
  * Represents the concept of an API Schema for a Gateway Target.
  */
 class ApiSchema extends base_schema_1.TargetSchema {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiSchema", version: "2.231.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiSchema", version: "2.232.0-alpha.0" };
     /**
      * Creates an API Schema from a local file.
      * @param path - the path to the local file containing the OpenAPI schema for the action group
@@ -82,7 +82,7 @@ exports.ApiSchema = ApiSchema;
 class AssetApiSchema extends ApiSchema {
     path;
     options;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.AssetApiSchema", version: "2.231.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.AssetApiSchema", version: "2.232.0-alpha.0" };
     asset;
     constructor(path, options = {}) {
         super();
@@ -144,7 +144,7 @@ exports.AssetApiSchema = AssetApiSchema;
  */
 class InlineApiSchema extends ApiSchema {
     schema;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.InlineApiSchema", version: "2.231.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.InlineApiSchema", version: "2.232.0-alpha.0" };
     constructor(schema) {
         super(undefined, undefined, schema);
         this.schema = schema;
@@ -174,7 +174,7 @@ exports.InlineApiSchema = InlineApiSchema;
 class S3ApiSchema extends ApiSchema {
     location;
     bucketOwnerAccountId;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.S3ApiSchema", version: "2.231.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.S3ApiSchema", version: "2.232.0-alpha.0" };
     constructor(location, bucketOwnerAccountId) {
         super(location, bucketOwnerAccountId, undefined);
         this.location = location;

package/lib/gateway/targets/schema/base-schema.d.ts

@@ -1,24 +1 @@
-import { IRole } from 'aws-cdk-lib/aws-iam';
-import { Construct } from 'constructs';
-/**
- * Base abstract class for all schema types used in Bedrock AgentCore Gateway Targets.
- * This provides a common interface for both API schemas and tool schemas.
- * @internal
- */
-export declare abstract class TargetSchema {
-    /**
-     * Format as CFN properties
-     *
-     * @internal This is an internal core function and should not be called directly.
-     */
-    abstract _render(): any;
-    /**
-     * Bind the schema to a construct
-     */
-    abstract bind(scope: Construct): void;
-    /**
-     * Grant permissions to the role
-     *
-     */
-    abstract grantPermissionsToRole(role: IRole): void;
-}
+export {};

package/lib/gateway/targets/schema/tool-schema.d.ts

@@ -3,23 +3,6 @@ import { IBucket, Location } from 'aws-cdk-lib/aws-s3';
 import * as s3_assets from 'aws-cdk-lib/aws-s3-assets';
 import { Construct } from 'constructs';
 import { TargetSchema } from './base-schema';
-/******************************************************************************
- *                                Tool Schema Configuration
- *****************************************************************************/
-/**
- * Abstract interface for tool schema configuration
- * @internal
- */
-export interface IToolSchemaConfiguration {
-    /**
-     * The tool schema configuration type
-     */
-    readonly toolSchemaType: string;
-    /**
-     * The tool schema configuration object
-     */
-    readonly configuration: any;
-}
 /**
  * Schema definition types
  */
@@ -136,11 +119,6 @@ export declare abstract class ToolSchema extends TargetSchema {
      */
     readonly bucketOwnerAccountId?: string;
     protected constructor(s3File?: Location, bucketOwnerAccountId?: string, inlineSchema?: ToolDefinition[]);
-    /**
-     * Format as CFN properties
-     * @internal This is an internal core function and should not be called directly.
-     */
-    abstract _render(): any;
 }
 /**
  * Tool Schema from a local asset.
@@ -161,11 +139,6 @@ export declare class AssetToolSchema extends ToolSchema {
      * @param scope - The construct scope to bind to
      */
     bind(scope: Construct): void;
-    /**
-     * Format as CFN properties
-     * @internal This is an internal core function and should not be called directly.
-     */
-    _render(): any;
     grantPermissionsToRole(role: IRole): void;
 }
 /**
@@ -175,10 +148,6 @@ export declare class AssetToolSchema extends ToolSchema {
 export declare class InlineToolSchema extends ToolSchema {
     private readonly schema;
     constructor(schema: ToolDefinition[]);
-    /**
-     * @internal This is an internal core function and should not be called directly.
-     */
-    _render(): any;
     bind(scope: Construct): void;
     grantPermissionsToRole(_role: IRole): void;
 }
@@ -189,10 +158,6 @@ export declare class S3ToolSchema extends ToolSchema {
     private readonly location;
     readonly bucketOwnerAccountId?: string | undefined;
     constructor(location: Location, bucketOwnerAccountId?: string | undefined);
-    /**
-     * @internal This is an internal core function and should not be called directly.
-     */
-    _render(): any;
     bind(scope: Construct): void;
     grantPermissionsToRole(role: IRole): void;
 }