@aws-cdk/aws-bedrock-agentcore-alpha 2.254.0-alpha.0 → 2.256.0-alpha.0

package/.jsii

@@ -8,8 +8,8 @@
     "url": "https://aws.amazon.com"
   },
   "dependencies": {
-    "@aws-cdk/aws-bedrock-alpha": "2.254.0-alpha.0",
-    "aws-cdk-lib": "^2.254.0",
+    "@aws-cdk/aws-bedrock-alpha": "2.256.0-alpha.0",
+    "aws-cdk-lib": "^2.256.0",
     "constructs": "^10.5.0"
   },
   "dependencyClosure": {
@@ -8991,7 +8991,7 @@
   },
   "name": "@aws-cdk/aws-bedrock-agentcore-alpha",
   "readme": {
-    "markdown": "# Amazon Bedrock AgentCore Construct Library\n\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\n| **Language**                                                                                   | **Package**                             |\n| :--------------------------------------------------------------------------------------------- | --------------------------------------- |\n| ![Typescript Logo](https://docs.aws.amazon.com/cdk/api/latest/img/typescript32.png) TypeScript | `@aws-cdk/aws-bedrock-agentcore-alpha` |\n\n[Amazon Bedrock AgentCore](https://aws.amazon.com/bedrock/agentcore/) enables you to deploy and operate highly capable AI agents securely, at scale. It offers infrastructure purpose-built for dynamic agent workloads, powerful tools to enhance agents, and essential controls for real-world deployment. AgentCore services can be used together or independently and work with any framework including CrewAI, LangGraph, LlamaIndex, and Strands Agents, as well as any foundation model in or outside of Amazon Bedrock, giving you ultimate flexibility. AgentCore eliminates the undifferentiated heavy lifting of building specialized agent infrastructure, so you can accelerate agents to production.\n\nThis construct library facilitates the deployment of Bedrock AgentCore primitives, enabling you to create sophisticated AI applications that can interact with your systems and data sources.\n\n> **Note:** Users need to ensure their CDK deployment role has the `iam:CreateServiceLinkedRole` permission for AgentCore service-linked roles.\n\n## Table of contents\n\n- [Amazon Bedrock AgentCore Construct Library](#amazon-bedrock-agentcore-construct-library)\n  - [Table of contents](#table-of-contents)\n  - [AgentCore Runtime](#agentcore-runtime)\n    - [Runtime Endpoints](#runtime-endpoints)\n    - [AgentCore Runtime Properties](#agentcore-runtime-properties)\n    - [Runtime Endpoint Properties](#runtime-endpoint-properties)\n    - [Creating a Runtime](#creating-a-runtime)\n      - [Option 1: Use an existing image in ECR](#option-1-use-an-existing-image-in-ecr)\n      - [Option 2: Use a local asset](#option-2-use-a-local-asset)\n      - [Option 3: Use direct code deployment](#option-3-use-direct-code-deployment)\n      - [Option 4: Use an ECR container image URI](#option-4-use-an-ecr-container-image-uri)\n    - [Granting Permissions to Invoke Bedrock Models or Inference Profiles](#granting-permissions-to-invoke-bedrock-models-or-inference-profiles)\n    - [Runtime Versioning](#runtime-versioning)\n      - [Managing Endpoints and Versions](#managing-endpoints-and-versions)\n        - [Step 1: Initial Deployment](#step-1-initial-deployment)\n        - [Step 2: Creating Custom Endpoints](#step-2-creating-custom-endpoints)\n        - [Step 3: Runtime Update Deployment](#step-3-runtime-update-deployment)\n        - [Step 4: Testing with Staging Endpoints](#step-4-testing-with-staging-endpoints)\n        - [Step 5: Promoting to Production](#step-5-promoting-to-production)\n    - [Creating Standalone Runtime Endpoints](#creating-standalone-runtime-endpoints)\n      - [Example: Creating an endpoint for an existing runtime](#example-creating-an-endpoint-for-an-existing-runtime)\n    - [Runtime Authentication Configuration](#runtime-authentication-configuration)\n      - [IAM Authentication (Default)](#iam-authentication-default)\n      - [Cognito Authentication](#cognito-authentication)\n      - [JWT Authentication](#jwt-authentication)\n      - [OAuth Authentication](#oauth-authentication)\n      - [Using a Custom IAM Role](#using-a-custom-iam-role)\n    - [Runtime Network Configuration](#runtime-network-configuration)\n      - [Public Network Mode (Default)](#public-network-mode-default)\n      - [VPC Network Mode](#vpc-network-mode)\n      - [Managing Security Groups with VPC Configuration](#managing-security-groups-with-vpc-configuration)\n    - [Runtime IAM Permissions](#runtime-iam-permissions)\n    - [Other configuration](#other-configuration)\n      - [Lifecycle configuration](#lifecycle-configuration)\n      - [Request header configuration](#request-header-configuration)\n  - [Browser](#browser)\n    - [Browser Network modes](#browser-network-modes)\n    - [Browser Properties](#browser-properties)\n    - [Basic Browser Creation](#basic-browser-creation)\n    - [Browser with Tags](#browser-with-tags)\n    - [Browser with VPC](#browser-with-vpc)\n    - [Browser with Recording Configuration](#browser-with-recording-configuration)\n    - [Browser with Custom Execution Role](#browser-with-custom-execution-role)\n    - [Browser with S3 Recording and Permissions](#browser-with-s3-recording-and-permissions)\n    - [Browser with Browser signing](#browser-with-browser-signing)\n    - [Browser IAM Permissions](#browser-iam-permissions)\n  - [Code Interpreter](#code-interpreter)\n    - [Code Interpreter Network Modes](#code-interpreter-network-modes)\n    - [Code Interpreter Properties](#code-interpreter-properties)\n    - [Basic Code Interpreter Creation](#basic-code-interpreter-creation)\n    - [Code Interpreter with VPC](#code-interpreter-with-vpc)\n    - [Code Interpreter with Sandbox Network Mode](#code-interpreter-with-sandbox-network-mode)\n    - [Code Interpreter with Custom Execution Role](#code-interpreter-with-custom-execution-role)\n    - [Code Interpreter IAM Permissions](#code-interpreter-iam-permissions)\n    - [Code interpreter with tags](#code-interpreter-with-tags)\n  - [Gateway](#gateway)\n    - [Gateway Properties](#gateway-properties)\n    - [Basic Gateway Creation](#basic-gateway-creation)\n    - [Protocol configuration](#protocol-configuration)\n    - [Inbound authorization](#inbound-authorization)\n    - [Gateway with KMS Encryption](#gateway-with-kms-encryption)\n    - [Gateway with Custom Execution Role](#gateway-with-custom-execution-role)\n    - [Gateway IAM Permissions](#gateway-iam-permissions)\n  - [Gateway Target](#gateway-target)\n    - [Gateway Target Properties](#gateway-target-properties)\n    - [Targets types](#targets-types)\n    - [Understanding Tool Naming](#understanding-tool-naming)\n    - [Tools schema For Lambda target](#tools-schema-for-lambda-target)\n    - [Api schema For OpenAPI and Smithy target](#api-schema-for-openapi-and-smithy-target)\n    - [Outbound auth](#outbound-auth)\n      - [Token Vault credential providers](#token-vault-credential-providers)\n      - [Workload identities](#workload-identities)\n    - [Basic Gateway Target Creation](#basic-gateway-target-creation)\n      - [Using addTarget methods (Recommended)](#using-addtarget-methods-recommended)\n      - [Using static factory methods](#using-static-factory-methods)\n    - [Advanced Usage: Direct Configuration for gateway target](#advanced-usage-direct-configuration-for-gateway-target)\n      - [Configuration Factory Methods](#configuration-factory-methods)\n      - [Example: Lambda Target with Custom Configuration](#example-lambda-target-with-custom-configuration)\n    - [Gateway Target IAM Permissions](#gateway-target-iam-permissions)\n  - [Memory](#memory)\n    - [Memory Properties](#memory-properties)\n    - [Basic Memory Creation](#basic-memory-creation)\n    - [LTM Memory Extraction Stategies](#ltm-memory-extraction-stategies)\n    - [Memory with Built-in Strategies](#memory-with-built-in-strategies)\n    - [Memory with custom Strategies](#memory-with-custom-strategies)\n      - [Memory with Custom Execution Role](#memory-with-custom-execution-role)\n    - [Memory with self-managed Strategies](#memory-with-self-managed-strategies)\n    - [Memory Strategy Methods](#memory-strategy-methods)\n  - [Policy](#policy)\n    - [PolicyEngine Properties](#policyengine-properties)\n    - [Policy Properties](#policy-properties)\n    - [Basic PolicyEngine and Policy Creation](#basic-policyengine-and-policy-creation)\n    - [Associating a Policy Engine with a Gateway](#associating-a-policy-engine-with-a-gateway)\n    - [Type-Safe Policy Builder](#type-safe-policy-builder)\n    - [PolicyEngine with KMS Encryption](#policyengine-with-kms-encryption)\n    - [Policy Validation Modes](#policy-validation-modes)\n  - [Online Evaluation](#online-evaluation)\n    - [Online Evaluation Properties](#online-evaluation-properties)\n    - [Basic Online Evaluation Creation](#basic-online-evaluation-creation)\n    - [Built-in Evaluators](#built-in-evaluators)\n    - [Custom Evaluators](#custom-evaluators)\n      - [LLM-as-a-Judge Evaluator](#llm-as-a-judge-evaluator)\n      - [Code-Based Evaluator](#code-based-evaluator)\n      - [Using Custom Evaluators with Online Evaluation](#using-custom-evaluators-with-online-evaluation)\n    - [Data Source Configuration](#data-source-configuration)\n    - [Sampling and Filtering](#sampling-and-filtering)\n    - [Online Evaluation with Custom Execution Role](#online-evaluation-with-custom-execution-role)\n    - [Online Evaluation IAM Permissions](#online-evaluation-iam-permissions)\n\n## AgentCore Runtime\n\nThe AgentCore Runtime construct enables you to deploy containerized agents on Amazon Bedrock AgentCore.\nThis L2 construct simplifies runtime creation just pass your ECR repository name\nand the construct handles all the configuration with sensible defaults.\n\n### Runtime Endpoints\n\nEndpoints provide a stable way to invoke specific versions of your agent runtime, enabling controlled deployments across different environments.\nWhen you create an agent runtime, Amazon Bedrock AgentCore automatically creates a \"DEFAULT\" endpoint which always points to the latest version\nof runtime.\n\nYou can create additional endpoints in two ways:\n\n1. **Using Runtime.addEndpoint()** - Convenient method when creating endpoints alongside the runtime.\n2. **Using RuntimeEndpoint** - Flexible approach for existing runtimes.\n\nFor example, you might keep a \"production\" endpoint on a stable version while testing newer versions\nthrough a \"staging\" endpoint. This separation allows you to test changes thoroughly before promoting them\nto production by simply updating the endpoint to point to the newer version.\n\n### AgentCore Runtime Properties\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `runtimeName` | `string` | No | The name of the agent runtime. Valid characters are a-z, A-Z, 0-9, _ (underscore). Must start with a letter and can be up to 48 characters long. If not provided, a unique name will be auto-generated |\n| `agentRuntimeArtifact` | `AgentRuntimeArtifact` | Yes | The artifact configuration for the agent runtime containing the container configuration with ECR URI |\n| `executionRole` | `iam.IRole` | No | The IAM role that provides permissions for the agent runtime. If not provided, a role will be created automatically |\n| `networkConfiguration` | `NetworkConfiguration` | No | Network configuration for the agent runtime. Defaults to `RuntimeNetworkConfiguration.usingPublicNetwork()` |\n| `description` | `string` | No | Optional description for the agent runtime |\n| `protocolConfiguration` | `ProtocolType` | No | Protocol configuration for the agent runtime. Defaults to `ProtocolType.HTTP` |\n| `authorizerConfiguration` | `RuntimeAuthorizerConfiguration` | No | Authorizer configuration for the agent runtime. Use `RuntimeAuthorizerConfiguration` static methods to create configurations for IAM, Cognito, JWT, or OAuth authentication |\n| `environmentVariables` | `{ [key: string]: string }` | No | Environment variables for the agent runtime. Maximum 50 environment variables |\n| `tags` | `{ [key: string]: string }` | No | Tags for the agent runtime. A list of key:value pairs of tags to apply to this Runtime resource |\n| `lifecycleConfiguration` | LifecycleConfiguration | No | The life cycle configuration for the AgentCore Runtime. Defaults to 900 seconds (15 minutes) for idle, 28800 seconds (8 hours) for max life time |\n| `requestHeaderConfiguration` | RequestHeaderConfiguration | No | Configuration for HTTP request headers that will be passed through to the runtime. Defaults to no configuration |\n\n### Runtime Endpoint Properties\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `endpointName` | `string` | No | The name of the runtime endpoint. Valid characters are a-z, A-Z, 0-9, _ (underscore). Must start with a letter and can be up to 48 characters long. If not provided, a unique name will be auto-generated |\n| `agentRuntimeId` | `string` | Yes | The Agent Runtime ID for this endpoint |\n| `agentRuntimeVersion` | `string` | Yes | The Agent Runtime version for this endpoint. Must be between 1 and 5 characters long.|\n| `description` | `string` | No | Optional description for the runtime endpoint |\n| `tags` | `{ [key: string]: string }` | No | Tags for the runtime endpoint |\n\n### Creating a Runtime\n\n#### Option 1: Use an existing image in ECR\n\nReference an image available within ECR.\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\n\n// The runtime by default create ECR permission only for the repository available in the account the stack is being deployed\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\n// Create runtime using the built image\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact\n});\n```\n\n#### Option 2: Use a local asset\n\nReference a local directory containing a Dockerfile.\nImages are built from a local Docker context directory (with a Dockerfile), uploaded to Amazon Elastic Container Registry (ECR)\nby the CDK toolkit,and can be naturally referenced in your CDK app.\n\n```typescript fixture=default\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromAsset(\n  path.join(__dirname, \"path to agent dockerfile directory\")\n);\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n});\n```\n\n#### Option 3: Use direct code deployment\n\nWith the container deployment method, developers create a Dockerfile, build ARM-compatible containers, manage ECR repositories, and upload containers for code changes. This works well where container DevOps pipelines have already been established to automate deployments.\n\nHowever, customers looking for fully managed deployments can benefit from direct code deployment, which can significantly improve developer time and productivity. Direct code deployment provides a secure and scalable path forward for rapid prototyping agent capabilities to deploying production workloads at scale.\n\nWith direct code deployment, developers create a zip archive of code and dependencies, upload to Amazon S3, and configure the bucket in the agent configuration. A ZIP archive containing Linux arm64 dependencies needs to be uploaded to S3 as a pre-requisite to Create Agent Runtime.\n\nFor more information, please refer to the [documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-get-started-code-deploy.html).\n\n```typescript fixture=default\n// S3 bucket containing the agent core\nconst codeBucket = new s3.Bucket(this, \"AgentCode\", {\n  bucketName: \"my-code-bucket\",\n  removalPolicy: RemovalPolicy.DESTROY, // For demo purposes\n});\n\n// the bucket above needs to contain the agent code\n\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromS3(\n  {\n    bucketName: codeBucket.bucketName,\n    objectKey: 'deployment_package.zip',\n  },\n  agentcore.AgentCoreRuntime.PYTHON_3_12,\n  ['opentelemetry-instrument', 'main.py']\n);\n\nconst runtimeInstance = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n});\n```\n\nAlternatively, you can use local code assets that will be automatically packaged and uploaded to a CDK-managed S3 bucket:\n\n```typescript fixture=default\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromCodeAsset({\n  path: path.join(__dirname, 'path/to/agent/code'),\n  runtime: agentcore.AgentCoreRuntime.PYTHON_3_12,\n  entrypoint: ['opentelemetry-instrument', 'main.py'],\n});\n\nconst runtimeInstance = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n});\n```\n\n#### Option 4: Use an ECR container image URI\n\nReference an ECR container image directly by its URI. This is useful when you have a pre-existing ECR image URI from CloudFormation parameters or cross-stack references. No IAM permissions are automatically granted - you must ensure the runtime has ECR pull permissions.\n\n```typescript fixture=default\n// Direct URI reference\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromImageUri(\n  \"123456789012.dkr.ecr.us-east-1.amazonaws.com/my-agent:v1.0.0\"\n);\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n});\n```\n\nYou can also use CloudFormation parameters or references:\n\n```typescript fixture=default\n// Using a CloudFormation parameter\nconst imageUriParam = new cdk.CfnParameter(this, \"ImageUri\", {\n  type: \"String\",\n  description: \"Container image URI for the agent runtime\",\n});\n\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromImageUri(\n  imageUriParam.valueAsString\n);\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n});\n```\n\n### Granting Permissions to Invoke Bedrock Models or Inference Profiles\n\nTo grant the runtime permissions to invoke Bedrock models or inference profiles:\n\n```typescript fixture=default\n// Note: This example uses @aws-cdk/aws-bedrock-alpha which must be installed separately\ndeclare const runtime: agentcore.Runtime;\n\n// Define the Bedrock Foundation Model\nconst model = bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_7_SONNET_V1_0;\n\n// Grant the runtime permissions to invoke the model\nmodel.grantInvoke(runtime);\n\n// Create a cross-region inference profile for Claude 3.7 Sonnet\nconst inferenceProfile = bedrock.CrossRegionInferenceProfile.fromConfig({\n  geoRegion: bedrock.CrossRegionInferenceProfileRegion.US,\n  model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_7_SONNET_V1_0\n});\n\n// Grant the runtime permissions to invoke the inference profile\ninferenceProfile.grantInvoke(runtime);\n```\n\n### Runtime Versioning\n\nAmazon Bedrock AgentCore automatically manages runtime versioning to ensure safe deployments and rollback capabilities.\nWhen you create an agent runtime, AgentCore automatically creates version 1 (V1). Each subsequent update to the\nruntime configuration (such as updating the container image, modifying network settings, or changing protocol configurations)\ncreates a new immutable version. These versions contain complete, self-contained configurations that can be referenced by endpoints,\nallowing you to maintain different versions for different environments or gradually roll out updates.\n\n#### Managing Endpoints and Versions\n\nAmazon Bedrock AgentCore automatically manages runtime versioning to provide safe deployments and rollback capabilities. You can follow\nthe steps below to understand how to use versioning with runtime for controlled deployments across different environments.\n\n##### Step 1: Initial Deployment\n\nWhen you first create an agent runtime, AgentCore automatically creates Version 1 of your runtime. At this point, a DEFAULT endpoint is\nautomatically created that points to Version 1. This DEFAULT endpoint serves as the main access point for your runtime.\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\"),\n});\n```\n\n##### Step 2: Creating Custom Endpoints\n\nAfter the initial deployment, you can create additional endpoints for different environments. For example, you might create a \"production\"\nendpoint that explicitly points to Version 1. This allows you to maintain stable access points for specific environments while keeping the\nflexibility to test newer versions elsewhere.\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\"),\n});\n\nconst prodEndpoint = runtime.addEndpoint(\"production\", {\n  version: \"1\",\n  description: \"Stable production endpoint - pinned to v1\"\n});\n```\n\n##### Step 3: Runtime Update Deployment\n\nWhen you update the runtime configuration (such as updating the container image, modifying network settings, or changing protocol\nconfigurations), AgentCore automatically creates a new version (Version 2). Upon this update:\n\n- Version 2 is created automatically with the new configuration\n- The DEFAULT endpoint automatically updates to point to Version 2\n- Any explicitly pinned endpoints (like the production endpoint) remain on their specified versions\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\n\nconst agentRuntimeArtifactNew = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v2.0.0\");\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifactNew,\n});\n```\n\n##### Step 4: Testing with Staging Endpoints\n\nOnce Version 2 exists, you can create a staging endpoint that points to the new version. This staging endpoint allows you to test the\nnew version in a controlled environment before promoting it to production. This separation ensures that production traffic continues\nto use the stable version while you validate the new version.\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\n\nconst agentRuntimeArtifactNew = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v2.0.0\");\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifactNew,\n});\n\nconst stagingEndpoint = runtime.addEndpoint(\"staging\", {\n  version: \"2\",\n  description: \"Staging environment for testing new version\"\n});\n```\n\n##### Step 5: Promoting to Production\n\nAfter thoroughly testing the new version through the staging endpoint, you can update the production endpoint to point to Version 2.\nThis controlled promotion process ensures that you can validate changes before they affect production traffic.\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\n\nconst agentRuntimeArtifactNew = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v2.0.0\");\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifactNew,\n});\n\nconst prodEndpoint = runtime.addEndpoint(\"production\", {\n  version: \"2\",  // New version added here\n  description: \"Stable production endpoint\"\n});\n```\n\n### Creating Standalone Runtime Endpoints\n\nRuntimeEndpoint can also be created as a standalone resource.\n\n#### Example: Creating an endpoint for an existing runtime\n\n```typescript fixture=default\n// Reference an existing runtime by its ID\nconst existingRuntimeId = \"abc123-runtime-id\"; // The ID of an existing runtime\n\n// Create a standalone endpoint\nconst endpoint = new agentcore.RuntimeEndpoint(this, \"MyEndpoint\", {\n  endpointName: \"production\",\n  agentRuntimeId: existingRuntimeId,\n  agentRuntimeVersion: \"1\", // Specify which version to use\n  description: \"Production endpoint for existing runtime\"\n});\n```\n\n### Runtime Authentication Configuration\n\nThe AgentCore Runtime supports multiple authentication modes to secure access to your agent endpoints. Authentication is configured during runtime creation using the `RuntimeAuthorizerConfiguration` class's static factory methods.\n\n#### IAM Authentication (Default)\n\nIAM authentication is the default mode, when no authorizerConfiguration is set then the underlying service use IAM.\n\n#### Cognito Authentication\n\nTo configure AWS Cognito User Pool authentication:\n\n```typescript fixture=default\ndeclare const userPool: cognito.UserPool;\ndeclare const userPoolClient: cognito.UserPoolClient;\ndeclare const anotherUserPoolClient: cognito.UserPoolClient;\n\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\n// Optional: Create custom claims for additional validation\nconst customClaims = [\n  agentcore.RuntimeCustomClaim.withStringValue('department', 'engineering'),\n  agentcore.RuntimeCustomClaim.withStringArrayValue('roles', ['admin'], agentcore.CustomClaimOperator.CONTAINS),\n  agentcore.RuntimeCustomClaim.withStringArrayValue('permissions', ['read', 'write'], agentcore.CustomClaimOperator.CONTAINS_ANY),\n];\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingCognito(\n    userPool, // User Pool (required)\n    [userPoolClient, anotherUserPoolClient], // User Pool Clients\n    [\"audience1\"], // Allowed Audiences (optional)\n    [\"read\", \"write\"], // Allowed Scopes (optional)\n    customClaims, // Custom claims (optional) - see Custom Claims Validation section\n  ),\n});\n```\n\nYou can configure:\n\n- User Pool: The Cognito User Pool that issues JWT tokens\n- User Pool Clients: One or more Cognito User Pool App Clients that are allowed to access the runtime\n- Allowed audiences: Used to validate that the audiences specified in the Cognito token match or are a subset of the audiences specified in the AgentCore Runtime\n- Allowed scopes: Allow access only if the token contains at least one of the required scopes configured here\n- Custom claims: A set of rules to match specific claims in the incoming token against predefined values for validating JWT tokens\n\n#### JWT Authentication\n\nTo configure custom JWT authentication with your own OpenID Connect (OIDC) provider:\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingJWT(\n    \"https://example.com/.well-known/openid-configuration\",  // Discovery URL (required)\n    [\"client1\", \"client2\"],  // Allowed Client IDs (optional)\n    [\"audience1\"],           // Allowed Audiences (optional)\n    [\"read\", \"write\"],       // Allowed Scopes (optional)\n    // Custom claims (optional) - see Custom Claims Validation section below\n  ),\n});\n```\n\nYou can configure:\n\n- Discovery URL: Enter the Discovery URL from your identity provider (e.g. Okta, Cognito, etc.), typically found in that provider's documentation. This allows your Agent or Tool to fetch login, downstream resource token, and verification settings.\n- Allowed audiences: This is used to validate that the audiences specified for the OAuth token matches or are a subset of the audiences specified in the AgentCore Runtime.\n- Allowed clients: This is used to validate that the public identifier of the client, as specified in the authorization token, is allowed to access the AgentCore Runtime.\n- Allowed scopes: Allow access only if the token contains at least one of the required scopes configured here.\n- Custom claims: A set of rules to match specific claims in the incoming token against predefined values for validating JWT tokens.\n\n**Note**: The discovery URL must end with `/.well-known/openid-configuration`.\n\n##### Custom Claims Validation\n\nCustom claims allow you to validate additional fields in JWT tokens beyond the standard audience, client, and scope validations. You can create custom claims using the `RuntimeCustomClaim` class:\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\n// String claim - validates that the claim exactly equals the specified value\n// Uses EQUALS operator automatically\nconst departmentClaim = agentcore.RuntimeCustomClaim.withStringValue('department', 'engineering');\n\n// String array claim with CONTAINS operator (default)\n// Validates that the claim array contains a specific string value\n// IMPORTANT: CONTAINS requires exactly one value in the array parameter\nconst rolesClaim = agentcore.RuntimeCustomClaim.withStringArrayValue('roles', ['admin']);\n\n// String array claim with CONTAINS_ANY operator\n// Validates that the claim array contains at least one of the specified values\n// Use this when you want to check for multiple possible values\nconst permissionsClaim = agentcore.RuntimeCustomClaim.withStringArrayValue(\n  'permissions',\n  ['read', 'write'],\n  agentcore.CustomClaimOperator.CONTAINS_ANY\n);\n\n// Use custom claims in authorizer configuration\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingJWT(\n    \"https://example.com/.well-known/openid-configuration\",\n    [\"client1\", \"client2\"],\n    [\"audience1\"],\n    [\"read\", \"write\"],\n    [departmentClaim, rolesClaim, permissionsClaim] // Custom claims\n  ),\n});\n```\n\n**Custom Claim Rules**:\n\n- **String claims**: Must use the `EQUALS` operator (automatically set). The claim value must exactly match the specified string.\n- **String array claims**: Can use `CONTAINS` (default) or `CONTAINS_ANY` operators:\n  - **`CONTAINS`**: Checks if the claim array contains a specific string value. **Requires exactly one value** in the array parameter. For example, `['admin']` will check if the token's claim array contains the string `'admin'`.\n  - **`CONTAINS_ANY`**: Checks if the claim array contains at least one of the provided string values. Use this when you want to validate against multiple possible values. For example, `['read', 'write']` will check if the token's claim array contains either `'read'` or `'write'`.\n\n**Example Use Cases**:\n\n- Use `CONTAINS` when you need to verify a user has a specific role: `RuntimeCustomClaim.withStringArrayValue('roles', ['admin'])`\n- Use `CONTAINS_ANY` when you need to verify a user has any of several permissions: `RuntimeCustomClaim.withStringArrayValue('permissions', ['read', 'write'], CustomClaimOperator.CONTAINS_ANY)`\n\n#### OAuth Authentication\n\nTo configure OAuth 2.0 authentication:\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingOAuth(\n    \"https://github.com/.well-known/openid-configuration\",  // Discovery URL (required)\n    \"oauth_client_123\",  // OAuth Client ID (required)\n    [\"audience1\"],       // Allowed Audiences (optional)\n    [\"openid\", \"profile\"], // Allowed Scopes (optional)\n    // Custom claims (optional) - see Custom Claims Validation section\n  ),\n});\n```\n\n#### Using a Custom IAM Role\n\nInstead of using the auto-created execution role, you can provide your own IAM role with specific permissions:\nThe auto-created role includes all necessary baseline permissions for ECR access, CloudWatch logging, and X-Ray tracing. When providing a custom role, ensure these permissions are included.\n\n### Runtime Network Configuration\n\nThe AgentCore Runtime supports two network modes for deployment:\n\n#### Public Network Mode (Default)\n\nBy default, runtimes are deployed in PUBLIC network mode, which provides internet access suitable for less sensitive or open-use scenarios:\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\n// Explicitly using public network (this is the default)\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  networkConfiguration: agentcore.RuntimeNetworkConfiguration.usingPublicNetwork(),\n});\n```\n\n#### VPC Network Mode\n\nFor enhanced security and network isolation, you can deploy your runtime within a VPC:\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\n// Create or use an existing VPC\nconst vpc = new ec2.Vpc(this, 'MyVpc', {\n  maxAzs: 2,\n});\n\n// Configure runtime with VPC\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  networkConfiguration: agentcore.RuntimeNetworkConfiguration.usingVpc(this, {\n    vpc: vpc,\n    vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },\n    // Optionally specify security groups, or one will be created automatically\n    // securityGroups: [mySecurityGroup],\n  }),\n});\n\n```\n\n#### Managing Security Groups with VPC Configuration\n\nWhen using VPC mode, the Runtime implements `ec2.IConnectable`, allowing you to manage network access using the `connections` property:\n\n```typescript fixture=default\nconst vpc = new ec2.Vpc(this, 'MyVpc', {\n  maxAzs: 2,\n});\n\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\n// Create runtime with VPC configuration\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  networkConfiguration: agentcore.RuntimeNetworkConfiguration.usingVpc(this, {\n    vpc: vpc,\n    vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },\n  }),\n});\n\n// Now you can manage network access using the connections property\n// Allow inbound HTTPS traffic from a specific security group\nconst webServerSecurityGroup = new ec2.SecurityGroup(this, 'WebServerSG', { vpc });\nruntime.connections.allowFrom(webServerSecurityGroup, ec2.Port.tcp(443), 'Allow HTTPS from web servers');\n\n// Allow outbound connections to a database\nconst databaseSecurityGroup = new ec2.SecurityGroup(this, 'DatabaseSG', { vpc });\nruntime.connections.allowTo(databaseSecurityGroup, ec2.Port.tcp(5432), 'Allow PostgreSQL connection');\n\n// Allow outbound HTTPS to anywhere (for external API calls)\nruntime.connections.allowToAnyIpv4(ec2.Port.tcp(443), 'Allow HTTPS outbound');\n```\n\n### Runtime IAM Permissions\n\nThe Runtime construct provides convenient methods for granting IAM permissions to principals that need to invoke the runtime or manage its execution role.\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\n// Create a runtime\nconst runtime = new agentcore.Runtime(this, \"MyRuntime\", {\n  runtimeName: \"my_runtime\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n});\n\n// Create a Lambda function that needs to invoke the runtime\nconst invokerFunction = new lambda.Function(this, \"InvokerFunction\", {\n  runtime: lambda.Runtime.PYTHON_3_12,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\nimport boto3\ndef handler(event, context):\n    client = boto3.client('bedrock-agentcore')\n    # Invoke the runtime...\n  `),\n});\n\n// Grant permission to invoke the runtime directly\nruntime.grantInvokeRuntime(invokerFunction);\n\n// Grant permission to invoke the runtime on behalf of a user\n// (requires X-Amzn-Bedrock-AgentCore-Runtime-User-Id header)\nruntime.grantInvokeRuntimeForUser(invokerFunction);\n\n// Grant both invoke permissions (most common use case)\nruntime.grantInvoke(invokerFunction);\n\n// Grant specific custom permissions to the runtime's execution role\nruntime.grant(['bedrock:InvokeModel'], ['arn:aws:bedrock:*:*:*']);\n\n// Add a policy statement to the runtime's execution role\nruntime.addToRolePolicy(new iam.PolicyStatement({\n  actions: ['s3:GetObject'],\n  resources: ['arn:aws:s3:::my-bucket/*'],\n}));\n```\n\n### Other configuration\n\n#### Lifecycle configuration\n\nThe LifecycleConfiguration input parameter to CreateAgentRuntime lets you manage the lifecycle of runtime sessions and resources in Amazon Bedrock AgentCore Runtime. This configuration helps optimize resource utilization by automatically cleaning up idle sessions and preventing long-running instances from consuming resources indefinitely.\n\nYou can configure:\n\n- idleRuntimeSessionTimeout: Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will trigger termination. Termination can last up to 15 seconds due to logging and other process completion. Default: 900 seconds (15 minutes)\n- maxLifetime: Maximum lifetime for the instance in seconds. Once reached, instances will initialize termination. Termination can last up to 15 seconds due to logging and other process completion. Default: 28800 seconds (8 hours)\n\nFor additional information, please refer to the [documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-lifecycle-settings.html).\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\n\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\nnew agentcore.Runtime(this, 'test-runtime', {\n  runtimeName: 'test_runtime',\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  lifecycleConfiguration: {\n    idleRuntimeSessionTimeout: Duration.minutes(10),\n    maxLifetime: Duration.hours(4),\n  },\n});\n```\n\n#### Request header configuration\n\nCustom headers let you pass contextual information from your application directly to your agent code without cluttering the main request payload. This includes authentication tokens like JWT (JSON Web Tokens, which contain user identity and authorization claims) through the Authorization header, allowing your agent to make decisions based on who is calling it. You can also pass custom metadata like user preferences, session identifiers, or trace context using headers prefixed with X-Amzn-Bedrock-AgentCore-Runtime-Custom-, giving your agent access to up to 20 pieces of runtime context that travel alongside each request. This information can be also used in downstream systems like AgentCore Memory that you can namespace based on those characteristics like user_id or aud in claims like line of business.\n\nFor additional information, please refer to the [documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-header-allowlist.html).\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\n\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\nnew agentcore.Runtime(this, 'test-runtime', {\n  runtimeName: 'test_runtime',\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  requestHeaderConfiguration: {\n    allowlistedHeaders: ['X-Amzn-Bedrock-AgentCore-Runtime-Custom-H1'],\n  },\n});\n```\n\n#### Observability configuration\n\nThe Runtime construct supports observability features including X-Ray tracing and logging to CloudWatch Logs, S3, or Kinesis Data Firehose. This allows you to monitor and debug your agent runtime invocations.\n\nYou can configure:\n\n- tracingEnabled: Enable X-Ray tracing for the runtime\n- loggingConfigs: Send APPLICATION_LOGS (agent runtime invocations) and USAGE_LOGS (session-level resource consumption) to CloudWatch Logs, S3, or Kinesis Data Firehose\n\nFor additional information, please refer to the [Set up logging and tracing for AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability.html).\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, 'TestRepository', {\n  repositoryName: 'test-agent-runtime',\n});\n\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, 'v1.0.0');\n\n// Create logging destinations\nconst logGroup = new logs.LogGroup(this, 'RuntimeLogGroup');\nconst logBucket = new s3.Bucket(this, 'RuntimeLogBucket');\nconst firehoseStream = new firehose.DeliveryStream(this, 'RuntimeLogStream', {\n  destination: new firehose.S3Bucket(logBucket),\n});\n\nnew agentcore.Runtime(this, 'test-runtime', {\n  runtimeName: 'test_runtime',\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  tracingEnabled: true,\n  loggingConfigs: [\n    {\n      logType: agentcore.LogType.APPLICATION_LOGS,\n      destination: agentcore.LoggingDestination.cloudWatchLogs(logGroup),\n    },\n    {\n      logType: agentcore.LogType.APPLICATION_LOGS,\n      destination: agentcore.LoggingDestination.s3(logBucket),\n    },\n    {\n      logType: agentcore.LogType.APPLICATION_LOGS,\n      destination: agentcore.LoggingDestination.firehose(firehoseStream),\n    },\n  ],\n});\n```\n\n## Browser\n\nThe Amazon Bedrock AgentCore Browser provides a secure, cloud-based browser that enables AI agents to interact with websites. It includes security features such as session isolation, built-in observability through live viewing, CloudTrail logging, and session replay capabilities.\n\nAdditional information about the browser tool can be found in the [official documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser-tool.html)\n\n### Browser Network modes\n\nThe Browser construct supports the following network modes:\n\n1. **Public Network Mode** (`BrowserNetworkMode.usingPublicNetwork()`) - Default\n\n   - Allows internet access for web browsing and external API calls\n   - Suitable for scenarios where agents need to interact with publicly available websites\n   - Enables full web browsing capabilities\n   - VPC mode is not supported with this option\n\n2. **VPC (Virtual Private Cloud)** (`BrowserNetworkMode.usingVpc()`)\n\n   - Select whether to run the browser in a virtual private cloud (VPC).\n   - By configuring VPC connectivity, you enable secure access to private resources such as databases, internal APIs, and services within your VPC.\n\n    While the VPC itself is mandatory, these are optional:\n    - Subnets - if not provided, CDK will select appropriate subnets from the VPC\n    - Security Groups - if not provided, CDK will create a default security group\n    - Specific subnet selection criteria - you can let CDK choose automatically\n\nFor more information on VPC connectivity for Amazon Bedrock AgentCore Browser, please refer to the [official documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html).\n\n### Browser Properties\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `browserCustomName` | `string` | No | The name of the browser. Must start with a letter and can be up to 48 characters long. Pattern: `[a-zA-Z][a-zA-Z0-9_]{0,47}`. If not provided, a unique name will be auto-generated |\n| `description` | `string` | No | Optional description for the browser. Can have up to 200 characters |\n| `networkConfiguration` | `BrowserNetworkConfiguration` | No | Network configuration for browser. Defaults to PUBLIC network mode |\n| `recordingConfig` | `RecordingConfig` | No | Recording configuration for browser. Defaults to no recording |\n| `executionRole` | `iam.IRole` | No | The IAM role that provides permissions for the browser to access AWS services. A new role will be created if not provided |\n| `tags` | `{ [key: string]: string }` | No | Tags to apply to the browser resource |\n| `browserSigning` | BrowserSigning | No | Browser signing configuration. Defaults to DISABLED |\n\n### Basic Browser Creation\n\n```typescript fixture=default\n// Create a basic browser with public network access\nconst browser = new agentcore.BrowserCustom(this, \"MyBrowser\", {\n  browserCustomName: \"my_browser\",\n  description: \"A browser for web automation\",\n});\n```\n\n### Browser with Tags\n\n```typescript fixture=default\n// Create a browser with custom tags\nconst browser = new agentcore.BrowserCustom(this, \"MyBrowser\", {\n  browserCustomName: \"my_browser\",\n  description: \"A browser for web automation with tags\",\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingPublicNetwork(),\n  tags: {\n    Environment: \"Production\",\n    Team: \"AI/ML\",\n    Project: \"AgentCore\",\n  },\n});\n```\n\n### Browser with VPC\n\n```typescript fixture=default\nconst browser = new agentcore.BrowserCustom(this, 'BrowserVpcWithRecording', {\n  browserCustomName: 'browser_recording',\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingVpc(this, {\n    vpc: new ec2.Vpc(this, 'VPC', { restrictDefaultSecurityGroup: false }),\n  }),\n});\n```\n\nBrowser exposes a [connections](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Connections.html) property. This property returns a connections object, which simplifies the process of defining and managing ingress and egress rules for security groups in your AWS CDK applications. Instead of directly manipulating security group rules, you interact with the Connections object of a construct, which then translates your connectivity requirements into the appropriate security group rules. For instance:\n\n```typescript fixture=default\nconst vpc = new ec2.Vpc(this, 'testVPC');\n\nconst browser = new agentcore.BrowserCustom(this, 'test-browser', {\n  browserCustomName: 'test_browser',\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingVpc(this, {\n    vpc: vpc,\n  }),\n});\n\nbrowser.connections.addSecurityGroup(new ec2.SecurityGroup(this, 'AdditionalGroup', { vpc }));\n```\n\nSo security groups can be added after the browser construct creation. You can use methods like allowFrom() and allowTo() to grant ingress access to/egress access from a specified peer over a given portRange. The Connections object automatically adds the necessary ingress or egress rules to the security group(s) associated with the calling construct.\n\n### Browser with Recording Configuration\n\n```typescript fixture=default\n// Create an S3 bucket for recordings\nconst recordingBucket = new s3.Bucket(this, \"RecordingBucket\", {\n  bucketName: \"my-browser-recordings\",\n  removalPolicy: RemovalPolicy.DESTROY, // For demo purposes\n});\n\n// Create browser with recording enabled\nconst browser = new agentcore.BrowserCustom(this, \"MyBrowser\", {\n  browserCustomName: \"my_browser\",\n  description: \"Browser with recording enabled\",\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingPublicNetwork(),\n  recordingConfig: {\n    enabled: true,\n    s3Location: {\n      bucketName: recordingBucket.bucketName,\n      objectKey: \"browser-recordings/\",\n    },\n  },\n});\n```\n\n### Browser with Custom Execution Role\n\n```typescript fixture=default\n// Create a custom execution role\nconst executionRole = new iam.Role(this, \"BrowserExecutionRole\", {\n  assumedBy: new iam.ServicePrincipal(\"bedrock-agentcore.amazonaws.com\"),\n  managedPolicies: [\n    iam.ManagedPolicy.fromAwsManagedPolicyName(\"AmazonBedrockAgentCoreBrowserExecutionRolePolicy\"),\n  ],\n});\n\n// Create browser with custom execution role\nconst browser = new agentcore.BrowserCustom(this, \"MyBrowser\", {\n  browserCustomName: \"my_browser\",\n  description: \"Browser with custom execution role\",\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingPublicNetwork(),\n  executionRole: executionRole,\n});\n```\n\n### Browser with S3 Recording and Permissions\n\n```typescript fixture=default\n// Create an S3 bucket for recordings\nconst recordingBucket = new s3.Bucket(this, \"RecordingBucket\", {\n  bucketName: \"my-browser-recordings\",\n  removalPolicy: RemovalPolicy.DESTROY, // For demo purposes\n});\n\n// Create browser with recording enabled\nconst browser = new agentcore.BrowserCustom(this, \"MyBrowser\", {\n  browserCustomName: \"my_browser\",\n  description: \"Browser with recording enabled\",\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingPublicNetwork(),\n  recordingConfig: {\n    enabled: true,\n    s3Location: {\n      bucketName: recordingBucket.bucketName,\n      objectKey: \"browser-recordings/\",\n    },\n  },\n});\n\n// The browser construct automatically grants S3 permissions to the execution role\n// when recording is enabled, so no additional IAM configuration is needed\n```\n\n### Browser with Browser signing\n\nAI agents need to browse the web on your behalf. When your agent visits a website to gather information, complete a form, or verify data, it encounters the same defenses designed to stop unwanted bots: CAPTCHAs, rate limits, and outright blocks.\n\nAmazon Bedrock AgentCore Browser supports Web Bot Auth. Web Bot Auth is a draft IETF protocol that gives agents verifiable cryptographic identities. When you enable Web Bot Auth in AgentCore Browser, the service issues cryptographic credentials that websites can verify. The agent presents these credentials with every request. The WAF may now additionally check the signature, confirm it matches a trusted directory, and allow the request through if verified bots are allowed by the domain owner and other WAF checks are clear.\n\nTo enable the browser to sign requests using the Web Bot Auth protocol, create a browser tool with the browserSigning configuration:\n\n```typescript fixture=default\nconst browser = new agentcore.BrowserCustom(this, 'test-browser', {\n  browserCustomName: 'test_browser',\n  browserSigning: agentcore.BrowserSigning.ENABLED\n});\n```\n\n### Browser IAM Permissions\n\nThe Browser construct provides convenient methods for granting IAM permissions:\n\n```typescript fixture=default\n// Create a browser\nconst browser = new agentcore.BrowserCustom(this, \"MyBrowser\", {\n  browserCustomName: \"my_browser\",\n  description: \"Browser for web automation\",\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingPublicNetwork(),\n});\n\n// Create a role that needs access to the browser\nconst userRole = new iam.Role(this, \"UserRole\", {\n  assumedBy: new iam.ServicePrincipal(\"lambda.amazonaws.com\"),\n});\n\n// Grant read permissions (Get and List actions)\nbrowser.grantRead(userRole);\n\n// Grant use permissions (Start, Update, Stop actions)\nbrowser.grantUse(userRole);\n\n// Grant specific custom permissions\nbrowser.grant(userRole, \"bedrock-agentcore:GetBrowserSession\");\n```\n\n## Code Interpreter\n\nThe Amazon Bedrock AgentCore Code Interpreter enables AI agents to write and execute code securely in sandbox environments, enhancing their accuracy and expanding their ability to solve complex end-to-end tasks. This is critical in Agentic AI applications where the agents may execute arbitrary code that can lead to data compromise or security risks. The AgentCore Code Interpreter tool provides secure code execution, which helps you avoid running into these issues.\n\nFor more information about code interpreter, please refer to the [official documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/code-interpreter-tool.html)\n\n### Code Interpreter Network Modes\n\nThe Code Interpreter construct supports the following network modes:\n\n1. **Public Network Mode** (`CodeInterpreterNetworkMode.usingPublicNetwork()`) - Default\n\n   - Allows internet access for package installation and external API calls\n   - Suitable for development and testing environments\n   - Enables downloading Python packages from PyPI\n\n2. **Sandbox Network Mode** (`CodeInterpreterNetworkMode.usingSandboxNetwork()`)\n   - Isolated network environment with no internet access\n   - Suitable for production environments with strict security requirements\n   - Only allows access to pre-installed packages and local resources\n\n3. **VPC (Virtual Private Cloud)** (`CodeInterpreterNetworkMode.usingVpc()`)\n   - Select whether to run the browser in a virtual private cloud (VPC).\n   - By configuring VPC connectivity, you enable secure access to private resources such as databases, internal APIs, and services within your VPC.\n\n    While the VPC itself is mandatory, these are optional:\n    - Subnets - if not provided, CDK will select appropriate subnets from the VPC\n    - Security Groups - if not provided, CDK will create a default security group\n    - Specific subnet selection criteria - you can let CDK choose automatically\n\nFor more information on VPC connectivity for Amazon Bedrock AgentCore Browser, please refer to the [official documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html).\n\n### Code Interpreter Properties\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `codeInterpreterCustomName` | `string` | No | The name of the code interpreter. Must start with a letter and can be up to 48 characters long. Pattern: `[a-zA-Z][a-zA-Z0-9_]{0,47}`. If not provided, a unique name will be auto-generated |\n| `description` | `string` | No | Optional description for the code interpreter. Can have up to 200 characters |\n| `executionRole` | `iam.IRole` | No | The IAM role that provides permissions for the code interpreter to access AWS services. A new role will be created if not provided |\n| `networkConfiguration` | `CodeInterpreterNetworkConfiguration` | No | Network configuration for code interpreter. Defaults to PUBLIC network mode |\n| `tags` | `{ [key: string]: string }` | No | Tags to apply to the code interpreter resource |\n\n### Basic Code Interpreter Creation\n\n```typescript fixture=default\n// Create a basic code interpreter with public network access\nconst codeInterpreter = new agentcore.CodeInterpreterCustom(this, \"MyCodeInterpreter\", {\n  codeInterpreterCustomName: \"my_code_interpreter\",\n  description: \"A code interpreter for Python execution\",\n});\n```\n\n### Code Interpreter with VPC\n\n```typescript fixture=default\nconst codeInterpreter = new agentcore.CodeInterpreterCustom(this, \"MyCodeInterpreter\", {\n  codeInterpreterCustomName: \"my_sandbox_interpreter\",\n  description: \"Code interpreter with isolated network access\",\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingVpc(this, {\n    vpc: new ec2.Vpc(this, 'VPC', { restrictDefaultSecurityGroup: false }),\n  }),\n});\n```\n\nCode Interpreter exposes a [connections](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Connections.html) property. This property returns a connections object, which simplifies the process of defining and managing ingress and egress rules for security groups in your AWS CDK applications. Instead of directly manipulating security group rules, you interact with the Connections object of a construct, which then translates your connectivity requirements into the appropriate security group rules. For instance:\n\n```typescript fixture=default\nconst vpc = new ec2.Vpc(this, 'testVPC');\n\nconst codeInterpreter = new agentcore.CodeInterpreterCustom(this, \"MyCodeInterpreter\", {\n  codeInterpreterCustomName: \"my_sandbox_interpreter\",\n  description: \"Code interpreter with isolated network access\",\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingVpc(this, {\n    vpc: vpc,\n  }),\n});\n\ncodeInterpreter.connections.addSecurityGroup(new ec2.SecurityGroup(this, 'AdditionalGroup', { vpc }));\n```\n\nSo security groups can be added after the browser construct creation. You can use methods like allowFrom() and allowTo() to grant ingress access to/egress access from a specified peer over a given portRange. The Connections object automatically adds the necessary ingress or egress rules to the security group(s) associated with the calling construct.\n\n### Code Interpreter with Sandbox Network Mode\n\n```typescript fixture=default\n// Create code interpreter with sandbox network mode (isolated)\nconst codeInterpreter = new agentcore.CodeInterpreterCustom(this, \"MyCodeInterpreter\", {\n  codeInterpreterCustomName: \"my_sandbox_interpreter\",\n  description: \"Code interpreter with isolated network access\",\n  networkConfiguration: agentcore.CodeInterpreterNetworkConfiguration.usingSandboxNetwork(),\n});\n```\n\n### Code Interpreter with Custom Execution Role\n\n```typescript fixture=default\n// Create a custom execution role\nconst executionRole = new iam.Role(this, \"CodeInterpreterExecutionRole\", {\n  assumedBy: new iam.ServicePrincipal(\"bedrock-agentcore.amazonaws.com\"),\n});\n\n// Create code interpreter with custom execution role\nconst codeInterpreter = new agentcore.CodeInterpreterCustom(this, \"MyCodeInterpreter\", {\n  codeInterpreterCustomName: \"my_code_interpreter\",\n  description: \"Code interpreter with custom execution role\",\n  networkConfiguration: agentcore.CodeInterpreterNetworkConfiguration.usingPublicNetwork(),\n  executionRole: executionRole,\n});\n```\n\n### Code Interpreter IAM Permissions\n\nThe Code Interpreter construct provides convenient methods for granting IAM permissions:\n\n```typescript fixture=default\n// Create a code interpreter\nconst codeInterpreter = new agentcore.CodeInterpreterCustom(this, \"MyCodeInterpreter\", {\n  codeInterpreterCustomName: \"my_code_interpreter\",\n  description: \"Code interpreter for Python execution\",\n  networkConfiguration: agentcore.CodeInterpreterNetworkConfiguration.usingPublicNetwork(),\n});\n\n// Create a role that needs access to the code interpreter\nconst userRole = new iam.Role(this, \"UserRole\", {\n  assumedBy: new iam.ServicePrincipal(\"lambda.amazonaws.com\"),\n});\n\n// Grant read permissions (Get and List actions)\ncodeInterpreter.grantRead(userRole);\n\n// Grant use permissions (Start, Invoke, Stop actions)\ncodeInterpreter.grantUse(userRole);\n\n// Grant specific custom permissions\ncodeInterpreter.grant(userRole, \"bedrock-agentcore:GetCodeInterpreterSession\");\n```\n\n### Code interpreter with tags\n\n```typescript fixture=default\n// Create code interpreter with sandbox network mode (isolated)\nconst codeInterpreter = new agentcore.CodeInterpreterCustom(this, \"MyCodeInterpreter\", {\n  codeInterpreterCustomName: \"my_sandbox_interpreter\",\n  description: \"Code interpreter with isolated network access\",\n  networkConfiguration: agentcore.CodeInterpreterNetworkConfiguration.usingPublicNetwork(),\n  tags: {\n    Environment: \"Production\",\n    Team: \"AI/ML\",\n    Project: \"AgentCore\",\n  },\n});\n```\n\n## Gateway\n\nThe Gateway construct provides a way to create Amazon Bedrock Agent Core Gateways, which serve as integration points between agents and external services.\n\n### Gateway Properties\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `gatewayName` | `string` | No | The name of the gateway. Valid characters are a-z, A-Z, 0-9, _ (underscore) and - (hyphen). Maximum 100 characters. If not provided, a unique name will be auto-generated |\n| `description` | `string` | No | Optional description for the gateway. Maximum 200 characters |\n| `protocolConfiguration` | `IGatewayProtocolConfig` | No | The protocol configuration for the gateway. Defaults to MCP protocol |\n| `authorizerConfiguration` | `IGatewayAuthorizerConfig` | No | The authorizer configuration for the gateway. Defaults to Cognito |\n| `exceptionLevel` | `GatewayExceptionLevel` | No | The verbosity of exception messages. Use DEBUG mode to see granular exception messages |\n| `kmsKey` | `kms.IKey` | No | The AWS KMS key used to encrypt data associated with the gateway |\n| `role` | `iam.IRole` | No | The IAM role that provides permissions for the gateway to access AWS services. A new role will be created if not provided |\n| `tags` | `{ [key: string]: string }` | No | Tags for the gateway. A list of key:value pairs of tags to apply to this Gateway resource |\n| `policyEngineConfiguration` | `GatewayPolicyEngineConfig` | No | Associates a policy engine with this gateway. All agent requests are evaluated against the Cedar policies in the engine. The gateway role is automatically granted evaluate permissions. Default: no policy engine |\n\n### Basic Gateway Creation\n\nThe protocol configuration defaults to MCP and the inbound auth configuration uses Cognito (it is automatically created on your behalf).\n\n```typescript fixture=default\n// Create a basic gateway with default MCP protocol and Cognito authorizer\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n```\n\n### Protocol configuration\n\nCurrently MCP is the only protocol available. To configure it, use the `protocol` property with `McpProtocolConfiguration`:\n\n- Instructions: Guidance for how to use the gateway with your tools\n- Semantic search: Smart tool discovery that finds the right tools without typical limits. It improves accuracy by finding relevant tools based on context\n- Supported versions: Which MCP protocol versions the gateway can use\n\n```typescript fixture=default\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  protocolConfiguration: new agentcore.McpProtocolConfiguration({\n    instructions: \"Use this gateway to connect to external MCP tools\",\n    searchType: agentcore.McpGatewaySearchType.SEMANTIC,\n    supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],\n  }),\n});\n```\n\n### Inbound authorization\n\nBefore you create your gateway, you must set up inbound authorization. Inbound authorization validates users who attempt to access targets through\nyour AgentCore gateway. By default, if not provided, the construct will create and configure Cognito as the default identity provider\n(inbound Auth setup). AgentCore supports the following types of inbound authorization:\n\n**JSON Web Token (JWT)** – A secure and compact token used for authorization. After creating the JWT, you specify it as the authorization\nconfiguration when you create the gateway. You can create a JWT with any of the identity providers at Provider setup and configuration.\n\nYou can configure a custom authorization provider using the `authorizerConfiguration` property with `GatewayAuthorizer.usingCustomJwt()`.\nYou need to specify an OAuth discovery server and client IDs/audiences when you create the gateway. You can specify the following:\n\n- Discovery Url — String that must match the pattern ^.+/\\.well-known/openid-configuration$ for OpenID Connect discovery URLs\n- At least one of the below options depending on the chosen identity provider.\n- Allowed audiences — List of allowed audiences for JWT tokens\n- Allowed clients — List of allowed client identifiers\n- Allowed scopes — List of allowed scopes for JWT tokens\n- Custom claims — Optional custom claim validations (see Custom Claims Validation section below)\n\n```typescript fixture=default\n\n// Optional: Create custom claims (CustomClaimOperator and GatewayCustomClaim from agentcore)\nconst customClaims = [\n  agentcore.GatewayCustomClaim.withStringValue('department', 'engineering'),\n  agentcore.GatewayCustomClaim.withStringArrayValue('roles', ['admin'], agentcore.CustomClaimOperator.CONTAINS),\n  agentcore.GatewayCustomClaim.withStringArrayValue('permissions', ['read', 'write'], agentcore.CustomClaimOperator.CONTAINS_ANY),\n];\n\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({\n    discoveryUrl: \"https://auth.example.com/.well-known/openid-configuration\",\n    allowedAudience: [\"my-app\"],\n    allowedClients: [\"my-client-id\"],\n    allowedScopes: [\"read\", \"write\"],\n    customClaims: customClaims, // Optional custom claims\n  }),\n});\n```\n\n**IAM** – Authorizes through the credentials of the AWS IAM identity trying to access the gateway.\n\n```typescript fixture=default\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingAwsIam(),\n});\n\n// Grant access to a Lambda function's role\nconst lambdaRole = new iam.Role(this, \"LambdaRole\", {\n  assumedBy: new iam.ServicePrincipal(\"lambda.amazonaws.com\"),\n});\n\n// The Lambda needs permission to invoke the gateway\ngateway.grantInvoke(lambdaRole);\n```\n\n**No Authorization** – Creates a gateway with no inbound authorization. This is useful for building public MCP servers,\nor when you want to skip gateway-level authentication and enforce tool execution-level authentication using Gateway Interceptors.\n\n```typescript fixture=default\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  authorizerConfiguration: agentcore.GatewayAuthorizer.withNoAuth(),\n});\n```\n\n> **⚠️ Important:** Do not use No Authorization gateways for production workloads unless you have implemented all the security best practices. No Authorization gateways are most appropriate for testing and development purposes. See [Security Best Practices](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-inbound-auth.html#gateway-inbound-auth-none) for required compensating controls.\n\nFor more information, see [No Authorization](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-inbound-auth.html#gateway-inbound-auth-none).\n\n**Cognito with M2M (Machine-to-Machine) Authentication (Default)** – When no authorizer is specified, the construct automatically creates a Cognito User Pool configured for OAuth 2.0 client credentials flow. This enables machine-to-machine authentication suitable for AI agents and service-to-service communication.\n\nFor more information, see [Setting up Amazon Cognito for Gateway inbound authorization](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity-idp-cognito.html).\n\n```typescript fixture=default\n// Create a gateway with default Cognito M2M authorizer\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// Access the Cognito resources for authentication setup\nconst userPool = gateway.userPool;\nconst userPoolClient = gateway.userPoolClient;\n\n// Get the token endpoint URL and OAuth scopes for client credentials flow\nconst tokenEndpointUrl = gateway.tokenEndpointUrl;\nconst oauthScopes = gateway.oauthScopes;\n// oauthScopes are in the format: ['{resourceServerId}/read', '{resourceServerId}/write']\n```\n\n**Using Cognito User Pool Explicitly with Custom Claims** – You can also use an existing Cognito User Pool with custom claims:\n\n```typescript fixture=default\ndeclare const userPool: cognito.UserPool;\ndeclare const userPoolClient: cognito.UserPoolClient;\n\n// Optional: Create custom claims (CustomClaimOperator and GatewayCustomClaim from agentcore)\nconst customClaims = [\n  agentcore.GatewayCustomClaim.withStringValue('department', 'engineering'),\n  agentcore.GatewayCustomClaim.withStringArrayValue('roles', ['admin'], agentcore.CustomClaimOperator.CONTAINS),\n  agentcore.GatewayCustomClaim.withStringArrayValue('permissions', ['read', 'write'], agentcore.CustomClaimOperator.CONTAINS_ANY),\n];\n\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCognito({\n    userPool: userPool,\n    allowedClients: [userPoolClient],\n    allowedAudiences: [\"audience1\"],\n    allowedScopes: [\"read\", \"write\"],\n    customClaims: customClaims, // Optional custom claims\n  }),\n});\n```\n\nTo authenticate with the gateway, request an access token using the client credentials flow and use it to call Gateway endpoints. For more information about the token endpoint, see [The token issuer endpoint](https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html).\n\nThe following is an example of a token request using curl:\n\n```bash\ncurl -X POST \"${TOKEN_ENDPOINT_URL}\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  -d \"grant_type=client_credentials\" \\\n  -d \"client_id=${USER_POOL_CLIENT_ID}\" \\\n  -d \"client_secret=${CLIENT_SECRET}\" \\\n  -d \"scope=${OAUTH_SCOPES}\"\n```\n\n### Gateway with KMS Encryption\n\nYou can provide a KMS key, and configure the authorizer as well as the protocol configuration.\n\n```typescript fixture=default\n// Create a KMS key for encryption\nconst encryptionKey = new kms.Key(this, \"GatewayEncryptionKey\", {\n  enableKeyRotation: true,\n  description: \"KMS key for gateway encryption\",\n});\n\n// Create gateway with KMS encryption\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-encrypted-gateway\",\n  description: \"Gateway with KMS encryption\",\n  protocolConfiguration: new agentcore.McpProtocolConfiguration({\n    instructions: \"Use this gateway to connect to external MCP tools\",\n    searchType: agentcore.McpGatewaySearchType.SEMANTIC,\n    supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],\n  }),\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({\n    discoveryUrl: \"https://auth.example.com/.well-known/openid-configuration\",\n    allowedAudience: [\"my-app\"],\n    allowedClients: [\"my-client-id\"],\n    allowedScopes: [\"read\", \"write\"],\n  }),\n  kmsKey: encryptionKey,\n  exceptionLevel: agentcore.GatewayExceptionLevel.DEBUG,\n});\n```\n\n### Gateway with Custom Execution Role\n\n```typescript fixture=default\n// Create a custom execution role\nconst executionRole = new iam.Role(this, \"GatewayExecutionRole\", {\n  assumedBy: new iam.ServicePrincipal(\"bedrock-agentcore.amazonaws.com\"),\n  managedPolicies: [\n    iam.ManagedPolicy.fromAwsManagedPolicyName(\"AmazonBedrockAgentCoreGatewayExecutionRolePolicy\"),\n  ],\n});\n\n// Create gateway with custom execution role\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  description: \"Gateway with custom execution role\",\n  protocolConfiguration: new agentcore.McpProtocolConfiguration({\n    instructions: \"Use this gateway to connect to external MCP tools\",\n    searchType: agentcore.McpGatewaySearchType.SEMANTIC,\n    supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],\n  }),\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({\n    discoveryUrl: \"https://auth.example.com/.well-known/openid-configuration\",\n    allowedAudience: [\"my-app\"],\n    allowedClients: [\"my-client-id\"],\n    allowedScopes: [\"read\", \"write\"],\n  }),\n  role: executionRole,\n});\n```\n\n### Gateway IAM Permissions\n\nThe Gateway construct provides convenient methods for granting IAM permissions:\n\n```typescript fixture=default\n// Create a gateway\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  description: \"Gateway for external service integration\",\n  protocolConfiguration: new agentcore.McpProtocolConfiguration({\n    instructions: \"Use this gateway to connect to external MCP tools\",\n    searchType: agentcore.McpGatewaySearchType.SEMANTIC,\n    supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],\n  }),\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({\n    discoveryUrl: \"https://auth.example.com/.well-known/openid-configuration\",\n    allowedAudience: [\"my-app\"],\n    allowedClients: [\"my-client-id\"],\n    allowedScopes: [\"read\", \"write\"],\n  }),\n});\n\n// Create a role that needs access to the gateway\nconst userRole = new iam.Role(this, \"UserRole\", {\n  assumedBy: new iam.ServicePrincipal(\"lambda.amazonaws.com\"),\n});\n\n// Grant read permissions (Get and List actions)\ngateway.grantRead(userRole);\n\n// Grant manage permissions (Create, Update, Delete actions)\ngateway.grantManage(userRole);\n\n// Grant specific custom permissions\ngateway.grant(userRole, \"bedrock-agentcore:GetGateway\");\n```\n\n## Gateway Target\n\nAfter Creating gateways, you can add targets which define the tools that your gateway will host. Gateway supports multiple target\ntypes including Lambda functions and API specifications (either OpenAPI schemas or Smithy models). Gateway allows you to attach multiple\ntargets to a Gateway and you can change the targets / tools attached to a gateway at any point. Each target can have its own\ncredential provider attached enabling you to securely access targets whether they need IAM, API Key, or OAuth credentials.\n\n### Gateway Target Properties\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `gatewayTargetName` | `string` | No | The name of the gateway target. Valid characters are a-z, A-Z, 0-9, _ (underscore) and - (hyphen). If not provided, a unique name will be auto-generated |\n| `description` | `string` | No | Optional description for the gateway target. Maximum 200 characters |\n| `gateway` | `IGateway` | Yes | The gateway this target belongs to |\n| `targetConfiguration` | `ITargetConfiguration` | Yes | The target configuration (Lambda, OpenAPI, Smithy, or API Gateway). **Note:** Users typically don't create this directly. When using convenience methods like `GatewayTarget.forLambda()`, `GatewayTarget.forOpenApi()`, `GatewayTarget.forSmithy()`, `GatewayTarget.forApiGateway()`, `GatewayTarget.forMcpServer()` or the gateway's `addLambdaTarget()`, `addOpenApiTarget()`, `addSmithyTarget()`, `addApiGatewayTarget()`, `addMcpServerTarget()` methods, this configuration is created internally for you. Only needed when using the GatewayTarget constructor directly for [advanced scenarios](#advanced-usage-direct-configuration-for-gateway-target). |\n| `credentialProviderConfigurations` | `IGatewayCredentialProvider[]` | No | Credential providers for authentication. Defaults to `[GatewayCredentialProvider.fromIamRole()]`. With Token Vault L2 constructs, prefer `GatewayCredentialProvider.fromApiKeyIdentity()` / `fromOauthIdentity()`; otherwise use `fromApiKeyIdentityArn()` / `fromOauthIdentityArn()`, or `fromIamRole()` |\n| `validateOpenApiSchema` | `boolean` | No | (OpenAPI targets only) Whether to validate the OpenAPI schema at synthesis time. Defaults to `true`. Only applies to inline and local asset schemas. For more information refer here <https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-schema-openapi.html> |\n\nThis approach gives you full control over the configuration but is typically not necessary for most use cases.\n\n### Targets types\n\nYou can create the following targets types:\n\n**Lambda Target**: Lambda targets allow you to connect your gateway to AWS Lambda functions that implement your tools. This is useful\nwhen you want to execute custom code in response to tool invocations.\n\n- Supports GATEWAY_IAM_ROLE credential provider only\n- Ideal for custom serverless function integration\n- Need tool schema (tool schema is a blueprint that describes the functions your Lambda provides to AI agents).\n  The construct provide [3 ways to upload a tool schema to Lambda target](#tools-schema-for-lambda-target)\n- When using the default IAM authentication (no `credentialProviderConfigurations` specified),\n  the construct automatocally grants the gateway role permission to invoke your Lambda function (`lambda:InvokeFunction`).\n\n**OpenAPI Schema Target** : OpenAPI widely used standard for describing RESTful APIs. Gateway supports OpenAPI 3.0\nspecifications for defining API targets. It connects to REST APIs using OpenAPI specifications\n\n- Supports OAUTH and API_KEY credential providers (Do not support IAM, you must provide `credentialProviderConfigurations`)\n- Ideal for integrating with external REST services\n- Need API schema. The construct provide [3 ways to upload a API schema to OpenAPI target](#api-schema-for-openapi-and-smithy-target)\n\n**Smithy Model Target** : Smithy is a language for defining services and software development kits (SDKs). Smithy models provide\na more structured approach to defining APIs compared to OpenAPI, and are particularly useful for connecting to AWS services.\nAgentCore Gateway supports built-in AWS service models only. It connects to services using Smithy model definitions\n\n- Supports OAUTH and API_KEY credential providers\n- Ideal for AWS service integrations\n- Need API schema. The construct provide 3 ways to upload a API schema to Smity target\n- When using the default IAM authentication (no `credentialProviderConfigurations` specified), The construct only\n  grants permission to read the Smithy schema file from S3. You MUST manually grant permissions for the gateway\n  role to invoke the actual Smithy API endpoints\n\n> Note: For Smithy model targets that access AWS services, your Gateway's execution role needs permissions to access those services.\nFor example, for a DynamoDB target, your execution role needs permissions to perform DynamoDB operations.\nThis is not managed by the construct due to the large number of options. Please refer to\n[Smithy Model Permission](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-prerequisites-permissions.html) for example.\n\n**MCP Server Target**: Model Context Protocol (MCP) servers provide external tools, data access, and custom functions for AI agents.\nMCP servers enable agents to interact with external systems and services through a standardized protocol. Gateway automatically\ndiscovers and indexes available tools from MCP servers through synchronization.\n\n**Key Features:**\n\n- Requires explicit authentication configuration (OAuth2 recommended, empty array for NoAuth)\n- Ideal for connecting to external MCP-compliant servers\n- The endpoint must use HTTPS protocol\n- Supported MCP protocol versions: 2025-06-18, 2025-03-26\n- Automatic tool discovery through synchronization\n\n**Synchronization Behavior:**\n\nMCP Server targets require synchronization to discover and index available tools:\n\n- **Implicit Synchronization (Automatic)**: Tool discovery happens automatically during:\n  - Target creation (`CreateGatewayTarget`)\n  - Target updates (`UpdateGatewayTarget`)\n  - The Gateway calls the MCP server's `tools/list` endpoint and indexes tools without user intervention\n\n- **Explicit Synchronization (Manual)**: When the MCP server's tools change independently (new tools added, schemas modified, tools removed):\n  - The Gateway's tool catalog becomes stale\n  - Call the `SynchronizeGatewayTargets` API to refresh the catalog\n  - Use the `grantSync()` method to grant permissions to Lambda functions, CI/CD pipelines, or scheduled tasks that will trigger synchronization\n\n**Authentication & Permissions:**\n\nWhen using OAuth2, the Gateway service role automatically receives:\n\n- `bedrock-agentcore:GetWorkloadAccessToken`\n- `bedrock-agentcore:GetResourceOauth2Token`\n- `secretsmanager:GetSecretValue`\n- KMS decrypt (if secrets are encrypted)\n\nFor explicit synchronization, use `grantSync()` to grant `bedrock-agentcore:SynchronizeGatewayTargets` permission to your operator roles.\n\n> For more information, refer to the [MCP Server Target documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-target-MCPservers.html).\n\n### Understanding Tool Naming\n\nWhen tools are exposed through gateway targets, AgentCore Gateway prefixes each tool name with the target name to ensure uniqueness across multiple targets. This is important to understand when building your application logic.\n\n**Naming Pattern:**\n\n**Example:**\n\nIf your target is named `my-lambda-target` and provides a tool called `calculate_price`, agents will discover and invoke it as `my-lambda-target__calculate_price`.\n\n**Important Considerations:**\n\n- **For Lambda Targets**: Your Lambda handler must strip the target name prefix before processing the tool request. The full tool name (with prefix) is sent in the event.\n- **For MCP Server Targets**: The MCP server receives tool calls with the prefixed name from the gateway.\n- **For OpenAPI/Smithy Targets**: The gateway handles the prefix automatically when mapping to API operations based on the `operationId`.\n\nThis naming convention ensures that:\n\n- Tools from different targets don't collide even if they have the same name\n- Agents can access tools from multiple targets through a single gateway\n- Tool names remain unique in the unified tool catalog\n\nFor more details, see the [Gateway Tool Naming Documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-tool-naming.html).\n\n### Tools schema For Lambda target\n\nThe lambda target need tools schema to understand the fuunction lambda provides. You can upload the tool schema by following 3 ways:\n\n- From a local asset file\n\n```typescript\nconst toolSchema = agentcore.ToolSchema.fromLocalAsset(\n    path.join(__dirname, \"schemas\", \"my-tool-schema.json\")\n  );\n```\n\n- From an existing S3 file:\n\n```typescript\n\nconst toolSchema = agentcore.ToolSchema.fromS3File(\n    s3.Bucket.fromBucketName(this, \"SchemasBucket\", \"my-schemas-bucket\"),\n    \"tools/complex-tool-schema.json\",\n    \"123456789012\"\n  );\n```\n\n- From Inline:\n\n```typescript\nconst toolSchema = agentcore.ToolSchema.fromInline([{\n      name: \"hello_world\",\n      description: \"A simple hello world tool\",\n      inputSchema: {\n        type: agentcore.SchemaDefinitionType.OBJECT,\n        properties: {\n          name: {\n            type: agentcore.SchemaDefinitionType.STRING,\n            description: \"The name to greet\",\n          },\n        },\n        required: [\"name\"],\n      },\n    }]);\n\n```\n\n### Api schema For OpenAPI and Smithy target\n\nThe OpenAPI and Smithy target need API Schema. The Gateway construct provide three ways to upload API schema for your target:\n\n- From a local asset file (requires binding to scope):\n\n```typescript fixture=default\n// When using ApiSchema.fromLocalAsset, you must bind the schema to a scope\nconst schema = agentcore.ApiSchema.fromLocalAsset(path.join(__dirname, \"mySchema.yml\"));\n\nschema.bind(this);\n```\n\n- From an inline schema:\n\n```typescript fixture=default\nconst inlineSchema = agentcore.ApiSchema.fromInline(`\nopenapi: 3.0.3\ninfo:\n  title: Library API\n  version: 1.0.0\npaths:\n  /search:\n    get:\n      summary: Search for books\n      operationId: searchBooks\n      parameters:\n        - name: query\n          in: query\n          required: true\n          schema:\n            type: string\n`);\n```\n\n- From an existing S3 file:\n\n```typescript fixture=default\nconst bucket = s3.Bucket.fromBucketName(this, \"ExistingBucket\", \"my-schema-bucket\");\nconst s3Schema = agentcore.ApiSchema.fromS3File(bucket, \"schemas/action-group.yaml\");\n```\n\n### Outbound auth\n\nOutbound authorization lets Amazon Bedrock AgentCore gateways securely access gateway targets on behalf of users authenticated\nand authorized during Inbound Auth.\n\nAgentCore Gateway supports the following types of outbound authorization:\n\n**IAM-based outbound authorization** – The gateway uses its execution role to authenticate with AWS services. This is the default\n and most common approach for Lambda targets and AWS service integrations.\n\n**2-legged OAuth (OAuth 2LO)** – Use OAuth 2.0 two-legged flow (2LO) for targets that require OAuth authentication.\nThe gateway authenticates on its own behalf, not on behalf of a user.\n\n**API key** – Use the AgentCore service/AWS console to generate an API key to authenticate access to the gateway target.\n\n**Note > You need to set up the outbound identity before you can create a gateway target.\n\n#### Token Vault credential providers\n\nAgentCore stores outbound **API key** and **OAuth2** client credentials in Token Vault. This module includes L2 constructs that create those resources and connect them to gateway targets.\n\n**Shared OAuth2 fields** — Every `OAuth2CredentialProvider` factory accepts the same **`clientId`** and **`clientSecret`**, plus optional **`oAuth2CredentialProviderName`** and **`tags`**. Extra properties appear only when an IdP needs them (for example **`tenantId`** for Microsoft, or **`issuer`** / endpoint overrides for Okta and other *included* configurations).\n\n**Vendor factories** — Prefer `OAuth2CredentialProvider.usingSlack`, `.usingGithub`, `.usingGoogle`, `.usingMicrosoft`, `.usingOkta`, `.usingAuth0`, `.usingCognito`, and the other `using*` helpers for known providers. Each maps to the matching CloudFormation *included* provider configuration.\n\n**Custom OAuth2 (`usingCustom`)** — Supply **exactly one** of:\n\n- **`discoveryUrl`** — OIDC/OAuth2 discovery document URL (for example `https://idp.example.com/.well-known/openid-configuration`), or\n- **`authorizationServerMetadata`** — Manual authorization server metadata (`issuer`, `authorizationEndpoint`, `tokenEndpoint`, and other fields supported by the `AWS::BedrockAgentCore::OAuth2CredentialProvider` resource).\n\nDo not pass both. The construct validates this at synthesis time when values are known; if you use CDK tokens, ensure the resolved template still satisfies the service rules.\n\n**Wiring to gateway targets** — After you create a provider in CDK, pass the construct to **`GatewayCredentialProvider.fromOauthIdentity()`** or **`fromApiKeyIdentity()`** (optional API key header/query settings go in the second argument for API keys). Alternatively, call **`bindForGatewayOAuthTarget`** / **`bindForGatewayApiKeyTarget`** on the provider and pass that object to **`fromOauthIdentityArn`** / **`fromApiKeyIdentityArn`**. You can still pass raw ARNs from the console or API when the provider already exists.\n\n**Example: GitHub OAuth2 and an MCP target**\n\n```typescript fixture=default\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst oauth = agentcore.OAuth2CredentialProvider.usingGithub(this, \"GhOAuth\", {\n  oAuth2CredentialProviderName: \"github-oauth\",\n  clientId: \"your-client-id\",\n  clientSecret: cdk.SecretValue.unsafePlainText(\"your-client-secret\"),\n});\n\ngateway.addMcpServerTarget(\"Mcp\", {\n  gatewayTargetName: \"mcp-server\",\n  description: \"MCP with GitHub OAuth\",\n  endpoint: \"https://my-mcp-server.example.com\",\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromOauthIdentity(oauth, {\n      scopes: [\"read:user\"],\n    }),\n  ],\n});\n```\n\n**Example: custom IdP with a discovery URL**\n\n```typescript fixture=default\nagentcore.OAuth2CredentialProvider.usingCustom(this, \"CustomOAuth\", {\n  oAuth2CredentialProviderName: \"custom-idp\",\n  clientId: \"your-client-id\",\n  clientSecret: cdk.SecretValue.unsafePlainText(\"your-client-secret\"),\n  discoveryUrl: \"https://idp.example.com/.well-known/openid-configuration\",\n});\n```\n\n**Example: custom IdP with explicit authorization server metadata**\n\n```typescript fixture=default\nagentcore.OAuth2CredentialProvider.usingCustom(this, \"CustomOAuthMeta\", {\n  clientId: \"your-client-id\",\n  clientSecret: cdk.SecretValue.unsafePlainText(\"your-client-secret\"),\n  authorizationServerMetadata: {\n    issuer: \"https://idp.example.com\",\n    authorizationEndpoint: \"https://idp.example.com/oauth2/authorize\",\n    tokenEndpoint: \"https://idp.example.com/oauth2/token\",\n  },\n});\n```\n\n#### Workload identities\n\nA **workload identity** is the stable identity of an agent in your AWS account within the AgentCore Identity model. It ties together IAM roles, OAuth2 flows, API keys, and workload access tokens so agents can authenticate consistently across environments. For conceptual background, see [Understanding workload identities](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/understanding-agent-identities.html).\n\n**Agent identity directory** — Each account has a single logical directory that holds every workload identity, whether it was created by AgentCore Runtime, AgentCore Gateway, or manually (for example through CloudFormation or the control-plane API). The directory is created automatically when the first workload identity exists. Resource ARNs follow the pattern described in [Understanding the agent identity directory](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agent-identity-directory.html) (`workload-identity-directory/default` and child `workload-identity/<name>` entries).\n\n**When to create one in CDK** — Runtime and Gateway can create workload identities for you during deployment. Use the **`WorkloadIdentity`** L2 when you need a **manually defined** identity (custom name, allowed OAuth2 return URLs, tags) or when integrating workloads that are not driven by those services.\n\n**Construct** — `WorkloadIdentity` maps to **`AWS::BedrockAgentCore::WorkloadIdentity`**. It exposes `workloadIdentityArn`, `workloadIdentityName`, and `workloadIdentityRef` for wiring into IAM or other AgentCore resources. Import an existing identity with **`WorkloadIdentity.fromWorkloadIdentityAttributes`**. Grant helpers (`grantRead`, `grantAdmin`, `grantFullAccess`) align with [directory-level IAM patterns](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agent-identity-directory.html#directory-access-control-and-permissions) such as listing identities on the directory resource and scoping mutations to specific identity ARNs.\n\n**Example**\n\n```typescript fixture=default\nnew agentcore.WorkloadIdentity(this, \"MyWorkloadIdentity\", {\n  workloadIdentityName: \"customer-support-agent-prod\",\n  allowedResourceOauth2ReturnUrls: [\"https://app.example.com/oauth/callback\"],\n  tags: { team: \"agents\", env: \"prod\" },\n});\n```\n\n### Basic Gateway Target Creation\n\nYou can create targets in two ways: using the static factory methods on `GatewayTarget` or using the convenient `addTarget` methods on the gateway instance.\n\n#### Using addTarget methods (Recommended)\n\nThis approach is recommended for most use cases, especially when creating targets alongside the gateway. It provides a cleaner, more fluent API by eliminating the need to explicitly pass the gateway reference.\n\nBelow are the examples on how you can create Lambda, Smithy, OpenAPI, MCP Server, and API Gateway targets using `addTarget` methods.\n\n```typescript fixture=default\n// Create a gateway first\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst lambdaFunction = new lambda.Function(this, \"MyFunction\", {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\n    exports.handler = async (event) => {\n      return {\n        statusCode: 200,\n        body: JSON.stringify({ message: 'Hello from Lambda!' })\n      };\n    };\n  `),\n});\n\nconst lambdaTarget = gateway.addLambdaTarget(\"MyLambdaTarget\", {\n  gatewayTargetName: \"my-lambda-target\",\n  description: \"Lambda function target\",\n  lambdaFunction: lambdaFunction,\n  toolSchema: agentcore.ToolSchema.fromInline([\n    {\n      name: \"hello_world\",\n      description: \"A simple hello world tool\",\n      inputSchema: {\n        type: agentcore.SchemaDefinitionType.OBJECT,\n        properties: {\n          name: {\n            type: agentcore.SchemaDefinitionType.STRING,\n            description: \"The name to greet\",\n          },\n        },\n        required: [\"name\"],\n      },\n    },\n  ]),\n});\n```\n\n- OpenAPI Target (using Token Vault L2 construct — preferred)\n\n``` typescript\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// Create an API key credential provider in Token Vault\nconst apiKeyProvider = new agentcore.ApiKeyCredentialProvider(this, \"MyApiKeyProvider\", {\n  apiKeyCredentialProviderName: \"my-apikey\",\n});\n\nconst bucket = s3.Bucket.fromBucketName(this, \"ExistingBucket\", \"my-schema-bucket\");\nconst s3mySchema = agentcore.ApiSchema.fromS3File(bucket, \"schemas/myschema.yaml\");\n\n// Add an OpenAPI target using the L2 construct directly\nconst target = gateway.addOpenApiTarget(\"MyTarget\", {\n  gatewayTargetName: \"my-api-target\",\n  description: \"Target for external API integration\",\n  apiSchema: s3mySchema,\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromApiKeyIdentity(apiKeyProvider, {\n      credentialLocation: agentcore.ApiKeyCredentialLocation.header({\n        credentialParameterName: \"X-API-Key\",\n      }),\n    }),\n  ],\n});\n\n// This makes sure your s3 bucket is available before target\ntarget.node.addDependency(bucket);\n```\n\n- OpenAPI Target (using ARNs — for providers created outside of CDK)\n\n``` typescript\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// ARNs from the console/API, or from ApiKeyCredentialProvider + bindForGatewayApiKeyTarget\nconst apiKeyProviderArn = \"arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/apikeycredentialprovider/my-apikey\"\nconst apiKeySecretArn = \"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-apikey-secret-abc123\"\n\nconst bucket = s3.Bucket.fromBucketName(this, \"ExistingBucket\", \"my-schema-bucket\");\nconst s3mySchema = agentcore.ApiSchema.fromS3File(bucket, \"schemas/myschema.yaml\");\n\n// Add an OpenAPI target using ARNs directly\nconst target = gateway.addOpenApiTarget(\"MyTarget\", {\n  gatewayTargetName: \"my-api-target\",\n  description: \"Target for external API integration\",\n  apiSchema: s3mySchema,\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromApiKeyIdentityArn({\n      providerArn: apiKeyProviderArn,\n      secretArn: apiKeySecretArn,\n      credentialLocation: agentcore.ApiKeyCredentialLocation.header({\n        credentialParameterName: \"X-API-Key\",\n      }),\n    }),\n  ],\n});\n\n// This makes sure your s3 bucket is available before target\ntarget.node.addDependency(bucket);\n```\n\n- Smithy Target\n\n```typescript fixture=default\n\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst smithySchema = agentcore.ApiSchema.fromLocalAsset(\n  path.join(__dirname, \"models\", \"smithy-model.json\")\n);\nsmithySchema.bind(this);\n\nconst smithyTarget = gateway.addSmithyTarget(\"MySmithyTarget\", {\n  gatewayTargetName: \"my-smithy-target\",\n  description: \"Smithy model target\",\n  smithyModel: smithySchema,\n\n});\n```\n\n- MCP Server Target\n\n```typescript fixture=default\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// OAuth2 (recommended): use OAuth2CredentialProvider + bindForGatewayOAuthTarget, or ARNs from console/API\nconst oauthProviderArn = \"arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/oauth2credentialprovider/my-oauth\";\nconst oauthSecretArn = \"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-oauth-secret-abc123\";\n\n// Add an MCP server target directly to the gateway\nconst mcpTarget = gateway.addMcpServerTarget(\"MyMcpServer\", {\n  gatewayTargetName: \"my-mcp-server\",\n  description: \"External MCP server integration\",\n  endpoint: \"https://my-mcp-server.example.com\",\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromOauthIdentityArn({\n      providerArn: oauthProviderArn,\n      secretArn: oauthSecretArn,\n      scopes:['mcp-runtime-server/invoke']\n    }),\n  ],\n});\n\n// Grant sync permission to a Lambda function that will trigger synchronization\nconst syncFunction = new lambda.Function(this, \"SyncFunction\", {\n  runtime: lambda.Runtime.PYTHON_3_12,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\nimport boto3\n\ndef handler(event, context):\n    client = boto3.client('bedrock-agentcore')\n    response = client.synchronize_gateway_targets(\n        gatewayIdentifier=event['gatewayId'],\n        targetIds=[event['targetId']]\n    )\n    return response\n  `),\n});\n\nmcpTarget.grantSync(syncFunction);\n```\n\n- API Gateway Target\n\n```typescript fixture=default\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst api = new apigateway.RestApi(this, 'MyApi', {\n  restApiName: 'my-api',\n});\n\n// Uses IAM authorization for outbound auth by default\nconst apiGatewayTarget = gateway.addApiGatewayTarget(\"MyApiGatewayTarget\", {\n  restApi: api,\n  apiGatewayToolConfiguration: {\n    toolFilters: [\n      {\n        filterPath: \"/pets/*\",\n        methods: [agentcore.ApiGatewayHttpMethod.GET],\n      },\n    ],\n  },\n});\n```\n\n#### Using static factory methods\n\nUse static factory methods when working with imported gateways, creating targets in different constructs/stacks, or when you need more explicit control over the construct tree hierarchy.\n\nCreate Gateway target using static convenience methods.\n\n- Lambda Target\n\n```typescript fixture=default\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst lambdaFunction = new lambda.Function(this, \"MyFunction\", {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\n        exports.handler = async (event) => {\n            return {\n                statusCode: 200,\n                body: JSON.stringify({ message: 'Hello from Lambda!' })\n            };\n        };\n    `),\n});\n\n// Create a gateway target with Lambda and tool schema\nconst target = agentcore.GatewayTarget.forLambda(this, \"MyLambdaTarget\", {\n  gatewayTargetName: \"my-lambda-target\",\n  description: \"Target for Lambda function integration\",\n  gateway: gateway,\n  lambdaFunction: lambdaFunction,\n  toolSchema: agentcore.ToolSchema.fromLocalAsset(\n    path.join(__dirname, \"schemas\", \"my-tool-schema.json\")\n  ),\n});\n```\n\n- OpenAPI Target\n\n```typescript fixture=default\n\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// Outbound auth: ApiKeyCredentialProvider + bindForGatewayApiKeyTarget, or ARNs from console/API\nconst apiKeyIdentityArn = \"arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/apikeycredentialprovider/my-apikey\"\nconst apiKeySecretArn = \"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-apikey-secret-abc123\"\n\nconst opneapiSchema = agentcore.ApiSchema.fromLocalAsset(path.join(__dirname, \"mySchema.yml\"));\nopneapiSchema.bind(this);\n\n// Create a gateway target with OpenAPI Schema\nconst target = agentcore.GatewayTarget.forOpenApi(this, \"MyTarget\", {\n  gatewayTargetName: \"my-api-target\",\n  description: \"Target for external API integration\",\n  gateway: gateway,  // Note: you need to pass the gateway reference\n  apiSchema: opneapiSchema,\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromApiKeyIdentityArn({\n     providerArn: apiKeyIdentityArn,\n     secretArn: apiKeySecretArn\n    }),\n  ],\n});\n\n```\n\n- Smithy Target\n\n```typescript fixture=default\n\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst smithySchema = agentcore.ApiSchema.fromLocalAsset(\n  path.join(__dirname, \"models\", \"smithy-model.json\")\n);\nsmithySchema.bind(this);\n\n// Create a gateway target with Smithy Model and OAuth\nconst target = agentcore.GatewayTarget.forSmithy(this, \"MySmithyTarget\", {\n  gatewayTargetName: \"my-smithy-target\",\n  description: \"Target for Smithy model integration\",\n  gateway: gateway,\n  smithyModel: smithySchema,\n});\n\n```\n\n- MCP Server Target\n\n```typescript fixture=default\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// OAuth2 (recommended): use OAuth2CredentialProvider + bindForGatewayOAuthTarget, or ARNs from console/API\nconst oauthProviderArn = \"arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/oauth2credentialprovider/my-oauth\";\nconst oauthSecretArn = \"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-oauth-secret-abc123\";\n\n// Create a gateway target with MCP Server\nconst mcpTarget = agentcore.GatewayTarget.forMcpServer(this, \"MyMcpServer\", {\n  gatewayTargetName: \"my-mcp-server\",\n  description: \"External MCP server integration\",\n  gateway: gateway,\n  endpoint: \"https://my-mcp-server.example.com\",\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromOauthIdentityArn({\n      providerArn: oauthProviderArn,\n      secretArn: oauthSecretArn,\n      scopes:['mcp-runtime-server/invoke']\n    }),\n  ],\n});\n```\n\n- API Gateway Target\n\n```typescript fixture=default\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst api = new apigateway.RestApi(this, 'MyApi', {\n  restApiName: 'my-api',\n});\n\n// Create a gateway target using the static factory method\nconst apiGatewayTarget = agentcore.GatewayTarget.forApiGateway(this, \"MyApiGatewayTarget\", {\n  gatewayTargetName: \"my-api-gateway-target\",\n  description: \"Target for API Gateway REST API integration\",\n  gateway: gateway,\n  restApi: api,\n  apiGatewayToolConfiguration: {\n    toolFilters: [\n      {\n        filterPath: \"/pets/*\",\n        methods: [agentcore.ApiGatewayHttpMethod.GET, agentcore.ApiGatewayHttpMethod.POST],\n      },\n    ],\n  },\n  metadataConfiguration: {\n    allowedRequestHeaders: [\"X-User-Id\"],\n    allowedQueryParameters: [\"limit\"],\n  },\n});\n```\n\n### Advanced Usage: Direct Configuration for gateway target\n\nFor advanced use cases where you need full control over the target configuration, you can create configurations manually using the static factory methods and use the GatewayTarget constructor directly.\n\n#### Configuration Factory Methods\n\nEach target type has a corresponding configuration class with a static `create()` method:\n\n- **Lambda**: `LambdaTargetConfiguration.create(lambdaFunction, toolSchema)`\n- **OpenAPI**: `OpenApiTargetConfiguration.create(apiSchema, validateSchema?)`\n- **Smithy**: `SmithyTargetConfiguration.create(smithyModel)`\n- **API Gateway**: `ApiGatewayTargetConfiguration.create(props)`\n\n#### Example: Lambda Target with Custom Configuration\n\n```typescript\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst myLambdaFunction = new lambda.Function(this, \"MyFunction\", {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\n    exports.handler = async (event) => ({ statusCode: 200 });\n  `),\n});\n\nconst myToolSchema = agentcore.ToolSchema.fromInline([{\n  name: \"my_tool\",\n  description: \"My custom tool\",\n  inputSchema: {\n    type: agentcore.SchemaDefinitionType.OBJECT,\n    properties: {},\n  },\n}]);\n\n// Create a custom Lambda configuration\nconst customConfig = agentcore.LambdaTargetConfiguration.create(\n  myLambdaFunction,\n  myToolSchema\n);\n\n// Use the GatewayTarget constructor directly\nconst target = new agentcore.GatewayTarget(this, \"AdvancedTarget\", {\n  gateway: gateway,\n  gatewayTargetName: \"advanced-target\",\n  targetConfiguration: customConfig,  // Manually created configuration\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromIamRole()\n  ]\n});\n```\n\nThis approach gives you full control over the configuration but is typically not necessary for most use cases. The convenience methods (`GatewayTarget.forLambda()`, `GatewayTarget.forOpenApi()`, `GatewayTarget.forSmithy()`, `GatewayTarget.forApiGateway()`) handle all of this internally.\n\n### Gateway Interceptors\n\nGateway interceptors allow you to run custom code during each gateway invocation to implement fine-grained access control, transform requests and responses, or implement custom authorization logic. A gateway can have at most one REQUEST interceptor and one RESPONSE interceptor.\n\n**Interceptor Types:**\n\n- **REQUEST interceptors**: Execute before the gateway calls the target. Useful for request validation, transformation, or custom authorization\n- **RESPONSE interceptors**: Execute after the target responds but before the gateway sends the response back. Useful for response transformation, filtering, or adding custom headers\n\n**Security Best Practices:**\n\n1. Keep `passRequestHeaders` disabled unless absolutely necessary (default: false)\n2. Implement idempotent Lambda functions (gateway may retry on failures)\n3. Restrict gateway execution role to specific Lambda functions\n4. Avoid logging sensitive information in your interceptor\n\nFor more information, see the [Gateway Interceptors documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-interceptors.html).\n\n#### Adding Interceptors via Constructor\n\n```typescript fixture=default\n// Create Lambda functions for interceptors\nconst requestInterceptorFn = new lambda.Function(this, \"RequestInterceptor\", {\n  runtime: lambda.Runtime.PYTHON_3_12,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\ndef handler(event, context):\n    # Validate and transform request\n    return {\n        \"interceptorOutputVersion\": \"1.0\",\n        \"mcp\": {\n            \"transformedGatewayRequest\": event[\"mcp\"][\"gatewayRequest\"]\n        }\n    }\n  `),\n});\n\nconst responseInterceptorFn = new lambda.Function(this, \"ResponseInterceptor\", {\n  runtime: lambda.Runtime.PYTHON_3_12,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\ndef handler(event, context):\n    # Filter or transform response\n    return {\n        \"interceptorOutputVersion\": \"1.0\",\n        \"mcp\": {\n            \"transformedGatewayResponse\": event[\"mcp\"][\"gatewayResponse\"]\n        }\n    }\n  `),\n});\n\n// Create gateway with interceptors\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  interceptorConfigurations: [\n    agentcore.LambdaInterceptor.forRequest(requestInterceptorFn, {\n      passRequestHeaders: true  // Only if you need to inspect headers\n    }),\n    agentcore.LambdaInterceptor.forResponse(responseInterceptorFn)\n  ]\n});\n```\n\n**Automatic Permission Granting:**\n\nWhen you add a Lambda interceptor to a gateway (either via constructor or `addInterceptor()`), the gateway's IAM role automatically receives `lambda:InvokeFunction` permission on the Lambda function. This permission grant happens internally during the bind process - you do not need to manually configure these IAM permissions.\n\n#### Adding Interceptors Dynamically\n\n```typescript fixture=default\n// Create a gateway first\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// Create Lambda functions for interceptors\nconst requestInterceptorFn = new lambda.Function(this, \"RequestInterceptor\", {\n  runtime: lambda.Runtime.PYTHON_3_12,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\ndef handler(event, context):\n    # Custom request validation logic\n    return {\n        \"interceptorOutputVersion\": \"1.0\",\n        \"mcp\": {\n            \"transformedGatewayRequest\": event[\"mcp\"][\"gatewayRequest\"]\n        }\n    }\n  `),\n});\n\nconst responseInterceptorFn = new lambda.Function(this, \"ResponseInterceptor\", {\n  runtime: lambda.Runtime.PYTHON_3_12,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\ndef handler(event, context):\n    # Filter sensitive data from response\n    return {\n        \"interceptorOutputVersion\": \"1.0\",\n        \"mcp\": {\n            \"transformedGatewayResponse\": event[\"mcp\"][\"gatewayResponse\"]\n        }\n    }\n  `),\n});\n\ngateway.addInterceptor(\n  agentcore.LambdaInterceptor.forRequest(requestInterceptorFn, {\n    passRequestHeaders: false  // Default, headers not passed for security\n  })\n);\n\ngateway.addInterceptor(\n  agentcore.LambdaInterceptor.forResponse(responseInterceptorFn)\n);\n```\n\n### Gateway Target IAM Permissions\n\nThe Gateway Target construct provides convenient methods for granting IAM permissions:\n\n```typescript fixture=default\n// Create a gateway and target\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst smithySchema = agentcore.ApiSchema.fromLocalAsset(\n  path.join(__dirname, \"models\", \"smithy-model.json\")\n);\nsmithySchema.bind(this);\n\n// Create a gateway target with Smithy Model and OAuth\nconst target = agentcore.GatewayTarget.forSmithy(this, \"MySmithyTarget\", {\n  gatewayTargetName: \"my-smithy-target\",\n  description: \"Target for Smithy model integration\",\n  gateway: gateway,\n  smithyModel: smithySchema,\n});\n\n// Create a role that needs access to the gateway target\nconst userRole = new iam.Role(this, \"UserRole\", {\n  assumedBy: new iam.ServicePrincipal(\"lambda.amazonaws.com\"),\n});\n\n// Grant read permissions (Get and List actions)\ntarget.grantRead(userRole);\n\n// Grant manage permissions (Create, Update, Delete actions)\ntarget.grantManage(userRole);\n\n// Grant specific custom permissions\ntarget.grant(userRole, \"bedrock-agentcore:GetGatewayTarget\");\n\n\n// Grants permission to invoke this Gateway\ngateway.grantInvoke(userRole);\n```\n\n## Memory\n\nMemory is a critical component of intelligence. While Large Language Models (LLMs) have impressive capabilities, they lack persistent memory across conversations. Amazon Bedrock AgentCore Memory addresses this limitation by providing a managed service that enables AI agents to maintain context over time, remember important facts, and deliver consistent, personalized experiences.\n\nAgentCore Memory operates on two levels:\n\n- **Short-Term Memory**: Immediate conversation context and session-based information that provides continuity within a single interaction or closely related sessions.\n- **Long-Term Memory**: Persistent information extracted and stored across multiple conversations, including facts, preferences, and summaries that enable personalized experiences over time.\n\nWhen you interact with the memory via the `CreateEvent` API, you store interactions in Short-Term Memory (STM) instantly. These interactions can include everything from user messages, assistant responses, to tool actions.\n\nTo write to long-term memory, you need to configure extraction strategies which define how and where to store information from conversations for future use. These strategies are asynchronously processed from raw events after every few turns based on the strategy that was selected. You can't create long term memory records directly, as they are extracted asynchronously by AgentCore Memory.\n\n### Memory Properties\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `memoryName` | `string` | No | The name of the memory. If not provided, a unique name will be auto-generated |\n| `expirationDuration` | `Duration` | No | Short-term memory expiration in days (between 7 and 365). Default: 90 days |\n| `description` | `string` | No | Optional description for the memory. Default: no description. |\n| `kmsKey` | `IKey` | No | Custom KMS key to use for encryption. Default: Your data is encrypted with a key that AWS owns and manages for you |\n| `memoryStrategies` | `MemoryStrategyBase[]` | No | Built-in extraction strategies to use for this memory. Default: No extraction strategies (short term memory only) |\n| `executionRole` | `iam.IRole` | No | The IAM role that provides permissions for the memory to access AWS services. Default: A new role will be created. |\n| `tags` | `{ [key: string]: string }` | No | Tags for memory. Default: no tags. |\n\n### Basic Memory Creation\n\nBelow you can find how to configure a simple short-term memory (STM) with no long-term memory extraction strategies.\nNote how you set `expirationDuration`, which defines the time the events will be stored in the short-term memory before they expire.\n\n```typescript fixture=default\n\n// Create a basic memory with default settings, no LTM strategies\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my_memory\",\n  description: \"A memory for storing user interactions for a period of 90 days\",\n  expirationDuration: cdk.Duration.days(90),\n});\n```\n\nBasic Memory with Custom KMS Encryption\n\n```typescript fixture=default\n// Create a custom KMS key for encryption\nconst encryptionKey = new kms.Key(this, \"MemoryEncryptionKey\", {\n  enableKeyRotation: true,\n  description: \"KMS key for memory encryption\",\n});\n\n// Create memory with custom encryption\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my_encrypted_memory\",\n  description: \"Memory with custom KMS encryption\",\n  expirationDuration: cdk.Duration.days(90),\n  kmsKey: encryptionKey,\n});\n```\n\n### LTM Memory Extraction Stategies\n\nIf you need long-term memory for context recall across sessions, you can setup memory extraction strategies\nto extract the relevant memory from the raw events.\n\nAmazon Bedrock AgentCore Memory has different memory strategies for extracting and organizing information:\n\n- **Summarization**: to summarize interactions to preserve critical context and key insights.\n- **Semantic Memory**: to extract general factual knowledge, concepts and meanings from raw conversations using vector embeddings.\nThis enables similarity-based retrieval of relevant facts and context.\n- **User Preferences**: to extract user behavior patterns from raw conversations.\n\nYou can use built-in extraction strategies for quick setup, or create custom extraction strategies with specific models and prompt templates.\n\n### Memory with Built-in Strategies\n\nThe library provides four built-in LTM strategies. These are default strategies for organizing and extracting memory data,\neach optimized for specific use cases.\n\nFor example: An agent helps multiple users with cloud storage setup. From these conversations,\nsee how each strategy processes users expressing confusion about account connection:\n\n1. **Summarization Strategy** (`MemoryStrategy.usingBuiltInSummarization()`)\nThis strategy compresses conversations into concise overviews, preserving essential context and key insights for quick recall.\nExtracted memory example: Users confused by cloud setup during onboarding.\n\n   - Extracts concise summaries to preserve critical context and key insights\n   - Namespace: `/strategies/{memoryStrategyId}/actors/{actorId}/sessions/{sessionId}`\n\n2. **Semantic Memory Strategy** (`MemoryStrategy.usingBuiltInSemantic()`)\nDistills general facts, concepts, and underlying meanings from raw conversational data, presenting the information in a context-independent format.\nExtracted memory example: In-context learning = task-solving via examples, no training needed.\n\n   - Extracts general factual knowledge, concepts and meanings from raw conversations\n   - Namespace: `/strategies/{memoryStrategyId}/actors/{actorId}`\n\n3. **User Preference Strategy** (`MemoryStrategy.usingBuiltInUserPreference()`)\nCaptures individual preferences, interaction patterns, and personalized settings to enhance future experiences.\nExtracted memory example: User needs clear guidance on cloud storage account connection during onboarding.\n\n   - Extracts user behavior patterns from raw conversations\n   - Namespace: `/strategies/{memoryStrategyId}/actors/{actorId}`\n\n4. **Episodic Memory Strategy** (`MemoryStrategy.usingBuiltInEpisodic()`)\nCaptures meaningful slices of user and system interactions, preserve them into compact records after summarizing.\nExtracted memory example: User first asked about pricing on Monday, then requested feature comparison on Tuesday, finally made purchase decision on Wednesday.\n\n   - Captures event sequences and temporal relationships\n   - Namespace: `/strategy/{memoryStrategyId}/actor/{actorId}/session/{sessionId}`\n   - Reflections: `/strategy/{memoryStrategyId}/actor/{actorId}`\n\n```typescript fixture=default\n// Create memory with built-in strategies\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my_memory\",\n  description: \"Memory with built-in strategies\",\n  expirationDuration: cdk.Duration.days(90),\n  memoryStrategies: [\n    agentcore.MemoryStrategy.usingBuiltInSummarization(),\n    agentcore.MemoryStrategy.usingBuiltInSemantic(),\n    agentcore.MemoryStrategy.usingBuiltInUserPreference(),\n    agentcore.MemoryStrategy.usingBuiltInEpisodic(),\n  ],\n});\n```\n\nThe name generated for each built in memory strategy is as follows:\n\n- For Summarization: `summary_builtin_cdk001`\n- For Semantic:`semantic_builtin_cdk001>`\n- For User Preferences: `preference_builtin_cdk001`\n- For Episodic : `episodic_builtin_cdkGen0001`\n\n### Memory with custom Strategies\n\nWith Long-Term Memory, organization is managed through Namespaces.\n\nAn `actor` refers to entity such as end users or agent/user combinations. For example, in a coding support chatbot,\nthe actor is usually the developer asking questions. Using the actor ID helps the system know which user the memory belongs to,\nkeeping each user's data separate and organized.\n\nA `session` is usually a single conversation or interaction period between the user and the AI agent.\nIt groups all related messages and events that happen during that conversation.\n\nA `namespace` is used to logically group and organize long-term memories. It ensures data stays neat, separate, and secure.\n\nWith AgentCore Memory, you need to add a namespace when you define a memory strategy. This namespace helps define where the long-term memory\nwill be logically grouped. Every time a new long-term memory is extracted using this memory strategy, it is saved under the namespace you set.\nThis means that all long-term memories are scoped to their specific namespace, keeping them organized and preventing any mix-ups with other\nusers or sessions. You should use a hierarchical format separated by forward slashes /. This helps keep memories organized clearly. As needed,\nyou can choose to use the below pre-defined variables within braces in the namespace based on your applications' organization needs:\n\n- `actorId` – Identifies who the long-term memory belongs to, such as a user\n- `memoryStrategyId` – Shows which memory strategy is being used. This strategy identifier is auto-generated when you create a memory using CreateMemory operation.\n- `sessionId` – Identifies which session or conversation the memory is from.\n\nFor example, if you define the following namespace as the input to your strategy in CreateMemory operation:\n\n```shell\n/strategy/{memoryStrategyId}/actor/{actorId}/session/{sessionId}\n```\n\nAfter memory creation, this namespace might look like:\n\n```shell\n/strategy/summarization-93483043//actor/actor-9830m2w3/session/session-9330sds8\n```\n\nYou can customise the namespace, i.e. where the memories are stored by using the following methods:\n\n1. **Summarization Strategy** (`MemoryStrategy.usingSummarization(props)`)\n1. **Semantic Memory Strategy** (`MemoryStrategy.usingSemantic(props)`)\n1. **User Preference Strategy** (`MemoryStrategy.usingUserPreference(props)`)\n1. **Episodic Memory Strategy** (`MemoryStrategy.usingEpisodic(props)`)\n\n```typescript fixture=default\n// Create memory with custom strategies\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my_memory\",\n  description: \"Memory with custom strategies\",\n  expirationDuration: cdk.Duration.days(90),\n  memoryStrategies: [\n    agentcore.MemoryStrategy.usingUserPreference({\n        name: \"CustomerPreferences\",\n        namespaces: [\"support/customer/{actorId}/preferences\"]\n    }),\n    agentcore.MemoryStrategy.usingSemantic({\n        name: \"CustomerSupportSemantic\",\n        namespaces: [\"support/customer/{actorId}/semantic\"]\n    }),\n     agentcore.MemoryStrategy.usingEpisodic({\n        name: \"customerJourneyEpisodic\",\n        namespaces: [\"/journey/customer/{actorId}/episodes\"],\n        reflectionConfiguration: {\n            namespaces: [\"/journey/customer/{actorId}/reflections\"]\n        }\n    }),\n  ],\n});\n```\n\nCustom memory strategies let you tailor memory extraction and consolidation to your specific domain or use case.\nYou can override the prompts for extracting and consolidating semantic, summary, or user preferences.\nYou can also choose the model that you want to use for extraction and consolidation.\n\nThe custom prompts you create are appended to a non-editable system prompt.\n\nSince a custom strategy requires you to invoke certain FMs, you need a role with appropriate permissions. For that, you can:\n\n- Let the L2 construct create a minimum permission role for you when use L2 Bedrock Foundation Models.\n- Use a custom role with the overly permissive `AmazonBedrockAgentCoreMemoryBedrockModelInferenceExecutionRolePolicy` managed policy.\n- Use a custom role with your own custom policies.\n\n#### Memory with Custom Execution Role\n\nKeep in mind that memories that **do not** use custom strategies do not require a service role.\nSo even if you provide it, it will be ignored as it will never be used.\n\n```typescript fixture=default\n// Create a custom execution role\nconst executionRole = new iam.Role(this, \"MemoryExecutionRole\", {\n  assumedBy: new iam.ServicePrincipal(\"bedrock-agentcore.amazonaws.com\"),\n  managedPolicies: [\n    iam.ManagedPolicy.fromAwsManagedPolicyName(\n      \"AmazonBedrockAgentCoreMemoryBedrockModelInferenceExecutionRolePolicy\"\n    ),\n  ],\n});\n\n// Create memory with custom execution role\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my_memory\",\n  description: \"Memory with custom execution role\",\n  expirationDuration: cdk.Duration.days(90),\n  executionRole: executionRole,\n});\n```\n\nIn customConsolidation and customExtraction, the model property uses the [@aws-cdk/aws-bedrock-alph](https://www.npmjs.com/package/@aws-cdk/aws-bedrock-alpha) library which must be installed separately.\n\n```typescript fixture=default\n// Create a custom semantic memory strategy\nconst customSemanticStrategy = agentcore.MemoryStrategy.usingSemantic({\n  name: \"customSemanticStrategy\",\n  description: \"Custom semantic memory strategy\",\n  namespaces: [\"/custom/strategies/{memoryStrategyId}/actors/{actorId}\"],\n  customConsolidation: {\n    model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V1_0,\n    appendToPrompt: \"Custom consolidation prompt for semantic memory\",\n  },\n  customExtraction: {\n    model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V1_0,\n    appendToPrompt: \"Custom extraction prompt for semantic memory\",\n  },\n});\n\n// Create memory with custom strategy\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my-custom-memory\",\n  description: \"Memory with custom strategy\",\n  expirationDuration: cdk.Duration.days(90),\n  memoryStrategies: [customSemanticStrategy],\n});\n```\n\n### Memory with self-managed Strategies\n\nA self-managed strategy in Amazon Bedrock AgentCore Memory gives you complete control over your memory extraction and consolidation pipelines.\nWith a self-managed strategy, you can build custom memory processing workflows while leveraging Amazon Bedrock AgentCore for storage and retrieval.\n\nFor additional information, you can refer to the [developer guide for self managed strategies](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/memory-self-managed-strategies.html).\n\nCreate the required AWS resources including:\n\n- an S3 bucket in your account where Amazon Bedrock AgentCore will deliver batched event payloads.\n- an SNS topic for job notifications. Use FIFO topics if processing order within sessions is important for your use case.\n\nThe construct will apply the correct permissions to the memory execution role to access these resources.\n\n```typescript fixture=default\n\nconst bucket = new s3.Bucket(this, 'memoryBucket', {\n  bucketName: 'test-memory',\n  removalPolicy: cdk.RemovalPolicy.DESTROY,\n  autoDeleteObjects: true,\n});\n\nconst topic = new sns.Topic(this, 'topic');\n\n// Create a custom semantic memory strategy\nconst selfManagedStrategy = agentcore.MemoryStrategy.usingSelfManaged({\n  name: \"selfManagedStrategy\",\n  description: \"self managed memory strategy\",\n  historicalContextWindowSize: 5,\n  invocationConfiguration: {\n    topic: topic,\n    s3Location: {\n      bucketName: bucket.bucketName,\n      objectKey: 'memory/',\n    }\n  },\n  triggerConditions: {\n    messageBasedTrigger: 1,\n    timeBasedTrigger: cdk.Duration.seconds(10),\n    tokenBasedTrigger: 100\n  }\n});\n\n// Create memory with custom strategy\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my-custom-memory\",\n  description: \"Memory with custom strategy\",\n  expirationDuration: cdk.Duration.days(90),\n  memoryStrategies: [selfManagedStrategy],\n});\n```\n\n### Memory Strategy Methods\n\nYou can add new memory strategies to the memory construct using the `addMemoryStrategy()` method, for instance:\n\n```typescript fixture=default\n// Create memory without initial strategies\nconst memory = new agentcore.Memory(this, \"test-memory\", {\n  memoryName: \"test_memory_add_strategy\",\n  description: \"A test memory for testing addMemoryStrategy method\",\n  expirationDuration: cdk.Duration.days(90),\n});\n\n// Add strategies after instantiation\nmemory.addMemoryStrategy(agentcore.MemoryStrategy.usingBuiltInSummarization());\nmemory.addMemoryStrategy(agentcore.MemoryStrategy.usingBuiltInSemantic());\n```\n\n## Policy Engine\n\nA policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with a gateway, the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies.\n\nFor more information, see the [Policy in Amazon Bedrock AgentCore documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.html).\n\n### PolicyEngine Properties\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `policyEngineName` | `string` | No | The name of the policy engine. Valid characters: a-z, A-Z, 0-9, _ (underscore). Must start with a letter, 1-48 characters. If not provided, a unique name will be auto-generated |\n| `description` | `string` | No | Optional description for the policy engine (max 4,096 characters). Default: no description |\n| `kmsKey` | `IKey` | No | Custom KMS key for encryption. **IMPORTANT**: Once set, cannot be changed (requires replacement). Must be symmetric ENCRYPT_DECRYPT key. If key becomes inaccessible, all authorization decisions will be DENIED. Default: AWS owned key |\n| `tags` | `{ [key: string]: string }` | No | Tags for the policy engine (max 50 tags). Default: no tags |\n\n### Understanding Cedar Policies in AgentCore\n\nPolicies are constructed using [Cedar language](https://www.cedarpolicy.com/en/tutorial), an open source language for writing and enforcing authorization policies.\nCedar policies in AgentCore follow a specific structure with three main components: **Principal**, **Action**, and **Resource**. Understanding how these components work together is critical for writing effective policies.\n\n#### Policy Structure\n\nEvery Cedar policy has this basic structure:\n\n```cedar\npermit(              // or forbid\n  principal,         // Who is making the request\n  action,            // What operation they want to perform\n  resource           // What Gateway/tool they want to access\n)\nwhen {               // Optional conditions\n  // Additional constraints\n};\n```\n\nExample Policy\n\n```cedar\npermit(\n  principal,\n  action == AgentCore::Action::\"ApplicationToolTarget___create_application\",\n  resource == AgentCore::Gateway::\"<gateway-arn>\"\n) when {\n  context.input.coverage_amount <= 1000000\n};\n```\n\n### Basic PolicyEngine and Policy Creation\n\nCreate a policy engine and add policies to it.\n\n#### Policy Engine Mode\n\nWhen associating a policy engine with a gateway, you can control the enforcement behavior using `PolicyEngineMode`:\n\n- `PolicyEngineMode.LOG_ONLY` (default) — evaluates actions and adds traces but does not enforce decisions. Use this mode for testing and validation before enabling enforcement.\n- `PolicyEngineMode.ENFORCE` — actively allows or denies agent operations based on Cedar policy evaluation.\n\n```typescript fixture=default\n\n// Create a Policy engine\nconst policyEngine = new agentcore.PolicyEngine(this, \"MyPolicyEngine\", {\n  policyEngineName: \"my_policy_engine\",\n  description: \"Policy engine for access control\",\n});\n\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  policyEngineConfiguration: {\n    policyEngine: policyEngine,\n    mode: agentcore.PolicyEngineMode.ENFORCE, // Default is LOG_ONLY\n  },\n});\n\n// Add policy to policy engine\npolicyEngine.addPolicy(\"AllowAllActions\", {\n  definition: `\n    permit(\n      principal,\n      action,\n      resource == AgentCore::Gateway::\"${gateway.gatewayArn}\"\n    );\n  `,\n  description: \"Allow all actions on specific gateway (development)\",\n  validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS, // This will ignore all cedar warnings\n});\n\n// you can add multiple policies to the policy engine\npolicyEngine.addPolicy(\"SpecificToolPolicy\", {\n  definition: `\n    permit(\n      principal is AgentCore::OAuthUser,\n      action == AgentCore::Action::\"WeatherTool__get_forecast\",\n      resource == AgentCore::Gateway::\"${gateway.gatewayArn}\"\n    );\n  `,\n  description: \"Allow specific weather tool access\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS, // This will fail policy creation for any cedar warning\n});\n```\n\n### Type-Safe Policy Builder\n\nFor a more type-safe approach, use the `PolicyStatement` builder instead of writing raw Cedar syntax.\n\n```typescript fixture=default\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst policyEngine = new agentcore.PolicyEngine(this, \"MyPolicyEngine\", {\n  policyEngineName: \"my_policy_engine\",\n});\n\nconst allowAllPolicy = new agentcore.Policy(this, \"AllowAllPolicy\", {\n  policyEngine: policyEngine,\n  policyName: \"allow_all\",\n  statement: agentcore.PolicyStatement.permit()\n    .forAllPrincipals() // ** This will give overly permission to all principals\n    .onAllActions()\n    .onResource('AgentCore::Gateway', gateway.gatewayArn),\n  description: \"Allow all actions on specific gateway (development only)\",\n  validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS,\n});\n\n// Generated Cedar:\n// permit(\n//   principal,\n//   action,\n//   resource == AgentCore::Gateway::\"arn:aws:bedrock-agentcore:region:account:gateway/gateway-id\"\n// );\n```\n\n#### Policy with Specific Actions\n\n```typescript fixture=default\ndeclare const policyEngine: agentcore.PolicyEngine;\ndeclare const gateway: agentcore.Gateway;\n\n// Allow specific tool actions on specific gateway\n// Action names follow pattern: \"ToolName__operation\"\npolicyEngine.addPolicy(\"SpecificToolPolicy\", {\n  statement: agentcore.PolicyStatement.permit()\n    .forPrincipal('AgentCore::OAuthUser::your-client-id')\n    .onActions([\n      'AgentCore::Action::WeatherTool__get_forecast',\n      'AgentCore::Action::WeatherTool__get_current',\n    ])\n    .onResource('AgentCore::Gateway', gateway.gatewayArn),\n  description: \"Allow specific weather tool operations\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,\n});\n\n// Generated Cedar:\n// permit(\n//   principal is AgentCore::OAuthUser,\n//   action in [\n//     AgentCore::Action::\"WeatherTool__get_forecast\",\n//     AgentCore::Action::\"WeatherTool__get_current\"\n//   ],\n//   resource == AgentCore::Gateway::\"arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-123\"\n// );\n```\n\n#### Policy with Conditions\n\nUse `when` clauses to add advanced conditions based on principal tags (from OAuth token) or context:\n\n```typescript fixture=default\ndeclare const policyEngine: agentcore.PolicyEngine;\ndeclare const gateway: agentcore.Gateway;\n\n// Policy with when conditions using principal tags\nconst conditionalPolicy = new agentcore.Policy(this, \"ConditionalPolicy\", {\n  policyEngine: policyEngine,\n  policyName: \"conditional_access\",\n  statement: agentcore.PolicyStatement.permit()\n    .forPrincipal('AgentCore::OAuthUser')  // Type constraint\n    .onAllActions()\n    .onResource('AgentCore::Gateway', gateway.gatewayArn)  // Specific ARN\n    .when()\n      .principalAttribute('department').equalTo('Engineering')\n      .and()\n      .contextAttribute('input.priority').equalTo('high')\n      .done(),\n  description: \"Allow engineers for high-priority requests\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,\n});\n\n// Generated Cedar:\n// permit(\n//   principal is AgentCore::OAuthUser,\n//   action,\n//   resource == AgentCore::Gateway::\"arn:...\"\n// )\n// when {\n//   principal.department == \"Engineering\" && context.input.priority == \"high\"\n// };\n```\n\n#### Policy with Exclusions (unless)\n\nUse `unless` clauses to exclude specific conditions from a policy. The policy applies when the `unless` conditions are NOT met:\n\n```typescript fixture=default\ndeclare const policyEngine: agentcore.PolicyEngine;\ndeclare const gateway: agentcore.Gateway;\n\n// Allow access unless the user is suspended\nconst policyWithUnless = new agentcore.Policy(this, \"UnlessPolicy\", {\n  policyEngine: policyEngine,\n  policyName: \"unless_suspended\",\n  statement: agentcore.PolicyStatement.permit()\n    .forPrincipal('AgentCore::OAuthUser')\n    .onAllActions()\n    .onResource('AgentCore::Gateway', gateway.gatewayArn)\n    .unless()\n      .principalAttribute('suspended').equalTo(true)\n      .done(),\n  description: \"Allow all actions unless user is suspended\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,\n});\n\n// Generated Cedar:\n// permit(\n//   principal is AgentCore::OAuthUser,\n//   action,\n//   resource == AgentCore::Gateway::\"arn:...\"\n// )\n// unless {\n//   principal.suspended == true\n// };\n```\n\nYou can combine `when` and `unless` clauses in the same policy:\n\n```typescript fixture=default\ndeclare const policyEngine: agentcore.PolicyEngine;\ndeclare const gateway: agentcore.Gateway;\n\n// Allow engineers unless they are on probation\npolicyEngine.addPolicy(\"CombinedConditions\", {\n  statement: agentcore.PolicyStatement.permit()\n    .forPrincipal('AgentCore::OAuthUser')\n    .onAllActions()\n    .onResource('AgentCore::Gateway', gateway.gatewayArn)\n    .when()\n      .principalAttribute('department').equalTo('Engineering')\n      .done()\n    .unless()\n      .principalAttribute('status').equalTo('probation')\n      .done(),\n  description: \"Allow engineers unless on probation\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,\n});\n```\n\n#### Forbid (Deny) Policy\n\nUse `forbid` to explicitly deny access. Forbid policies override permit policies.\n\n```typescript fixture=default\ndeclare const policyEngine: agentcore.PolicyEngine;\ndeclare const gateway: agentcore.Gateway;\n\n// Explicitly deny dangerous tool operations\npolicyEngine.addPolicy(\"DenyDangerous\", {\n  statement: agentcore.PolicyStatement.forbid()\n    .forAllPrincipals()\n    .onAction('AgentCore::Action::DeleteTool__delete_all')\n    .onResource('AgentCore::Gateway', gateway.gatewayArn),\n  description: \"Forbid delete_all operation for all users\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,\n});\n\n// Generated Cedar:\n// forbid(\n//   principal,\n//   action == AgentCore::Action::\"DeleteTool__delete_all\",\n//   resource == AgentCore::Gateway::\"arn:...\"\n// );\n```\n\n#### Raw Cedar for Advanced Cases\n\nFor advanced Cedar features not supported by the builder, use raw Cedar strings:\n\n```typescript fixture=default\ndeclare const policyEngine: agentcore.PolicyEngine;\n\n// Option 1: Using definition property\nconst advancedPolicy = new agentcore.Policy(this, \"AdvancedPolicy\", {\n  policyEngine: policyEngine,\n  definition: 'permit(principal, action, resource) when { context.custom > 10 };',\n  description: \"Advanced policy with custom Cedar logic\",\n});\n\n// Option 2: Using fromCedar() with statement property\npolicyEngine.addPolicy(\"CustomPolicy\", {\n  statement: agentcore.PolicyStatement.fromCedar(\n    'forbid(principal, action, resource) when { resource.confidential == true };'\n  ),\n  description: \"Custom policy from Cedar string\",\n});\n```\n\n**Note**: You must specify **either** `definition` (raw Cedar string) **or** `statement` (PolicyStatement builder), but not both.\n\n#### Accessing Policies on PolicyEngine\n\nYou can access the list of policies added to a PolicyEngine using policyEngine.policies.\n\n### PolicyEngine with KMS Encryption\n\nEncrypt policy data with a custom KMS key.\n\n```typescript fixture=default\n// Create a custom KMS key\nconst policyKey = new kms.Key(this, \"PolicyEngineKey\", {\n  enableKeyRotation: true,\n  description: \"KMS key for policy engine encryption\",\n});\n\n// Create policy engine with encryption\nconst policyEngine = new agentcore.PolicyEngine(this, \"EncryptedEngine\", {\n  policyEngineName: \"encrypted_engine\",\n  description: \"Policy engine with KMS encryption\",\n  kmsKey: policyKey,\n});\n```\n\n### Importing Existing PolicyEngine\n\nImport an existing policy engine from its ARN:\n\n```typescript fixture=default\nconst importedEngine = agentcore.PolicyEngine.fromPolicyEngineAttributes(\n  this,\n  \"ImportedEngine\",\n  {\n    policyEngineArn: \"policy-engine-arn\",\n    kmsKeyArn: \"kms-arn\",\n  }\n);\n\n// Use the imported engine\nconst policy = new agentcore.Policy(this, \"PolicyForImportedEngine\", {\n  policyEngine: importedEngine,\n  definition: \"permit(principal, action, resource);\",\n});\n```\n\n### Importing Existing Policy\n\nImport an existing policy from its ARN:\n\n```typescript fixture=default\nconst importedEngine = agentcore.PolicyEngine.fromPolicyEngineAttributes(\n  this,\n  \"ImportedEngine\",\n  {\n    policyEngineArn: \"policy-engine/my-engine-id\",\n  }\n);\n\nconst importedPolicy = agentcore.Policy.fromPolicyAttributes(\n  this,\n  \"ImportedPolicy\",\n  {\n    policyArn: \"my-policy-arn\",\n    policyEngine: importedEngine,\n  }\n);\n\n// Grant permissions to the imported policy\nconst role = new iam.Role(this, \"PolicyRole\", {\n  assumedBy: new iam.ServicePrincipal(\"lambda.amazonaws.com\"),\n});\n\nimportedPolicy.grantRead(role);\n```\n\n### PolicyEngine IAM Permissions\n\nGrant various levels of access to policy engines:\n\n```typescript fixture=default\nconst policyEngine = new agentcore.PolicyEngine(this, \"MyEngine\", {\n  policyEngineName: \"my_engine\",\n});\n\nconst lambdaRole = new iam.Role(this, \"LambdaRole\", {\n  assumedBy: new iam.ServicePrincipal(\"lambda.amazonaws.com\"),\n});\n\n// Grant read permissions\npolicyEngine.grantRead(lambdaRole);\n\n// Grant evaluation permissions\npolicyEngine.grantEvaluate(lambdaRole);\n\n```\n\n## Online Evaluation\n\nThe Online Evaluation construct enables continuous monitoring and assessment of your agent's performance using live traffic. It automatically samples agent traces from CloudWatch Logs or Agent Endpoints and applies built-in evaluators to assess quality metrics like helpfulness, correctness, and safety.\n\n### Prerequisites\n\nBefore creating an `OnlineEvaluationConfig`, ensure the following are configured in your account:\n\n- **CloudWatch Transaction Search** enabled — this creates the `aws/spans` log group required by the evaluation service. See [Enable Transaction Search](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-configure.html).\n- **AWS Distro for OpenTelemetry (ADOT) SDK** instrumenting your agent to emit traces.\n\nFor full details, see [AgentCore Evaluations Prerequisites](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/evaluations-prerequisites.html).\n\n### Online Evaluation Properties\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `onlineEvaluationConfigName` | `string` | Yes | The name of the online evaluation configuration. Must start with a letter and can contain a-z, A-Z, 0-9, _ (underscore). Maximum 48 characters |\n| `evaluators` | `EvaluatorReference[]` | Yes | The list of built-in evaluators to apply during evaluation. Minimum 1, maximum 10 |\n| `dataSource` | `DataSourceConfig` | Yes | The data source configuration specifying where to read agent traces from |\n| `executionRole` | `iam.IRole` | No | The IAM role for evaluation. If not provided, a role will be created automatically |\n| `description` | `string` | No | Description of the evaluation configuration. Maximum 200 characters |\n| `samplingPercentage` | `number` | No | Percentage of traces to sample (0.01-100). Default: 10 |\n| `filters` | `FilterConfig[]` | No | Filters to determine which traces to evaluate. Use `FilterValue.string()`, `FilterValue.number()`, or `FilterValue.boolean()` for typed filter values. Maximum 5 |\n| `sessionTimeout` | `Duration` | No | Duration of inactivity before a session is considered complete (1-1440 minutes). Default: `Duration.minutes(15)` |\n| `tags` | `{ [key: string]: string }` | No | Tags for the evaluation configuration |\n\n### Basic Online Evaluation Creation\n\nCreate an online evaluation configuration with built-in evaluators:\n\n```typescript fixture=default\nconst evaluation = new agentcore.OnlineEvaluationConfig(this, 'MyEvaluation', {\n  onlineEvaluationConfigName: 'my_evaluation',\n  evaluators: [\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.CORRECTNESS),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: ['/aws/bedrock-agentcore/my-agent'],\n    serviceNames: ['my-agent.default'],\n  }),\n});\n```\n\n### Built-in Evaluators\n\nAmazon Bedrock AgentCore provides 13 built-in evaluators that assess different aspects of agent performance:\n\n**Session-Level Evaluators:**\n\n- `GOAL_SUCCESS_RATE` - Evaluates whether the conversation successfully meets the user's goals\n\n**Trace-Level Evaluators:**\n\n- `HELPFULNESS` - How useful and valuable the agent's response is\n- `CORRECTNESS` - Whether the information is factually accurate\n- `FAITHFULNESS` - Whether the response is faithful to the provided context\n- `HARMFULNESS` - Whether the response contains harmful content\n- `STEREOTYPING` - Detects content that makes generalizations about individuals or groups\n- `REFUSAL` - Whether the agent appropriately refuses harmful requests\n- `COHERENCE` - Whether the response is logically coherent\n- `RESPONSE_RELEVANCE` - Whether the response appropriately addresses the user's query\n- `CONCISENESS` - Whether the response is appropriately concise\n- `INSTRUCTION_FOLLOWING` - How well the agent follows system instructions\n\n**Tool Call-Level Evaluators:**\n\n- `TOOL_SELECTION_ACCURACY` - Whether the agent selected the appropriate tool\n- `TOOL_PARAMETER_ACCURACY` - How accurately the agent extracts parameters from user queries\n\n```typescript fixture=default\nconst evaluation = new agentcore.OnlineEvaluationConfig(this, 'ComprehensiveEval', {\n  onlineEvaluationConfigName: 'comprehensive_evaluation',\n  evaluators: [\n    // Session level\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.GOAL_SUCCESS_RATE),\n    // Trace level - quality\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.CORRECTNESS),\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.COHERENCE),\n    // Trace level - safety\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HARMFULNESS),\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.STEREOTYPING),\n    // Tool call level\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.TOOL_SELECTION_ACCURACY),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: ['/aws/bedrock-agentcore/my-agent'],\n    serviceNames: ['my-agent.default'],\n  }),\n});\n```\n\n### Custom Evaluators\n\nCustom evaluators let you define evaluation logic tailored to your specific use cases. You can create custom evaluators using two strategies:\n\n- **LLM-as-a-Judge**: Uses a foundation model with custom instructions and a rating scale to assess agent performance.\n- **Code-based**: Uses a Lambda function for custom evaluation logic.\n\n| Property | Type | Required | Description |\n|---|---|---|---|\n| `evaluatorName` | `string` | Yes | Name of the evaluator. Must start with a letter, a-z, A-Z, 0-9, _ only. Maximum 48 characters |\n| `evaluatorConfig` | `EvaluatorConfig` | Yes | Configuration defining how the evaluator assesses performance |\n| `level` | `EvaluationLevel` | Yes | The level at which the evaluator operates: `TOOL_CALL`, `TRACE`, or `SESSION` |\n| `description` | `string` | No | Description of the evaluator. Maximum 200 characters |\n| `tags` | `{ [key: string]: string }` | No | Tags for the evaluator. A list of key:value pairs to apply to this Evaluator resource |\n\n#### LLM-as-a-Judge Evaluator\n\nCreate a custom evaluator that uses a foundation model to assess agent performance:\n\n```typescript fixture=default\n// LLM-as-a-Judge with categorical rating scale\nconst categoricalEvaluator = new agentcore.Evaluator(this, 'CategoricalEvaluator', {\n  evaluatorName: 'domain_accuracy_evaluator',\n  level: agentcore.EvaluationLevel.SESSION,\n  description: 'Evaluates domain-specific accuracy of agent responses',\n  evaluatorConfig: agentcore.EvaluatorConfig.llmAsAJudge({\n    instructions: 'Evaluate whether the agent response is accurate within the healthcare domain.',\n    modelId: 'us.anthropic.claude-sonnet-4-6',\n    ratingScale: agentcore.EvaluatorRatingScale.categorical([\n      { label: 'Accurate', definition: 'The response contains factually correct healthcare information.' },\n      { label: 'Inaccurate', definition: 'The response contains incorrect or misleading healthcare information.' },\n    ]),\n  }),\n});\n\n// LLM-as-a-Judge with numerical rating scale and inference config\nconst numericalEvaluator = new agentcore.Evaluator(this, 'NumericalEvaluator', {\n  evaluatorName: 'response_quality_evaluator',\n  level: agentcore.EvaluationLevel.TRACE,\n  evaluatorConfig: agentcore.EvaluatorConfig.llmAsAJudge({\n    instructions: 'Rate the overall quality of the agent response on a scale of 1 to 5.',\n    modelId: 'us.anthropic.claude-sonnet-4-6',\n    ratingScale: agentcore.EvaluatorRatingScale.numerical([\n      { label: 'Poor', definition: 'Inadequate response.', value: 1 },\n      { label: 'Below Average', definition: 'Partially addresses the query.', value: 2 },\n      { label: 'Average', definition: 'Adequately addresses the query.', value: 3 },\n      { label: 'Good', definition: 'Well-structured and accurate response.', value: 4 },\n      { label: 'Excellent', definition: 'Outstanding response exceeding expectations.', value: 5 },\n    ]),\n    inferenceConfig: {\n      maxTokens: 1024,\n      temperature: 0.1,\n    },\n  }),\n});\n```\n\nThe `modelId` accepts standard Bedrock model IDs and cross-region inference profile IDs with region prefixes (e.g., `us.`, `eu.`, `global.`).\n\n> **Instructions placeholders:** Instructions must contain placeholders appropriate for the evaluation level (e.g., `{context}`, `{available_tools}` for SESSION level). Evaluators using reference-input placeholders (e.g., `{expected_tool_trajectory}`, `{assertions}`) are only compatible with on-demand evaluation, not online evaluation. See the [custom evaluators documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/custom-evaluators.html) for allowed placeholders per level.\n\n#### Code-Based Evaluator\n\nCreate a custom evaluator that uses a Lambda function for evaluation logic:\n\n```typescript fixture=default\ndeclare const evalFunction: lambda.IFunction;\n\nconst codeEvaluator = new agentcore.Evaluator(this, 'CodeEvaluator', {\n  evaluatorName: 'custom_code_evaluator',\n  level: agentcore.EvaluationLevel.TOOL_CALL,\n  description: 'Evaluates tool call accuracy using custom logic',\n  evaluatorConfig: agentcore.EvaluatorConfig.codeBased({\n    lambdaFunction: evalFunction,\n    timeout: cdk.Duration.seconds(30),\n  }),\n});\n```\n\nFor code-based evaluators, the construct automatically grants the `bedrock-agentcore.amazonaws.com` service principal permission to invoke the Lambda function, scoped to the specific evaluator resource with `aws:SourceAccount` and `aws:SourceArn` conditions for confused deputy prevention.\n\n#### Using Custom Evaluators with Online Evaluation\n\nCustom evaluators are used in `OnlineEvaluationConfig` via `EvaluatorReference.custom()`, alongside built-in evaluators:\n\n```typescript fixture=default\ndeclare const customEvaluator: agentcore.Evaluator;\n\nconst evaluation = new agentcore.OnlineEvaluationConfig(this, 'MixedEvaluation', {\n  onlineEvaluationConfigName: 'mixed_evaluation',\n  evaluators: [\n    // Built-in evaluators\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.CORRECTNESS),\n    // Custom evaluator\n    agentcore.EvaluatorReference.custom(customEvaluator),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: ['/aws/bedrock-agentcore/my-agent'],\n    serviceNames: ['my-agent.default'],\n  }),\n});\n```\n\n### Data Source Configuration\n\nOnline evaluation supports two types of data sources:\n\n**AgentCore Runtime Data Source (Recommended):**\n\nFor runtimes created within your CDK app, use `fromAgentRuntimeEndpoint()` which automatically derives the CloudWatch log group and service name:\n\n```typescript fixture=default\nconst repository = new ecr.Repository(this, 'TestRepository', {\n  repositoryName: 'test-agent-runtime',\n});\n\nconst runtime = new agentcore.Runtime(this, 'MyRuntime', {\n  runtimeName: 'my_agent',\n  agentRuntimeArtifact: agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, 'v1.0.0'),\n});\n\n// Using default endpoint (simplest)\nconst evaluation = new agentcore.OnlineEvaluationConfig(this, 'RuntimeEval', {\n  onlineEvaluationConfigName: 'runtime_evaluation',\n  evaluators: [\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromAgentRuntimeEndpoint(runtime),\n});\n```\n\nYou can also specify a specific endpoint:\n\n```typescript fixture=default\ndeclare const runtime: agentcore.Runtime;\n\n// Using a specific endpoint construct\nconst prodEndpoint = runtime.addEndpoint('PROD');\nconst evaluation = new agentcore.OnlineEvaluationConfig(this, 'ProdEval', {\n  onlineEvaluationConfigName: 'prod_evaluation',\n  evaluators: [\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.CORRECTNESS),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromAgentRuntimeEndpoint(runtime, prodEndpoint),\n});\n\n// Or using endpoint name as string\nconst stagingEval = new agentcore.OnlineEvaluationConfig(this, 'StagingEval', {\n  onlineEvaluationConfigName: 'staging_evaluation',\n  evaluators: [\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.CORRECTNESS),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromAgentRuntimeEndpointName(runtime, 'STAGING'),\n});\n```\n\n**CloudWatch Logs Data Source:**\n\nFor external agents or when you need to specify log groups directly:\n\n```typescript fixture=default\nconst evaluation = new agentcore.OnlineEvaluationConfig(this, 'CloudWatchEval', {\n  onlineEvaluationConfigName: 'cloudwatch_evaluation',\n  evaluators: [\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: [\n      '/aws/bedrock-agentcore/agent1',\n      '/aws/bedrock-agentcore/agent2',\n    ],\n    serviceNames: ['agent1.default'],\n  }),\n});\n```\n\n### Sampling and Filtering\n\nConfigure sampling percentage and filters to control which traces are evaluated:\n\n```typescript fixture=default\nconst evaluation = new agentcore.OnlineEvaluationConfig(this, 'FilteredEval', {\n  onlineEvaluationConfigName: 'filtered_evaluation',\n  evaluators: [\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: ['/aws/bedrock-agentcore/my-agent'],\n    serviceNames: ['my-agent.default'],\n  }),\n  // Sample 25% of traces\n  samplingPercentage: 25,\n  // Only evaluate traces matching these filters\n  filters: [\n    {\n      key: 'user.region',\n      operator: agentcore.FilterOperator.EQUAL,\n      value: agentcore.FilterValue.string('us-east-1'),\n    },\n    {\n      key: 'session.duration',\n      operator: agentcore.FilterOperator.GREATER_THAN,\n      value: agentcore.FilterValue.number(60),\n    },\n  ],\n  // Consider sessions complete after 30 minutes of inactivity\n  sessionTimeout: cdk.Duration.minutes(30),\n});\n```\n\n### Online Evaluation with Custom Execution Role\n\nProvide a custom IAM role for the evaluation execution:\n\n```typescript fixture=default\nconst executionRole = new iam.Role(this, 'EvaluationRole', {\n  assumedBy: new iam.ServicePrincipal('bedrock-agentcore.amazonaws.com'),\n  description: 'Custom role for online evaluation',\n});\n\n// Add required permissions\nexecutionRole.addToPolicy(new iam.PolicyStatement({\n  actions: [\n    'logs:DescribeLogGroups',\n    'logs:GetQueryResults',\n    'logs:StartQuery',\n  ],\n  resources: ['arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/*'],\n}));\n\nconst evaluation = new agentcore.OnlineEvaluationConfig(this, 'CustomRoleEval', {\n  onlineEvaluationConfigName: 'custom_role_evaluation',\n  evaluators: [\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: ['/aws/bedrock-agentcore/my-agent'],\n    serviceNames: ['my-agent.default'],\n  }),\n  executionRole: executionRole,\n});\n```\n\n### Online Evaluation IAM Permissions\n\nGrant IAM permissions to manage or read evaluation configurations:\n\n```typescript fixture=default\ndeclare const evaluation: agentcore.OnlineEvaluationConfig;\ndeclare const role: iam.IRole;\n\n// Grant specific permissions\nevaluation.grant(role,\n  'bedrock-agentcore:GetOnlineEvaluationConfig',\n  'bedrock-agentcore:UpdateOnlineEvaluationConfig',\n);\n```\n"
+    "markdown": "# Amazon Bedrock AgentCore Construct Library\n\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\n> The **Policy** submodule is the only submodule that remains in alpha. All other constructs have graduated to stable in `aws-cdk-lib/aws-bedrockagentcore` and we recommend migrating to the stable versions.\n\n| **Language**                                                                                   | **Package**                             |\n| :--------------------------------------------------------------------------------------------- | --------------------------------------- |\n| ![Typescript Logo](https://docs.aws.amazon.com/cdk/api/latest/img/typescript32.png) TypeScript | `@aws-cdk/aws-bedrock-agentcore-alpha` |\n\n## Migration to Stable\n\nAll constructs except Policy have moved to `aws-cdk-lib/aws-bedrockagentcore`:\n\n```ts nofixture\n// Before\nimport * as agentcore from '@aws-cdk/aws-bedrock-agentcore-alpha';\n```\n\n```ts nofixture\n// After (for all non-Policy constructs)\nimport * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';\n```\n\nThe following constructs are now in stable:\n\n- **Runtime**: `Runtime`, `RuntimeEndpoint`, `AgentRuntimeArtifact`, `NetworkConfiguration`, `Observability`\n- **Gateway**: `Gateway`, `GatewayTarget`, `GatewayAuthorizer`, `GatewayCredentialProvider`, `Interceptor`\n- **Tools**: `BrowserCustom`, `CodeInterpreterCustom`\n- **Memory**: `Memory`, `MemoryStrategy`\n- **Evaluation**: `OnlineEvaluationConfig`, `Evaluator`, `EvaluatorSelector`\n- **Identity**: `OAuth2CredentialProvider`, `ApiKeyCredentialProvider`, `WorkloadIdentity`\n\n## What Remains in Alpha\n\nThe Policy submodule remains experimental:\n\n- `PolicyEngine`\n- `Policy`\n- `PolicyStatement`\n- `PolicyValidationMode`\n- `PolicyEngineMode`\n\n## Policy Engine\n\nA policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with a gateway, the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies.\n\nFor more information, see the [Policy in Amazon Bedrock AgentCore documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.html).\n\n### PolicyEngine Properties\n\n| Name | Type | Required | Description |\n|------|------|----------|-------------|\n| `policyEngineName` | `string` | No | The name of the policy engine. Valid characters: a-z, A-Z, 0-9, _ (underscore). Must start with a letter, 1-48 characters. If not provided, a unique name will be auto-generated |\n| `description` | `string` | No | Optional description for the policy engine (max 4,096 characters). Default: no description |\n| `kmsKey` | `IKey` | No | Custom KMS key for encryption. **IMPORTANT**: Once set, cannot be changed (requires replacement). Must be symmetric ENCRYPT_DECRYPT key. If key becomes inaccessible, all authorization decisions will be DENIED. Default: AWS owned key |\n| `tags` | `{ [key: string]: string }` | No | Tags for the policy engine (max 50 tags). Default: no tags |\n\n### Understanding Cedar Policies in AgentCore\n\nPolicies are constructed using [Cedar language](https://www.cedarpolicy.com/en/tutorial), an open source language for writing and enforcing authorization policies.\nCedar policies in AgentCore follow a specific structure with three main components: **Principal**, **Action**, and **Resource**. Understanding how these components work together is critical for writing effective policies.\n\n#### Policy Structure\n\nEvery Cedar policy has this basic structure:\n\n```cedar\npermit(              // or forbid\n  principal,         // Who is making the request\n  action,            // What operation they want to perform\n  resource           // What Gateway/tool they want to access\n)\nwhen {               // Optional conditions\n  // Additional constraints\n};\n```\n\nExample Policy\n\n```cedar\npermit(\n  principal,\n  action == AgentCore::Action::\"ApplicationToolTarget___create_application\",\n  resource == AgentCore::Gateway::\"<gateway-arn>\"\n) when {\n  context.input.coverage_amount <= 1000000\n};\n```\n\n### Basic PolicyEngine and Policy Creation\n\nCreate a policy engine and add policies to it.\n\n#### Policy Engine Mode\n\nWhen associating a policy engine with a gateway, you can control the enforcement behavior using `PolicyEngineMode`:\n\n- `PolicyEngineMode.LOG_ONLY` (default) — evaluates actions and adds traces but does not enforce decisions. Use this mode for testing and validation before enabling enforcement.\n- `PolicyEngineMode.ENFORCE` — actively allows or denies agent operations based on Cedar policy evaluation.\n\n```typescript fixture=default\n\n// Create a Policy engine\nconst policyEngine = new agentcore.PolicyEngine(this, \"MyPolicyEngine\", {\n  policyEngineName: \"my_policy_engine\",\n  description: \"Policy engine for access control\",\n});\n\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  policyEngineConfiguration: {\n    policyEngine: policyEngine,\n    mode: agentcore.PolicyEngineMode.ENFORCE, // Default is LOG_ONLY\n  },\n});\n\n// Add policy to policy engine\npolicyEngine.addPolicy(\"AllowAllActions\", {\n  definition: `\n    permit(\n      principal,\n      action,\n      resource == AgentCore::Gateway::\"${gateway.gatewayArn}\"\n    );\n  `,\n  description: \"Allow all actions on specific gateway (development)\",\n  validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS, // This will ignore all cedar warnings\n});\n\n// you can add multiple policies to the policy engine\npolicyEngine.addPolicy(\"SpecificToolPolicy\", {\n  definition: `\n    permit(\n      principal is AgentCore::OAuthUser,\n      action == AgentCore::Action::\"WeatherTool__get_forecast\",\n      resource == AgentCore::Gateway::\"${gateway.gatewayArn}\"\n    );\n  `,\n  description: \"Allow specific weather tool access\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS, // This will fail policy creation for any cedar warning\n});\n```\n\n### Type-Safe Policy Builder\n\nFor a more type-safe approach, use the `PolicyStatement` builder instead of writing raw Cedar syntax.\n\n```typescript fixture=default\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst policyEngine = new agentcore.PolicyEngine(this, \"MyPolicyEngine\", {\n  policyEngineName: \"my_policy_engine\",\n});\n\nconst allowAllPolicy = new agentcore.Policy(this, \"AllowAllPolicy\", {\n  policyEngine: policyEngine,\n  policyName: \"allow_all\",\n  statement: agentcore.PolicyStatement.permit()\n    .forAllPrincipals() // ** This will give overly permission to all principals\n    .onAllActions()\n    .onResource('AgentCore::Gateway', gateway.gatewayArn),\n  description: \"Allow all actions on specific gateway (development only)\",\n  validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS,\n});\n\n// Generated Cedar:\n// permit(\n//   principal,\n//   action,\n//   resource == AgentCore::Gateway::\"arn:aws:bedrock-agentcore:region:account:gateway/gateway-id\"\n// );\n```\n\n#### Policy with Specific Actions\n\n```typescript fixture=default\ndeclare const policyEngine: agentcore.PolicyEngine;\ndeclare const gateway: agentcore.Gateway;\n\n// Allow specific tool actions on specific gateway\n// Action names follow pattern: \"ToolName__operation\"\npolicyEngine.addPolicy(\"SpecificToolPolicy\", {\n  statement: agentcore.PolicyStatement.permit()\n    .forPrincipal('AgentCore::OAuthUser::your-client-id')\n    .onActions([\n      'AgentCore::Action::WeatherTool__get_forecast',\n      'AgentCore::Action::WeatherTool__get_current',\n    ])\n    .onResource('AgentCore::Gateway', gateway.gatewayArn),\n  description: \"Allow specific weather tool operations\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,\n});\n\n// Generated Cedar:\n// permit(\n//   principal is AgentCore::OAuthUser,\n//   action in [\n//     AgentCore::Action::\"WeatherTool__get_forecast\",\n//     AgentCore::Action::\"WeatherTool__get_current\"\n//   ],\n//   resource == AgentCore::Gateway::\"arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-123\"\n// );\n```\n\n#### Policy with Conditions\n\nUse `when` clauses to add advanced conditions based on principal tags (from OAuth token) or context:\n\n```typescript fixture=default\ndeclare const policyEngine: agentcore.PolicyEngine;\ndeclare const gateway: agentcore.Gateway;\n\n// Policy with when conditions using principal tags\nconst conditionalPolicy = new agentcore.Policy(this, \"ConditionalPolicy\", {\n  policyEngine: policyEngine,\n  policyName: \"conditional_access\",\n  statement: agentcore.PolicyStatement.permit()\n    .forPrincipal('AgentCore::OAuthUser')  // Type constraint\n    .onAllActions()\n    .onResource('AgentCore::Gateway', gateway.gatewayArn)  // Specific ARN\n    .when()\n      .principalAttribute('department').equalTo('Engineering')\n      .and()\n      .contextAttribute('input.priority').equalTo('high')\n      .done(),\n  description: \"Allow engineers for high-priority requests\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,\n});\n\n// Generated Cedar:\n// permit(\n//   principal is AgentCore::OAuthUser,\n//   action,\n//   resource == AgentCore::Gateway::\"arn:...\"\n// )\n// when {\n//   principal.department == \"Engineering\" && context.input.priority == \"high\"\n// };\n```\n\n#### Policy with Exclusions (unless)\n\nUse `unless` clauses to exclude specific conditions from a policy. The policy applies when the `unless` conditions are NOT met:\n\n```typescript fixture=default\ndeclare const policyEngine: agentcore.PolicyEngine;\ndeclare const gateway: agentcore.Gateway;\n\n// Allow access unless the user is suspended\nconst policyWithUnless = new agentcore.Policy(this, \"UnlessPolicy\", {\n  policyEngine: policyEngine,\n  policyName: \"unless_suspended\",\n  statement: agentcore.PolicyStatement.permit()\n    .forPrincipal('AgentCore::OAuthUser')\n    .onAllActions()\n    .onResource('AgentCore::Gateway', gateway.gatewayArn)\n    .unless()\n      .principalAttribute('suspended').equalTo(true)\n      .done(),\n  description: \"Allow all actions unless user is suspended\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,\n});\n\n// Generated Cedar:\n// permit(\n//   principal is AgentCore::OAuthUser,\n//   action,\n//   resource == AgentCore::Gateway::\"arn:...\"\n// )\n// unless {\n//   principal.suspended == true\n// };\n```\n\nYou can combine `when` and `unless` clauses in the same policy:\n\n```typescript fixture=default\ndeclare const policyEngine: agentcore.PolicyEngine;\ndeclare const gateway: agentcore.Gateway;\n\n// Allow engineers unless they are on probation\npolicyEngine.addPolicy(\"CombinedConditions\", {\n  statement: agentcore.PolicyStatement.permit()\n    .forPrincipal('AgentCore::OAuthUser')\n    .onAllActions()\n    .onResource('AgentCore::Gateway', gateway.gatewayArn)\n    .when()\n      .principalAttribute('department').equalTo('Engineering')\n      .done()\n    .unless()\n      .principalAttribute('status').equalTo('probation')\n      .done(),\n  description: \"Allow engineers unless on probation\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,\n});\n```\n\n#### Forbid (Deny) Policy\n\nUse `forbid` to explicitly deny access. Forbid policies override permit policies.\n\n```typescript fixture=default\ndeclare const policyEngine: agentcore.PolicyEngine;\ndeclare const gateway: agentcore.Gateway;\n\n// Explicitly deny dangerous tool operations\npolicyEngine.addPolicy(\"DenyDangerous\", {\n  statement: agentcore.PolicyStatement.forbid()\n    .forAllPrincipals()\n    .onAction('AgentCore::Action::DeleteTool__delete_all')\n    .onResource('AgentCore::Gateway', gateway.gatewayArn),\n  description: \"Forbid delete_all operation for all users\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,\n});\n\n// Generated Cedar:\n// forbid(\n//   principal,\n//   action == AgentCore::Action::\"DeleteTool__delete_all\",\n//   resource == AgentCore::Gateway::\"arn:...\"\n// );\n```\n\n#### Raw Cedar for Advanced Cases\n\nFor advanced Cedar features not supported by the builder, use raw Cedar strings:\n\n```typescript fixture=default\ndeclare const policyEngine: agentcore.PolicyEngine;\n\n// Option 1: Using definition property\nconst advancedPolicy = new agentcore.Policy(this, \"AdvancedPolicy\", {\n  policyEngine: policyEngine,\n  definition: 'permit(principal, action, resource) when { context.custom > 10 };',\n  description: \"Advanced policy with custom Cedar logic\",\n});\n\n// Option 2: Using fromCedar() with statement property\npolicyEngine.addPolicy(\"CustomPolicy\", {\n  statement: agentcore.PolicyStatement.fromCedar(\n    'forbid(principal, action, resource) when { resource.confidential == true };'\n  ),\n  description: \"Custom policy from Cedar string\",\n});\n```\n\n**Note**: You must specify **either** `definition` (raw Cedar string) **or** `statement` (PolicyStatement builder), but not both.\n\n#### Accessing Policies on PolicyEngine\n\nYou can access the list of policies added to a PolicyEngine using policyEngine.policies.\n\n### PolicyEngine with KMS Encryption\n\nEncrypt policy data with a custom KMS key.\n\n```typescript fixture=default\n// Create a custom KMS key\nconst policyKey = new kms.Key(this, \"PolicyEngineKey\", {\n  enableKeyRotation: true,\n  description: \"KMS key for policy engine encryption\",\n});\n\n// Create policy engine with encryption\nconst policyEngine = new agentcore.PolicyEngine(this, \"EncryptedEngine\", {\n  policyEngineName: \"encrypted_engine\",\n  description: \"Policy engine with KMS encryption\",\n  kmsKey: policyKey,\n});\n```\n\n### Importing Existing PolicyEngine\n\nImport an existing policy engine from its ARN:\n\n```typescript fixture=default\nconst importedEngine = agentcore.PolicyEngine.fromPolicyEngineAttributes(\n  this,\n  \"ImportedEngine\",\n  {\n    policyEngineArn: \"policy-engine-arn\",\n    kmsKeyArn: \"kms-arn\",\n  }\n);\n\n// Use the imported engine\nconst policy = new agentcore.Policy(this, \"PolicyForImportedEngine\", {\n  policyEngine: importedEngine,\n  definition: \"permit(principal, action, resource);\",\n});\n```\n\n### Importing Existing Policy\n\nImport an existing policy from its ARN:\n\n```typescript fixture=default\nconst importedEngine = agentcore.PolicyEngine.fromPolicyEngineAttributes(\n  this,\n  \"ImportedEngine\",\n  {\n    policyEngineArn: \"policy-engine/my-engine-id\",\n  }\n);\n\nconst importedPolicy = agentcore.Policy.fromPolicyAttributes(\n  this,\n  \"ImportedPolicy\",\n  {\n    policyArn: \"my-policy-arn\",\n    policyEngine: importedEngine,\n  }\n);\n\n// Grant permissions to the imported policy\nconst role = new iam.Role(this, \"PolicyRole\", {\n  assumedBy: new iam.ServicePrincipal(\"lambda.amazonaws.com\"),\n});\n\nimportedPolicy.grantRead(role);\n```\n\n### PolicyEngine IAM Permissions\n\nGrant various levels of access to policy engines:\n\n```typescript fixture=default\nconst policyEngine = new agentcore.PolicyEngine(this, \"MyEngine\", {\n  policyEngineName: \"my_engine\",\n});\n\nconst lambdaRole = new iam.Role(this, \"LambdaRole\", {\n  assumedBy: new iam.ServicePrincipal(\"lambda.amazonaws.com\"),\n});\n\n// Grant read permissions\npolicyEngine.grantRead(lambdaRole);\n\n// Grant evaluation permissions\npolicyEngine.grantEvaluate(lambdaRole);\n```\n\n## Using Policy with Stable Gateway\n\nSince Gateway is now in `aws-cdk-lib/aws-bedrockagentcore` but Policy remains in alpha, use the L1 escape hatch to associate a policy engine with a stable gateway:\n\n> Proper L2 integration will be added in a future update.\n\n```ts fixture=policy\nimport * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';\nimport * as agentcoreAlpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\n// Create policy engine (alpha)\nconst policyEngine = new agentcoreAlpha.PolicyEngine(this, 'Engine', {\n  policyEngineName: 'my_engine',\n});\n\n// Create gateway (stable)\nconst gateway = new agentcore.Gateway(this, 'Gateway', {\n  gatewayName: 'my-gateway',\n});\n\n// Wire policy engine to gateway via the L1 construct\nconst cfnGateway = gateway.node.defaultChild as agentcore.CfnGateway;\ncfnGateway.policyEngineConfiguration = {\n  arn: policyEngine.policyEngineArn,\n  mode: agentcoreAlpha.PolicyEngineMode.ENFORCE.value,\n};\n\n// Grant evaluate permissions to the gateway role\ngateway.role.addToPrincipalPolicy(new iam.PolicyStatement({\n  actions: ['bedrock-agentcore:GetPolicyEngine'],\n  resources: [policyEngine.policyEngineArn],\n}));\ngateway.role.addToPrincipalPolicy(new iam.PolicyStatement({\n  actions: ['bedrock-agentcore:AuthorizeAction', 'bedrock-agentcore:PartiallyAuthorizeActions'],\n  resources: [policyEngine.policyEngineArn, gateway.gatewayArn],\n}));\n```\n"
   },
   "repository": {
     "directory": "packages/@aws-cdk/aws-bedrock-agentcore-alpha",
@@ -9035,9 +9035,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Options for adding an API Gateway target to a gateway.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst api = new apigateway.RestApi(this, 'MyApi', {\n  restApiName: 'my-api',\n});\n\n// Uses IAM authorization for outbound auth by default\nconst apiGatewayTarget = gateway.addApiGatewayTarget(\"MyApiGatewayTarget\", {\n  restApi: api,\n  apiGatewayToolConfiguration: {\n    toolFilters: [\n      {\n        filterPath: \"/pets/*\",\n        methods: [agentcore.ApiGatewayHttpMethod.GET],\n      },\n    ],\n  },\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_apigateway as apigateway } from 'aws-cdk-lib';\n\ndeclare const credentialProviderConfig: bedrock_agentcore_alpha.ICredentialProviderConfig;\ndeclare const restApi: apigateway.RestApi;\nconst addApiGatewayTargetOptions: bedrock_agentcore_alpha.AddApiGatewayTargetOptions = {\n  apiGatewayToolConfiguration: {\n    toolFilters: [{\n      filterPath: 'filterPath',\n      methods: [bedrock_agentcore_alpha.ApiGatewayHttpMethod.GET],\n    }],\n\n    // the properties below are optional\n    toolOverrides: [{\n      method: bedrock_agentcore_alpha.ApiGatewayHttpMethod.GET,\n      name: 'name',\n      path: 'path',\n\n      // the properties below are optional\n      description: 'description',\n    }],\n  },\n  restApi: restApi,\n\n  // the properties below are optional\n  credentialProviderConfigurations: [credentialProviderConfig],\n  description: 'description',\n  gatewayTargetName: 'gatewayTargetName',\n  metadataConfiguration: {\n    allowedQueryParameters: ['allowedQueryParameters'],\n    allowedRequestHeaders: ['allowedRequestHeaders'],\n    allowedResponseHeaders: ['allowedResponseHeaders'],\n  },\n  stage: 'stage',\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.AddApiGatewayTargetOptions",
@@ -9184,9 +9184,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Options for adding an endpoint to the runtime.",
-        "example": "const repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\n\nconst agentRuntimeArtifactNew = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v2.0.0\");\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifactNew,\n});\n\nconst stagingEndpoint = runtime.addEndpoint(\"staging\", {\n  version: \"2\",\n  description: \"Staging environment for testing new version\"\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst addEndpointOptions: bedrock_agentcore_alpha.AddEndpointOptions = {\n  description: 'description',\n  version: 'version',\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.AddEndpointOptions",
@@ -9242,9 +9242,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Options for adding a Lambda target to a gateway.",
-        "example": "// Create a gateway first\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst lambdaFunction = new lambda.Function(this, \"MyFunction\", {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\n    exports.handler = async (event) => {\n      return {\n        statusCode: 200,\n        body: JSON.stringify({ message: 'Hello from Lambda!' })\n      };\n    };\n  `),\n});\n\nconst lambdaTarget = gateway.addLambdaTarget(\"MyLambdaTarget\", {\n  gatewayTargetName: \"my-lambda-target\",\n  description: \"Lambda function target\",\n  lambdaFunction: lambdaFunction,\n  toolSchema: agentcore.ToolSchema.fromInline([\n    {\n      name: \"hello_world\",\n      description: \"A simple hello world tool\",\n      inputSchema: {\n        type: agentcore.SchemaDefinitionType.OBJECT,\n        properties: {\n          name: {\n            type: agentcore.SchemaDefinitionType.STRING,\n            description: \"The name to greet\",\n          },\n        },\n        required: [\"name\"],\n      },\n    },\n  ]),\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_lambda as lambda } from 'aws-cdk-lib';\n\ndeclare const credentialProviderConfig: bedrock_agentcore_alpha.ICredentialProviderConfig;\ndeclare const function_: lambda.Function;\ndeclare const toolSchema: bedrock_agentcore_alpha.ToolSchema;\nconst addLambdaTargetOptions: bedrock_agentcore_alpha.AddLambdaTargetOptions = {\n  lambdaFunction: function_,\n  toolSchema: toolSchema,\n\n  // the properties below are optional\n  credentialProviderConfigurations: [credentialProviderConfig],\n  description: 'description',\n  gatewayTargetName: 'gatewayTargetName',\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.AddLambdaTargetOptions",
@@ -9355,9 +9355,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Options for adding an MCP Server target to a gateway.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst oauth = agentcore.OAuth2CredentialProvider.usingGithub(this, \"GhOAuth\", {\n  oAuth2CredentialProviderName: \"github-oauth\",\n  clientId: \"your-client-id\",\n  clientSecret: cdk.SecretValue.unsafePlainText(\"your-client-secret\"),\n});\n\ngateway.addMcpServerTarget(\"Mcp\", {\n  gatewayTargetName: \"mcp-server\",\n  description: \"MCP with GitHub OAuth\",\n  endpoint: \"https://my-mcp-server.example.com\",\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromOauthIdentity(oauth, {\n      scopes: [\"read:user\"],\n    }),\n  ],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\ndeclare const credentialProviderConfig: bedrock_agentcore_alpha.ICredentialProviderConfig;\nconst addMcpServerTargetOptions: bedrock_agentcore_alpha.AddMcpServerTargetOptions = {\n  credentialProviderConfigurations: [credentialProviderConfig],\n  endpoint: 'endpoint',\n\n  // the properties below are optional\n  description: 'description',\n  gatewayTargetName: 'gatewayTargetName',\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.AddMcpServerTargetOptions",
@@ -9452,9 +9452,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Options for adding an OpenAPI target to a gateway.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// Create an API key credential provider in Token Vault\nconst apiKeyProvider = new agentcore.ApiKeyCredentialProvider(this, \"MyApiKeyProvider\", {\n  apiKeyCredentialProviderName: \"my-apikey\",\n});\n\nconst bucket = s3.Bucket.fromBucketName(this, \"ExistingBucket\", \"my-schema-bucket\");\nconst s3mySchema = agentcore.ApiSchema.fromS3File(bucket, \"schemas/myschema.yaml\");\n\n// Add an OpenAPI target using the L2 construct directly\nconst target = gateway.addOpenApiTarget(\"MyTarget\", {\n  gatewayTargetName: \"my-api-target\",\n  description: \"Target for external API integration\",\n  apiSchema: s3mySchema,\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromApiKeyIdentity(apiKeyProvider, {\n      credentialLocation: agentcore.ApiKeyCredentialLocation.header({\n        credentialParameterName: \"X-API-Key\",\n      }),\n    }),\n  ],\n});\n\n// This makes sure your s3 bucket is available before target\ntarget.node.addDependency(bucket);",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\ndeclare const apiSchema: bedrock_agentcore_alpha.ApiSchema;\ndeclare const credentialProviderConfig: bedrock_agentcore_alpha.ICredentialProviderConfig;\nconst addOpenApiTargetOptions: bedrock_agentcore_alpha.AddOpenApiTargetOptions = {\n  apiSchema: apiSchema,\n\n  // the properties below are optional\n  credentialProviderConfigurations: [credentialProviderConfig],\n  description: 'description',\n  gatewayTargetName: 'gatewayTargetName',\n  validateOpenApiSchema: false,\n};",
         "custom": {
-          "exampleMetadata": "infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.AddOpenApiTargetOptions",
@@ -9683,9 +9683,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Options for adding a Smithy target to a gateway.",
-        "example": "\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst smithySchema = agentcore.ApiSchema.fromLocalAsset(\n  path.join(__dirname, \"models\", \"smithy-model.json\")\n);\nsmithySchema.bind(this);\n\nconst smithyTarget = gateway.addSmithyTarget(\"MySmithyTarget\", {\n  gatewayTargetName: \"my-smithy-target\",\n  description: \"Smithy model target\",\n  smithyModel: smithySchema,\n\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\ndeclare const apiSchema: bedrock_agentcore_alpha.ApiSchema;\ndeclare const credentialProviderConfig: bedrock_agentcore_alpha.ICredentialProviderConfig;\nconst addSmithyTargetOptions: bedrock_agentcore_alpha.AddSmithyTargetOptions = {\n  smithyModel: apiSchema,\n\n  // the properties below are optional\n  credentialProviderConfigurations: [credentialProviderConfig],\n  description: 'description',\n  gatewayTargetName: 'gatewayTargetName',\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.AddSmithyTargetOptions",
@@ -9778,11 +9778,7 @@
       "assembly": "@aws-cdk/aws-bedrock-agentcore-alpha",
       "docs": {
         "stability": "experimental",
-        "summary": "Bedrock AgentCore runtime environment for code execution Allowed values: PYTHON_3_10 | PYTHON_3_11 | PYTHON_3_12 | PYTHON_3_13 | PYTHON_3_14 | NODE_22.",
-        "example": "// S3 bucket containing the agent core\nconst codeBucket = new s3.Bucket(this, \"AgentCode\", {\n  bucketName: \"my-code-bucket\",\n  removalPolicy: RemovalPolicy.DESTROY, // For demo purposes\n});\n\n// the bucket above needs to contain the agent code\n\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromS3(\n  {\n    bucketName: codeBucket.bucketName,\n    objectKey: 'deployment_package.zip',\n  },\n  agentcore.AgentCoreRuntime.PYTHON_3_12,\n  ['opentelemetry-instrument', 'main.py']\n);\n\nconst runtimeInstance = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n});",
-        "custom": {
-          "exampleMetadata": "fixture=default infused"
-        }
+        "summary": "Bedrock AgentCore runtime environment for code execution Allowed values: PYTHON_3_10 | PYTHON_3_11 | PYTHON_3_12 | PYTHON_3_13 | PYTHON_3_14 | NODE_22."
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.AgentCoreRuntime",
       "kind": "enum",
@@ -9844,9 +9840,9 @@
         "remarks": "Provides methods to reference container images from ECR repositories or local assets.",
         "stability": "experimental",
         "summary": "Abstract base class for agent runtime artifacts.",
-        "example": "// S3 bucket containing the agent core\nconst codeBucket = new s3.Bucket(this, \"AgentCode\", {\n  bucketName: \"my-code-bucket\",\n  removalPolicy: RemovalPolicy.DESTROY, // For demo purposes\n});\n\n// the bucket above needs to contain the agent code\n\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromS3(\n  {\n    bucketName: codeBucket.bucketName,\n    objectKey: 'deployment_package.zip',\n  },\n  agentcore.AgentCoreRuntime.PYTHON_3_12,\n  ['opentelemetry-instrument', 'main.py']\n);\n\nconst runtimeInstance = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\nimport { aws_ecr_assets as ecr_assets } from 'aws-cdk-lib';\n\ndeclare const networkMode: ecr_assets.NetworkMode;\ndeclare const platform: ecr_assets.Platform;\nconst agentRuntimeArtifact = bedrock_agentcore_alpha.AgentRuntimeArtifact.fromAsset('directory', /* all optional props */ {\n  assetName: 'assetName',\n  buildArgs: {\n    buildArgsKey: 'buildArgs',\n  },\n  buildContexts: {\n    buildContextsKey: 'buildContexts',\n  },\n  buildSecrets: {\n    buildSecretsKey: 'buildSecrets',\n  },\n  buildSsh: 'buildSsh',\n  cacheDisabled: false,\n  cacheFrom: [{\n    type: 'type',\n\n    // the properties below are optional\n    params: {\n      paramsKey: 'params',\n    },\n  }],\n  cacheTo: {\n    type: 'type',\n\n    // the properties below are optional\n    params: {\n      paramsKey: 'params',\n    },\n  },\n  displayName: 'displayName',\n  exclude: ['exclude'],\n  extraHash: 'extraHash',\n  file: 'file',\n  followSymlinks: cdk.SymlinkFollowMode.NEVER,\n  ignoreMode: cdk.IgnoreMode.GLOB,\n  invalidation: {\n    buildArgs: false,\n    buildContexts: false,\n    buildSecrets: false,\n    buildSsh: false,\n    extraHash: false,\n    file: false,\n    networkMode: false,\n    outputs: false,\n    platform: false,\n    repositoryName: false,\n    target: false,\n  },\n  networkMode: networkMode,\n  outputs: ['outputs'],\n  platform: platform,\n  target: 'target',\n});",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.AgentRuntimeArtifact",
@@ -10273,11 +10269,7 @@
       "assembly": "@aws-cdk/aws-bedrock-agentcore-alpha",
       "docs": {
         "stability": "experimental",
-        "summary": "HTTP methods supported by API Gateway.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst api = new apigateway.RestApi(this, 'MyApi', {\n  restApiName: 'my-api',\n});\n\n// Uses IAM authorization for outbound auth by default\nconst apiGatewayTarget = gateway.addApiGatewayTarget(\"MyApiGatewayTarget\", {\n  restApi: api,\n  apiGatewayToolConfiguration: {\n    toolFilters: [\n      {\n        filterPath: \"/pets/*\",\n        methods: [agentcore.ApiGatewayHttpMethod.GET],\n      },\n    ],\n  },\n});",
-        "custom": {
-          "exampleMetadata": "fixture=default infused"
-        }
+        "summary": "HTTP methods supported by API Gateway."
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.ApiGatewayHttpMethod",
       "kind": "enum",
@@ -10639,9 +10631,9 @@
         "remarks": "The API Gateway tool configuration defines which operations from your REST API\nare exposed as tools. It requires a list of tool filters to select operations\nto expose, and optionally accepts tool overrides to customize tool metadata.",
         "stability": "experimental",
         "summary": "Configuration for API Gateway tools.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst api = new apigateway.RestApi(this, 'MyApi', {\n  restApiName: 'my-api',\n});\n\n// Uses IAM authorization for outbound auth by default\nconst apiGatewayTarget = gateway.addApiGatewayTarget(\"MyApiGatewayTarget\", {\n  restApi: api,\n  apiGatewayToolConfiguration: {\n    toolFilters: [\n      {\n        filterPath: \"/pets/*\",\n        methods: [agentcore.ApiGatewayHttpMethod.GET],\n      },\n    ],\n  },\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst apiGatewayToolConfiguration: bedrock_agentcore_alpha.ApiGatewayToolConfiguration = {\n  toolFilters: [{\n    filterPath: 'filterPath',\n    methods: [bedrock_agentcore_alpha.ApiGatewayHttpMethod.GET],\n  }],\n\n  // the properties below are optional\n  toolOverrides: [{\n    method: bedrock_agentcore_alpha.ApiGatewayHttpMethod.GET,\n    name: 'name',\n    path: 'path',\n\n    // the properties below are optional\n    description: 'description',\n  }],\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.ApiGatewayToolConfiguration",
@@ -10854,9 +10846,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "API Key additional configuration.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// Create an API key credential provider in Token Vault\nconst apiKeyProvider = new agentcore.ApiKeyCredentialProvider(this, \"MyApiKeyProvider\", {\n  apiKeyCredentialProviderName: \"my-apikey\",\n});\n\nconst bucket = s3.Bucket.fromBucketName(this, \"ExistingBucket\", \"my-schema-bucket\");\nconst s3mySchema = agentcore.ApiSchema.fromS3File(bucket, \"schemas/myschema.yaml\");\n\n// Add an OpenAPI target using the L2 construct directly\nconst target = gateway.addOpenApiTarget(\"MyTarget\", {\n  gatewayTargetName: \"my-api-target\",\n  description: \"Target for external API integration\",\n  apiSchema: s3mySchema,\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromApiKeyIdentity(apiKeyProvider, {\n      credentialLocation: agentcore.ApiKeyCredentialLocation.header({\n        credentialParameterName: \"X-API-Key\",\n      }),\n    }),\n  ],\n});\n\n// This makes sure your s3 bucket is available before target\ntarget.node.addDependency(bucket);",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst apiKeyAdditionalConfiguration: bedrock_agentcore_alpha.ApiKeyAdditionalConfiguration = {\n  credentialParameterName: 'credentialParameterName',\n  credentialPrefix: 'credentialPrefix',\n};",
         "custom": {
-          "exampleMetadata": "infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyAdditionalConfiguration",
@@ -10913,9 +10905,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "API Key location within the request.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// Create an API key credential provider in Token Vault\nconst apiKeyProvider = new agentcore.ApiKeyCredentialProvider(this, \"MyApiKeyProvider\", {\n  apiKeyCredentialProviderName: \"my-apikey\",\n});\n\nconst bucket = s3.Bucket.fromBucketName(this, \"ExistingBucket\", \"my-schema-bucket\");\nconst s3mySchema = agentcore.ApiSchema.fromS3File(bucket, \"schemas/myschema.yaml\");\n\n// Add an OpenAPI target using the L2 construct directly\nconst target = gateway.addOpenApiTarget(\"MyTarget\", {\n  gatewayTargetName: \"my-api-target\",\n  description: \"Target for external API integration\",\n  apiSchema: s3mySchema,\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromApiKeyIdentity(apiKeyProvider, {\n      credentialLocation: agentcore.ApiKeyCredentialLocation.header({\n        credentialParameterName: \"X-API-Key\",\n      }),\n    }),\n  ],\n});\n\n// This makes sure your s3 bucket is available before target\ntarget.node.addDependency(bucket);",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst apiKeyCredentialLocation = bedrock_agentcore_alpha.ApiKeyCredentialLocation.header(/* all optional props */ {\n  credentialParameterName: 'credentialParameterName',\n  credentialPrefix: 'credentialPrefix',\n});",
         "custom": {
-          "exampleMetadata": "infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialLocation",
@@ -11043,13 +11035,13 @@
       "docs": {
         "custom": {
           "resource": "AWS::BedrockAgentCore::ApiKeyCredentialProvider",
-          "exampleMetadata": "infused"
+          "exampleMetadata": "fixture=_generated"
         },
         "remarks": "Use this to register an API key identity in AgentCore Token Vault. To attach the identity to a\ngateway target, use {@link GatewayCredentialProvider.fromApiKeyIdentity } with this construct, or\n{@link ApiKeyCredentialProvider.bindForGatewayApiKeyTarget} with {@link GatewayCredentialProvider.fromApiKeyIdentityArn }.",
         "see": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-apikeycredentialprovider.html",
         "stability": "experimental",
         "summary": "L2 construct for `AWS::BedrockAgentCore::ApiKeyCredentialProvider`.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// Create an API key credential provider in Token Vault\nconst apiKeyProvider = new agentcore.ApiKeyCredentialProvider(this, \"MyApiKeyProvider\", {\n  apiKeyCredentialProviderName: \"my-apikey\",\n});\n\nconst bucket = s3.Bucket.fromBucketName(this, \"ExistingBucket\", \"my-schema-bucket\");\nconst s3mySchema = agentcore.ApiSchema.fromS3File(bucket, \"schemas/myschema.yaml\");\n\n// Add an OpenAPI target using the L2 construct directly\nconst target = gateway.addOpenApiTarget(\"MyTarget\", {\n  gatewayTargetName: \"my-api-target\",\n  description: \"Target for external API integration\",\n  apiSchema: s3mySchema,\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromApiKeyIdentity(apiKeyProvider, {\n      credentialLocation: agentcore.ApiKeyCredentialLocation.header({\n        credentialParameterName: \"X-API-Key\",\n      }),\n    }),\n  ],\n});\n\n// This makes sure your s3 bucket is available before target\ntarget.node.addDependency(bucket);"
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\n\ndeclare const secretValue: cdk.SecretValue;\nconst apiKeyCredentialProvider = new bedrock_agentcore_alpha.ApiKeyCredentialProvider(this, 'MyApiKeyCredentialProvider', /* all optional props */ {\n  apiKey: secretValue,\n  apiKeyCredentialProviderName: 'apiKeyCredentialProviderName',\n  tags: {\n    tagsKey: 'tags',\n  },\n});"
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialProvider",
       "initializer": {
@@ -11646,9 +11638,9 @@
         "remarks": "Pass this to {@link GatewayCredentialProvider.fromApiKeyIdentityArn } or to {@link ApiKeyCredentialProviderConfiguration}.",
         "stability": "experimental",
         "summary": "API key credential provider ARNs for gateway outbound auth (Token Vault identity).",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// ARNs from the console/API, or from ApiKeyCredentialProvider + bindForGatewayApiKeyTarget\nconst apiKeyProviderArn = \"arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/apikeycredentialprovider/my-apikey\"\nconst apiKeySecretArn = \"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-apikey-secret-abc123\"\n\nconst bucket = s3.Bucket.fromBucketName(this, \"ExistingBucket\", \"my-schema-bucket\");\nconst s3mySchema = agentcore.ApiSchema.fromS3File(bucket, \"schemas/myschema.yaml\");\n\n// Add an OpenAPI target using ARNs directly\nconst target = gateway.addOpenApiTarget(\"MyTarget\", {\n  gatewayTargetName: \"my-api-target\",\n  description: \"Target for external API integration\",\n  apiSchema: s3mySchema,\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromApiKeyIdentityArn({\n      providerArn: apiKeyProviderArn,\n      secretArn: apiKeySecretArn,\n      credentialLocation: agentcore.ApiKeyCredentialLocation.header({\n        credentialParameterName: \"X-API-Key\",\n      }),\n    }),\n  ],\n});\n\n// This makes sure your s3 bucket is available before target\ntarget.node.addDependency(bucket);",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\ndeclare const apiKeyCredentialLocation: bedrock_agentcore_alpha.ApiKeyCredentialLocation;\nconst apiKeyCredentialProviderProps: bedrock_agentcore_alpha.ApiKeyCredentialProviderProps = {\n  providerArn: 'providerArn',\n  secretArn: 'secretArn',\n\n  // the properties below are optional\n  credentialLocation: apiKeyCredentialLocation,\n};",
         "custom": {
-          "exampleMetadata": "infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialProviderProps",
@@ -11721,9 +11713,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for a new {@link ApiKeyCredentialProvider} (Token Vault resource).",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// Create an API key credential provider in Token Vault\nconst apiKeyProvider = new agentcore.ApiKeyCredentialProvider(this, \"MyApiKeyProvider\", {\n  apiKeyCredentialProviderName: \"my-apikey\",\n});\n\nconst bucket = s3.Bucket.fromBucketName(this, \"ExistingBucket\", \"my-schema-bucket\");\nconst s3mySchema = agentcore.ApiSchema.fromS3File(bucket, \"schemas/myschema.yaml\");\n\n// Add an OpenAPI target using the L2 construct directly\nconst target = gateway.addOpenApiTarget(\"MyTarget\", {\n  gatewayTargetName: \"my-api-target\",\n  description: \"Target for external API integration\",\n  apiSchema: s3mySchema,\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromApiKeyIdentity(apiKeyProvider, {\n      credentialLocation: agentcore.ApiKeyCredentialLocation.header({\n        credentialParameterName: \"X-API-Key\",\n      }),\n    }),\n  ],\n});\n\n// This makes sure your s3 bucket is available before target\ntarget.node.addDependency(bucket);",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\n\ndeclare const secretValue: cdk.SecretValue;\nconst apiKeyCredentialProviderResourceProps: bedrock_agentcore_alpha.ApiKeyCredentialProviderResourceProps = {\n  apiKey: secretValue,\n  apiKeyCredentialProviderName: 'apiKeyCredentialProviderName',\n  tags: {\n    tagsKey: 'tags',\n  },\n};",
         "custom": {
-          "exampleMetadata": "infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialProviderResourceProps",
@@ -11802,11 +11794,7 @@
       "assembly": "@aws-cdk/aws-bedrock-agentcore-alpha",
       "docs": {
         "stability": "experimental",
-        "summary": "Represents the concept of an API Schema for a Gateway Target.",
-        "example": "\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst smithySchema = agentcore.ApiSchema.fromLocalAsset(\n  path.join(__dirname, \"models\", \"smithy-model.json\")\n);\nsmithySchema.bind(this);\n\n// Create a gateway target with Smithy Model and OAuth\nconst target = agentcore.GatewayTarget.forSmithy(this, \"MySmithyTarget\", {\n  gatewayTargetName: \"my-smithy-target\",\n  description: \"Target for Smithy model integration\",\n  gateway: gateway,\n  smithyModel: smithySchema,\n});",
-        "custom": {
-          "exampleMetadata": "fixture=default infused"
-        }
+        "summary": "Represents the concept of an API Schema for a Gateway Target."
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.ApiSchema",
       "initializer": {
@@ -12055,9 +12043,9 @@
         "remarks": "The asset is uploaded to an S3 staging bucket, then moved to its final location\nby CloudFormation during deployment.",
         "stability": "experimental",
         "summary": "API Schema from a local asset.",
-        "example": "\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst smithySchema = agentcore.ApiSchema.fromLocalAsset(\n  path.join(__dirname, \"models\", \"smithy-model.json\")\n);\nsmithySchema.bind(this);\n\n// Create a gateway target with Smithy Model and OAuth\nconst target = agentcore.GatewayTarget.forSmithy(this, \"MySmithyTarget\", {\n  gatewayTargetName: \"my-smithy-target\",\n  description: \"Target for Smithy model integration\",\n  gateway: gateway,\n  smithyModel: smithySchema,\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\nimport { aws_iam as iam } from 'aws-cdk-lib';\nimport { aws_kms as interfaces_kms } from 'aws-cdk-lib/interfaces';\n\ndeclare const dockerImage: cdk.DockerImage;\ndeclare const grantable: iam.IGrantable;\ndeclare const keyRef: interfaces_kms.IKeyRef;\ndeclare const localBundling: cdk.ILocalBundling;\nconst assetApiSchema = new bedrock_agentcore_alpha.AssetApiSchema('path', /* all optional props */ {\n  assetHash: 'assetHash',\n  assetHashType: cdk.AssetHashType.SOURCE,\n  bundling: {\n    image: dockerImage,\n\n    // the properties below are optional\n    bundlingFileAccess: cdk.BundlingFileAccess.VOLUME_COPY,\n    command: ['command'],\n    entrypoint: ['entrypoint'],\n    environment: {\n      environmentKey: 'environment',\n    },\n    local: localBundling,\n    network: 'network',\n    outputType: cdk.BundlingOutput.ARCHIVED,\n    platform: 'platform',\n    securityOpt: 'securityOpt',\n    user: 'user',\n    volumes: [{\n      containerPath: 'containerPath',\n      hostPath: 'hostPath',\n\n      // the properties below are optional\n      consistency: cdk.DockerVolumeConsistency.CONSISTENT,\n    }],\n    volumesFrom: ['volumesFrom'],\n    workingDirectory: 'workingDirectory',\n  },\n  deployTime: false,\n  displayName: 'displayName',\n  exclude: ['exclude'],\n  followSymlinks: cdk.SymlinkFollowMode.NEVER,\n  ignoreMode: cdk.IgnoreMode.GLOB,\n  readers: [grantable],\n  sourceKMSKey: keyRef,\n});",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.AssetApiSchema",
@@ -12561,13 +12549,13 @@
       "docs": {
         "custom": {
           "resource": "AWS::BedrockAgentCore::BrowserCustom",
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         },
         "remarks": "Provides a browser environment for web automation and interaction.",
         "see": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser.html",
         "stability": "experimental",
         "summary": "Browser resource for AWS Bedrock Agent Core.",
-        "example": "const browser = new agentcore.BrowserCustom(this, 'BrowserVpcWithRecording', {\n  browserCustomName: 'browser_recording',\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingVpc(this, {\n    vpc: new ec2.Vpc(this, 'VPC', { restrictDefaultSecurityGroup: false }),\n  }),\n});"
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_iam as iam } from 'aws-cdk-lib';\n\ndeclare const browserNetworkConfiguration: bedrock_agentcore_alpha.BrowserNetworkConfiguration;\ndeclare const role: iam.Role;\nconst browserCustom = new bedrock_agentcore_alpha.BrowserCustom(this, 'MyBrowserCustom', /* all optional props */ {\n  browserCustomName: 'browserCustomName',\n  browserSigning: bedrock_agentcore_alpha.BrowserSigning.ENABLED,\n  description: 'description',\n  executionRole: role,\n  networkConfiguration: browserNetworkConfiguration,\n  recordingConfig: {\n    enabled: false,\n    s3Location: {\n      bucketName: 'bucketName',\n      objectKey: 'objectKey',\n\n      // the properties below are optional\n      objectVersion: 'objectVersion',\n    },\n  },\n  tags: {\n    tagsKey: 'tags',\n  },\n});"
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.BrowserCustom",
       "initializer": {
@@ -13813,9 +13801,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for creating a Browser resource.",
-        "example": "const browser = new agentcore.BrowserCustom(this, 'BrowserVpcWithRecording', {\n  browserCustomName: 'browser_recording',\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingVpc(this, {\n    vpc: new ec2.Vpc(this, 'VPC', { restrictDefaultSecurityGroup: false }),\n  }),\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_iam as iam } from 'aws-cdk-lib';\n\ndeclare const browserNetworkConfiguration: bedrock_agentcore_alpha.BrowserNetworkConfiguration;\ndeclare const role: iam.Role;\nconst browserCustomProps: bedrock_agentcore_alpha.BrowserCustomProps = {\n  browserCustomName: 'browserCustomName',\n  browserSigning: bedrock_agentcore_alpha.BrowserSigning.ENABLED,\n  description: 'description',\n  executionRole: role,\n  networkConfiguration: browserNetworkConfiguration,\n  recordingConfig: {\n    enabled: false,\n    s3Location: {\n      bucketName: 'bucketName',\n      objectKey: 'objectKey',\n\n      // the properties below are optional\n      objectVersion: 'objectVersion',\n    },\n  },\n  tags: {\n    tagsKey: 'tags',\n  },\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.BrowserCustomProps",
@@ -13982,9 +13970,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Network configuration for the Browser tool.",
-        "example": "const vpc = new ec2.Vpc(this, 'testVPC');\n\nconst codeInterpreter = new agentcore.CodeInterpreterCustom(this, \"MyCodeInterpreter\", {\n  codeInterpreterCustomName: \"my_sandbox_interpreter\",\n  description: \"Code interpreter with isolated network access\",\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingVpc(this, {\n    vpc: vpc,\n  }),\n});\n\ncodeInterpreter.connections.addSecurityGroup(new ec2.SecurityGroup(this, 'AdditionalGroup', { vpc }));",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst browserNetworkConfiguration = bedrock_agentcore_alpha.BrowserNetworkConfiguration.usingPublicNetwork();",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.BrowserNetworkConfiguration",
@@ -14093,11 +14081,7 @@
       "docs": {
         "remarks": "Specifies whether browser signing is enabled.\nWhen enabled, the browser will cryptographically sign HTTP requests to identify\nitself as an AI agent to bot control vendors.",
         "stability": "experimental",
-        "summary": "Browser signing.",
-        "example": "const browser = new agentcore.BrowserCustom(this, 'test-browser', {\n  browserCustomName: 'test_browser',\n  browserSigning: agentcore.BrowserSigning.ENABLED\n});",
-        "custom": {
-          "exampleMetadata": "fixture=default infused"
-        }
+        "summary": "Browser signing."
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.BrowserSigning",
       "kind": "enum",
@@ -14130,9 +14114,9 @@
         "remarks": "These evaluators assess different aspects of agent performance\nat various levels (session, trace, or tool call).",
         "stability": "experimental",
         "summary": "Built-in evaluators provided by Amazon Bedrock AgentCore.",
-        "example": "declare const customEvaluator: agentcore.Evaluator;\n\nconst evaluation = new agentcore.OnlineEvaluationConfig(this, 'MixedEvaluation', {\n  onlineEvaluationConfigName: 'mixed_evaluation',\n  evaluators: [\n    // Built-in evaluators\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.CORRECTNESS),\n    // Custom evaluator\n    agentcore.EvaluatorReference.custom(customEvaluator),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: ['/aws/bedrock-agentcore/my-agent'],\n    serviceNames: ['my-agent.default'],\n  }),\n});",
+        "example": "// Basic usage with built-in evaluators\nconst evaluation = new agentcore.OnlineEvaluationConfig(this, 'MyEvaluation', {\n  onlineEvaluationConfigName: 'my_evaluation',\n  evaluators: [\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.CORRECTNESS),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: ['/aws/bedrock-agentcore/my-agent'],\n    serviceNames: ['my-agent.default'],\n  }),\n});",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "infused"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.BuiltinEvaluator",
@@ -14465,9 +14449,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Configuration for CloudWatch Logs data source.",
-        "example": "const evaluation = new agentcore.OnlineEvaluationConfig(this, 'MyEvaluation', {\n  onlineEvaluationConfigName: 'my_evaluation',\n  evaluators: [\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.CORRECTNESS),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: ['/aws/bedrock-agentcore/my-agent'],\n    serviceNames: ['my-agent.default'],\n  }),\n});",
+        "example": "// Basic usage with built-in evaluators\nconst evaluation = new agentcore.OnlineEvaluationConfig(this, 'MyEvaluation', {\n  onlineEvaluationConfigName: 'my_evaluation',\n  evaluators: [\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.CORRECTNESS),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: ['/aws/bedrock-agentcore/my-agent'],\n    serviceNames: ['my-agent.default'],\n  }),\n});",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "infused"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.CloudWatchLogsDataSourceConfig",
@@ -14538,9 +14522,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Options for configuring an S3 code asset from local files for agent runtime artifact.",
-        "example": "const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromCodeAsset({\n  path: path.join(__dirname, 'path/to/agent/code'),\n  runtime: agentcore.AgentCoreRuntime.PYTHON_3_12,\n  entrypoint: ['opentelemetry-instrument', 'main.py'],\n});\n\nconst runtimeInstance = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\nimport { aws_iam as iam } from 'aws-cdk-lib';\nimport { aws_kms as interfaces_kms } from 'aws-cdk-lib/interfaces';\n\ndeclare const dockerImage: cdk.DockerImage;\ndeclare const grantable: iam.IGrantable;\ndeclare const keyRef: interfaces_kms.IKeyRef;\ndeclare const localBundling: cdk.ILocalBundling;\nconst codeAssetOptions: bedrock_agentcore_alpha.CodeAssetOptions = {\n  entrypoint: ['entrypoint'],\n  path: 'path',\n  runtime: bedrock_agentcore_alpha.AgentCoreRuntime.PYTHON_3_10,\n\n  // the properties below are optional\n  assetHash: 'assetHash',\n  assetHashType: cdk.AssetHashType.SOURCE,\n  bundling: {\n    image: dockerImage,\n\n    // the properties below are optional\n    bundlingFileAccess: cdk.BundlingFileAccess.VOLUME_COPY,\n    command: ['command'],\n    entrypoint: ['entrypoint'],\n    environment: {\n      environmentKey: 'environment',\n    },\n    local: localBundling,\n    network: 'network',\n    outputType: cdk.BundlingOutput.ARCHIVED,\n    platform: 'platform',\n    securityOpt: 'securityOpt',\n    user: 'user',\n    volumes: [{\n      containerPath: 'containerPath',\n      hostPath: 'hostPath',\n\n      // the properties below are optional\n      consistency: cdk.DockerVolumeConsistency.CONSISTENT,\n    }],\n    volumesFrom: ['volumesFrom'],\n    workingDirectory: 'workingDirectory',\n  },\n  deployTime: false,\n  displayName: 'displayName',\n  exclude: ['exclude'],\n  followSymlinks: cdk.SymlinkFollowMode.NEVER,\n  ignoreMode: cdk.IgnoreMode.GLOB,\n  readers: [grantable],\n  sourceKMSKey: keyRef,\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.CodeAssetOptions",
@@ -14617,9 +14601,9 @@
         "remarks": "Uses a Lambda function to implement custom evaluation logic.",
         "stability": "experimental",
         "summary": "Options for configuring a code-based custom evaluator using a Lambda function.",
-        "example": "declare const evalFunction: lambda.IFunction;\n\nconst codeEvaluator = new agentcore.Evaluator(this, 'CodeEvaluator', {\n  evaluatorName: 'custom_code_evaluator',\n  level: agentcore.EvaluationLevel.TOOL_CALL,\n  description: 'Evaluates tool call accuracy using custom logic',\n  evaluatorConfig: agentcore.EvaluatorConfig.codeBased({\n    lambdaFunction: evalFunction,\n    timeout: cdk.Duration.seconds(30),\n  }),\n});",
+        "example": "// LLM-as-a-Judge evaluator\nconst llmConfig = agentcore.EvaluatorConfig.llmAsAJudge({\n  instructions: 'Evaluate whether the agent response is helpful.',\n  modelId: 'us.anthropic.claude-sonnet-4-6',\n  ratingScale: agentcore.EvaluatorRatingScale.categorical([\n    { label: 'Good', definition: 'The response is helpful.' },\n    { label: 'Bad', definition: 'The response is not helpful.' },\n  ]),\n});\n\n// Code-based evaluator\ndeclare const myEvalFunction: lambda.IFunction;\nconst codeConfig = agentcore.EvaluatorConfig.codeBased({\n  lambdaFunction: myEvalFunction,\n});",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "infused"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.CodeBasedOptions",
@@ -14676,13 +14660,13 @@
       "docs": {
         "custom": {
           "resource": "AWS::BedrockAgentCore::CodeInterpreterCustom",
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         },
         "remarks": "Provides a sandboxed environment for code execution with configurable network access.",
         "see": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/code-interpreter.html",
         "stability": "experimental",
         "summary": "Custom code interpreter resource for AWS Bedrock Agent Core.",
-        "example": "// Create a custom execution role\nconst executionRole = new iam.Role(this, \"CodeInterpreterExecutionRole\", {\n  assumedBy: new iam.ServicePrincipal(\"bedrock-agentcore.amazonaws.com\"),\n});\n\n// Create code interpreter with custom execution role\nconst codeInterpreter = new agentcore.CodeInterpreterCustom(this, \"MyCodeInterpreter\", {\n  codeInterpreterCustomName: \"my_code_interpreter\",\n  description: \"Code interpreter with custom execution role\",\n  networkConfiguration: agentcore.CodeInterpreterNetworkConfiguration.usingPublicNetwork(),\n  executionRole: executionRole,\n});"
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_iam as iam } from 'aws-cdk-lib';\n\ndeclare const codeInterpreterNetworkConfiguration: bedrock_agentcore_alpha.CodeInterpreterNetworkConfiguration;\ndeclare const role: iam.Role;\nconst codeInterpreterCustom = new bedrock_agentcore_alpha.CodeInterpreterCustom(this, 'MyCodeInterpreterCustom', /* all optional props */ {\n  codeInterpreterCustomName: 'codeInterpreterCustomName',\n  description: 'description',\n  executionRole: role,\n  networkConfiguration: codeInterpreterNetworkConfiguration,\n  tags: {\n    tagsKey: 'tags',\n  },\n});"
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.CodeInterpreterCustom",
       "initializer": {
@@ -15833,9 +15817,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for creating a CodeInterpreter resource.",
-        "example": "// Create a custom execution role\nconst executionRole = new iam.Role(this, \"CodeInterpreterExecutionRole\", {\n  assumedBy: new iam.ServicePrincipal(\"bedrock-agentcore.amazonaws.com\"),\n});\n\n// Create code interpreter with custom execution role\nconst codeInterpreter = new agentcore.CodeInterpreterCustom(this, \"MyCodeInterpreter\", {\n  codeInterpreterCustomName: \"my_code_interpreter\",\n  description: \"Code interpreter with custom execution role\",\n  networkConfiguration: agentcore.CodeInterpreterNetworkConfiguration.usingPublicNetwork(),\n  executionRole: executionRole,\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_iam as iam } from 'aws-cdk-lib';\n\ndeclare const codeInterpreterNetworkConfiguration: bedrock_agentcore_alpha.CodeInterpreterNetworkConfiguration;\ndeclare const role: iam.Role;\nconst codeInterpreterCustomProps: bedrock_agentcore_alpha.CodeInterpreterCustomProps = {\n  codeInterpreterCustomName: 'codeInterpreterCustomName',\n  description: 'description',\n  executionRole: role,\n  networkConfiguration: codeInterpreterNetworkConfiguration,\n  tags: {\n    tagsKey: 'tags',\n  },\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.CodeInterpreterCustomProps",
@@ -15962,9 +15946,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Network configuration for the Code Interpreter tool.",
-        "example": "// Create a custom execution role\nconst executionRole = new iam.Role(this, \"CodeInterpreterExecutionRole\", {\n  assumedBy: new iam.ServicePrincipal(\"bedrock-agentcore.amazonaws.com\"),\n});\n\n// Create code interpreter with custom execution role\nconst codeInterpreter = new agentcore.CodeInterpreterCustom(this, \"MyCodeInterpreter\", {\n  codeInterpreterCustomName: \"my_code_interpreter\",\n  description: \"Code interpreter with custom execution role\",\n  networkConfiguration: agentcore.CodeInterpreterNetworkConfiguration.usingPublicNetwork(),\n  executionRole: executionRole,\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst codeInterpreterNetworkConfiguration = bedrock_agentcore_alpha.CodeInterpreterNetworkConfiguration.usingPublicNetwork();",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.CodeInterpreterNetworkConfiguration",
@@ -16091,9 +16075,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "****************************************************************************                              Factory ***************************************************************************.",
-        "example": "declare const userPool: cognito.UserPool;\ndeclare const userPoolClient: cognito.UserPoolClient;\n\n// Optional: Create custom claims (CustomClaimOperator and GatewayCustomClaim from agentcore)\nconst customClaims = [\n  agentcore.GatewayCustomClaim.withStringValue('department', 'engineering'),\n  agentcore.GatewayCustomClaim.withStringArrayValue('roles', ['admin'], agentcore.CustomClaimOperator.CONTAINS),\n  agentcore.GatewayCustomClaim.withStringArrayValue('permissions', ['read', 'write'], agentcore.CustomClaimOperator.CONTAINS_ANY),\n];\n\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCognito({\n    userPool: userPool,\n    allowedClients: [userPoolClient],\n    allowedAudiences: [\"audience1\"],\n    allowedScopes: [\"read\", \"write\"],\n    customClaims: customClaims, // Optional custom claims\n  }),\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_cognito as cognito } from 'aws-cdk-lib';\n\ndeclare const gatewayCustomClaim: bedrock_agentcore_alpha.GatewayCustomClaim;\ndeclare const userPool: cognito.UserPool;\ndeclare const userPoolClient: cognito.UserPoolClient;\nconst cognitoAuthorizerProps: bedrock_agentcore_alpha.CognitoAuthorizerProps = {\n  userPool: userPool,\n\n  // the properties below are optional\n  allowedAudiences: ['allowedAudiences'],\n  allowedClients: [userPoolClient],\n  allowedScopes: ['allowedScopes'],\n  customClaims: [gatewayCustomClaim],\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.CognitoAuthorizerProps",
@@ -16901,11 +16885,7 @@
       "docs": {
         "remarks": "Shared by Runtime and Gateway custom claim implementations.",
         "stability": "experimental",
-        "summary": "Custom claim match operator.",
-        "example": "declare const userPool: cognito.UserPool;\ndeclare const userPoolClient: cognito.UserPoolClient;\n\n// Optional: Create custom claims (CustomClaimOperator and GatewayCustomClaim from agentcore)\nconst customClaims = [\n  agentcore.GatewayCustomClaim.withStringValue('department', 'engineering'),\n  agentcore.GatewayCustomClaim.withStringArrayValue('roles', ['admin'], agentcore.CustomClaimOperator.CONTAINS),\n  agentcore.GatewayCustomClaim.withStringArrayValue('permissions', ['read', 'write'], agentcore.CustomClaimOperator.CONTAINS_ANY),\n];\n\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCognito({\n    userPool: userPool,\n    allowedClients: [userPoolClient],\n    allowedAudiences: [\"audience1\"],\n    allowedScopes: [\"read\", \"write\"],\n    customClaims: customClaims, // Optional custom claims\n  }),\n});",
-        "custom": {
-          "exampleMetadata": "fixture=default infused"
-        }
+        "summary": "Custom claim match operator."
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.CustomClaimOperator",
       "kind": "enum",
@@ -17004,9 +16984,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Custom JWT authorizer configuration.",
-        "example": "// Create a custom execution role\nconst executionRole = new iam.Role(this, \"GatewayExecutionRole\", {\n  assumedBy: new iam.ServicePrincipal(\"bedrock-agentcore.amazonaws.com\"),\n  managedPolicies: [\n    iam.ManagedPolicy.fromAwsManagedPolicyName(\"AmazonBedrockAgentCoreGatewayExecutionRolePolicy\"),\n  ],\n});\n\n// Create gateway with custom execution role\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  description: \"Gateway with custom execution role\",\n  protocolConfiguration: new agentcore.McpProtocolConfiguration({\n    instructions: \"Use this gateway to connect to external MCP tools\",\n    searchType: agentcore.McpGatewaySearchType.SEMANTIC,\n    supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],\n  }),\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({\n    discoveryUrl: \"https://auth.example.com/.well-known/openid-configuration\",\n    allowedAudience: [\"my-app\"],\n    allowedClients: [\"my-client-id\"],\n    allowedScopes: [\"read\", \"write\"],\n  }),\n  role: executionRole,\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\ndeclare const gatewayCustomClaim: bedrock_agentcore_alpha.GatewayCustomClaim;\nconst customJwtConfiguration: bedrock_agentcore_alpha.CustomJwtConfiguration = {\n  discoveryUrl: 'discoveryUrl',\n\n  // the properties below are optional\n  allowedAudience: ['allowedAudience'],\n  allowedClients: ['allowedClients'],\n  allowedScopes: ['allowedScopes'],\n  customClaims: [gatewayCustomClaim],\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.CustomJwtConfiguration",
@@ -17137,9 +17117,9 @@
         "remarks": "Set exactly one of {@link discoveryUrl} (OIDC discovery document) or {@link authorizationServerMetadata}\n(static OAuth2 server metadata). Do not pass both.",
         "stability": "experimental",
         "summary": "Props for {@link OAuth2CredentialProvider.usingCustom}.",
-        "example": "agentcore.OAuth2CredentialProvider.usingCustom(this, \"CustomOAuth\", {\n  oAuth2CredentialProviderName: \"custom-idp\",\n  clientId: \"your-client-id\",\n  clientSecret: cdk.SecretValue.unsafePlainText(\"your-client-secret\"),\n  discoveryUrl: \"https://idp.example.com/.well-known/openid-configuration\",\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\n\ndeclare const secretValue: cdk.SecretValue;\nconst customOAuth2CredentialProviderProps: bedrock_agentcore_alpha.CustomOAuth2CredentialProviderProps = {\n  clientId: 'clientId',\n  clientSecret: secretValue,\n\n  // the properties below are optional\n  authorizationServerMetadata: {\n    authorizationEndpoint: 'authorizationEndpoint',\n    issuer: 'issuer',\n    tokenEndpoint: 'tokenEndpoint',\n\n    // the properties below are optional\n    responseTypes: ['responseTypes'],\n  },\n  discoveryUrl: 'discoveryUrl',\n  oAuth2CredentialProviderName: 'oAuth2CredentialProviderName',\n  tags: {\n    tagsKey: 'tags',\n  },\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.CustomOAuth2CredentialProviderProps",
@@ -17425,9 +17405,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Configuration for episodic memory reflection.",
-        "example": "// Create memory with custom strategies\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my_memory\",\n  description: \"Memory with custom strategies\",\n  expirationDuration: cdk.Duration.days(90),\n  memoryStrategies: [\n    agentcore.MemoryStrategy.usingUserPreference({\n        name: \"CustomerPreferences\",\n        namespaces: [\"support/customer/{actorId}/preferences\"]\n    }),\n    agentcore.MemoryStrategy.usingSemantic({\n        name: \"CustomerSupportSemantic\",\n        namespaces: [\"support/customer/{actorId}/semantic\"]\n    }),\n     agentcore.MemoryStrategy.usingEpisodic({\n        name: \"customerJourneyEpisodic\",\n        namespaces: [\"/journey/customer/{actorId}/episodes\"],\n        reflectionConfiguration: {\n            namespaces: [\"/journey/customer/{actorId}/reflections\"]\n        }\n    }),\n  ],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst episodicReflectionConfiguration: bedrock_agentcore_alpha.EpisodicReflectionConfiguration = {\n  namespaces: ['namespaces'],\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.EpisodicReflectionConfiguration",
@@ -18290,9 +18270,9 @@
         "remarks": "Controls how the foundation model generates evaluation responses.",
         "stability": "experimental",
         "summary": "Inference configuration for a custom LLM-as-a-Judge evaluator.",
-        "example": "// LLM-as-a-Judge with categorical rating scale\nconst categoricalEvaluator = new agentcore.Evaluator(this, 'CategoricalEvaluator', {\n  evaluatorName: 'domain_accuracy_evaluator',\n  level: agentcore.EvaluationLevel.SESSION,\n  description: 'Evaluates domain-specific accuracy of agent responses',\n  evaluatorConfig: agentcore.EvaluatorConfig.llmAsAJudge({\n    instructions: 'Evaluate whether the agent response is accurate within the healthcare domain.',\n    modelId: 'us.anthropic.claude-sonnet-4-6',\n    ratingScale: agentcore.EvaluatorRatingScale.categorical([\n      { label: 'Accurate', definition: 'The response contains factually correct healthcare information.' },\n      { label: 'Inaccurate', definition: 'The response contains incorrect or misleading healthcare information.' },\n    ]),\n  }),\n});\n\n// LLM-as-a-Judge with numerical rating scale and inference config\nconst numericalEvaluator = new agentcore.Evaluator(this, 'NumericalEvaluator', {\n  evaluatorName: 'response_quality_evaluator',\n  level: agentcore.EvaluationLevel.TRACE,\n  evaluatorConfig: agentcore.EvaluatorConfig.llmAsAJudge({\n    instructions: 'Rate the overall quality of the agent response on a scale of 1 to 5.',\n    modelId: 'us.anthropic.claude-sonnet-4-6',\n    ratingScale: agentcore.EvaluatorRatingScale.numerical([\n      { label: 'Poor', definition: 'Inadequate response.', value: 1 },\n      { label: 'Below Average', definition: 'Partially addresses the query.', value: 2 },\n      { label: 'Average', definition: 'Adequately addresses the query.', value: 3 },\n      { label: 'Good', definition: 'Well-structured and accurate response.', value: 4 },\n      { label: 'Excellent', definition: 'Outstanding response exceeding expectations.', value: 5 },\n    ]),\n    inferenceConfig: {\n      maxTokens: 1024,\n      temperature: 0.1,\n    },\n  }),\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst evaluatorInferenceConfig: bedrock_agentcore_alpha.EvaluatorInferenceConfig = {\n  maxTokens: 123,\n  temperature: 123,\n  topP: 123,\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.EvaluatorInferenceConfig",
@@ -18914,9 +18894,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Filter operators for online evaluation filtering.",
-        "example": "const evaluation = new agentcore.OnlineEvaluationConfig(this, 'FilteredEval', {\n  onlineEvaluationConfigName: 'filtered_evaluation',\n  evaluators: [\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: ['/aws/bedrock-agentcore/my-agent'],\n    serviceNames: ['my-agent.default'],\n  }),\n  // Sample 25% of traces\n  samplingPercentage: 25,\n  // Only evaluate traces matching these filters\n  filters: [\n    {\n      key: 'user.region',\n      operator: agentcore.FilterOperator.EQUAL,\n      value: agentcore.FilterValue.string('us-east-1'),\n    },\n    {\n      key: 'session.duration',\n      operator: agentcore.FilterOperator.GREATER_THAN,\n      value: agentcore.FilterValue.number(60),\n    },\n  ],\n  // Consider sessions complete after 30 minutes of inactivity\n  sessionTimeout: cdk.Duration.minutes(30),\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst filterOperator = bedrock_agentcore_alpha.FilterOperator.CONTAINS;",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.FilterOperator",
@@ -19107,9 +19087,9 @@
         "remarks": "Use the static factory methods to create filter values:\n- `FilterValue.string()` for string comparisons\n- `FilterValue.number()` for numeric comparisons\n- `FilterValue.boolean()` for boolean comparisons",
         "stability": "experimental",
         "summary": "A typed filter value for online evaluation filtering.",
-        "example": "const evaluation = new agentcore.OnlineEvaluationConfig(this, 'FilteredEval', {\n  onlineEvaluationConfigName: 'filtered_evaluation',\n  evaluators: [\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: ['/aws/bedrock-agentcore/my-agent'],\n    serviceNames: ['my-agent.default'],\n  }),\n  // Sample 25% of traces\n  samplingPercentage: 25,\n  // Only evaluate traces matching these filters\n  filters: [\n    {\n      key: 'user.region',\n      operator: agentcore.FilterOperator.EQUAL,\n      value: agentcore.FilterValue.string('us-east-1'),\n    },\n    {\n      key: 'session.duration',\n      operator: agentcore.FilterOperator.GREATER_THAN,\n      value: agentcore.FilterValue.number(60),\n    },\n  ],\n  // Consider sessions complete after 30 minutes of inactivity\n  sessionTimeout: cdk.Duration.minutes(30),\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst filterValue = bedrock_agentcore_alpha.FilterValue.boolean(false);",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.FilterValue",
@@ -19213,9 +19193,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Optional gateway settings when binding an {@link IApiKeyCredentialProvider} to a target.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// Create an API key credential provider in Token Vault\nconst apiKeyProvider = new agentcore.ApiKeyCredentialProvider(this, \"MyApiKeyProvider\", {\n  apiKeyCredentialProviderName: \"my-apikey\",\n});\n\nconst bucket = s3.Bucket.fromBucketName(this, \"ExistingBucket\", \"my-schema-bucket\");\nconst s3mySchema = agentcore.ApiSchema.fromS3File(bucket, \"schemas/myschema.yaml\");\n\n// Add an OpenAPI target using the L2 construct directly\nconst target = gateway.addOpenApiTarget(\"MyTarget\", {\n  gatewayTargetName: \"my-api-target\",\n  description: \"Target for external API integration\",\n  apiSchema: s3mySchema,\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromApiKeyIdentity(apiKeyProvider, {\n      credentialLocation: agentcore.ApiKeyCredentialLocation.header({\n        credentialParameterName: \"X-API-Key\",\n      }),\n    }),\n  ],\n});\n\n// This makes sure your s3 bucket is available before target\ntarget.node.addDependency(bucket);",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\ndeclare const apiKeyCredentialLocation: bedrock_agentcore_alpha.ApiKeyCredentialLocation;\nconst fromApiKeyIdentityOptions: bedrock_agentcore_alpha.FromApiKeyIdentityOptions = {\n  credentialLocation: apiKeyCredentialLocation,\n};",
         "custom": {
-          "exampleMetadata": "infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.FromApiKeyIdentityOptions",
@@ -19253,9 +19233,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "OAuth scopes (and optional custom parameters) when binding an {@link IOAuth2CredentialProvider} to a gateway target.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst oauth = agentcore.OAuth2CredentialProvider.usingGithub(this, \"GhOAuth\", {\n  oAuth2CredentialProviderName: \"github-oauth\",\n  clientId: \"your-client-id\",\n  clientSecret: cdk.SecretValue.unsafePlainText(\"your-client-secret\"),\n});\n\ngateway.addMcpServerTarget(\"Mcp\", {\n  gatewayTargetName: \"mcp-server\",\n  description: \"MCP with GitHub OAuth\",\n  endpoint: \"https://my-mcp-server.example.com\",\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromOauthIdentity(oauth, {\n      scopes: [\"read:user\"],\n    }),\n  ],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst fromOauthIdentityOptions: bedrock_agentcore_alpha.FromOauthIdentityOptions = {\n  scopes: ['scopes'],\n\n  // the properties below are optional\n  customParameters: {\n    customParametersKey: 'customParameters',\n  },\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.FromOauthIdentityOptions",
@@ -19325,7 +19305,7 @@
         "see": "https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_CreateGateway.html",
         "stability": "experimental",
         "summary": "Gateway resource for AWS Bedrock Agent Core.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst policyEngine = new agentcore.PolicyEngine(this, \"MyPolicyEngine\", {\n  policyEngineName: \"my_policy_engine\",\n});\n\nconst allowAllPolicy = new agentcore.Policy(this, \"AllowAllPolicy\", {\n  policyEngine: policyEngine,\n  policyName: \"allow_all\",\n  statement: agentcore.PolicyStatement.permit()\n    .forAllPrincipals() // ** This will give overly permission to all principals\n    .onAllActions()\n    .onResource('AgentCore::Gateway', gateway.gatewayArn),\n  description: \"Allow all actions on specific gateway (development only)\",\n  validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS,\n});\n\n// Generated Cedar:\n// permit(\n//   principal,\n//   action,\n//   resource == AgentCore::Gateway::\"arn:aws:bedrock-agentcore:region:account:gateway/gateway-id\"\n// );"
+        "example": "\n// Create a Policy engine\nconst policyEngine = new agentcore.PolicyEngine(this, \"MyPolicyEngine\", {\n  policyEngineName: \"my_policy_engine\",\n  description: \"Policy engine for access control\",\n});\n\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  policyEngineConfiguration: {\n    policyEngine: policyEngine,\n    mode: agentcore.PolicyEngineMode.ENFORCE, // Default is LOG_ONLY\n  },\n});\n\n// Add policy to policy engine\npolicyEngine.addPolicy(\"AllowAllActions\", {\n  definition: `\n    permit(\n      principal,\n      action,\n      resource == AgentCore::Gateway::\"${gateway.gatewayArn}\"\n    );\n  `,\n  description: \"Allow all actions on specific gateway (development)\",\n  validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS, // This will ignore all cedar warnings\n});\n\n// you can add multiple policies to the policy engine\npolicyEngine.addPolicy(\"SpecificToolPolicy\", {\n  definition: `\n    permit(\n      principal is AgentCore::OAuthUser,\n      action == AgentCore::Action::\"WeatherTool__get_forecast\",\n      resource == AgentCore::Gateway::\"${gateway.gatewayArn}\"\n    );\n  `,\n  description: \"Allow specific weather tool access\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS, // This will fail policy creation for any cedar warning\n});"
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.Gateway",
       "initializer": {
@@ -20186,11 +20166,7 @@
       "assembly": "@aws-cdk/aws-bedrock-agentcore-alpha",
       "docs": {
         "stability": "experimental",
-        "summary": "Factory class for creating Gateway Authorizers.",
-        "example": "\n// Optional: Create custom claims (CustomClaimOperator and GatewayCustomClaim from agentcore)\nconst customClaims = [\n  agentcore.GatewayCustomClaim.withStringValue('department', 'engineering'),\n  agentcore.GatewayCustomClaim.withStringArrayValue('roles', ['admin'], agentcore.CustomClaimOperator.CONTAINS),\n  agentcore.GatewayCustomClaim.withStringArrayValue('permissions', ['read', 'write'], agentcore.CustomClaimOperator.CONTAINS_ANY),\n];\n\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({\n    discoveryUrl: \"https://auth.example.com/.well-known/openid-configuration\",\n    allowedAudience: [\"my-app\"],\n    allowedClients: [\"my-client-id\"],\n    allowedScopes: [\"read\", \"write\"],\n    customClaims: customClaims, // Optional custom claims\n  }),\n});",
-        "custom": {
-          "exampleMetadata": "fixture=default infused"
-        }
+        "summary": "Factory class for creating Gateway Authorizers."
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayAuthorizer",
       "initializer": {
@@ -21064,11 +21040,7 @@
       "assembly": "@aws-cdk/aws-bedrock-agentcore-alpha",
       "docs": {
         "stability": "experimental",
-        "summary": "Factory class for creating different Gateway Credential Providers.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// OAuth2 (recommended): use OAuth2CredentialProvider + bindForGatewayOAuthTarget, or ARNs from console/API\nconst oauthProviderArn = \"arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/oauth2credentialprovider/my-oauth\";\nconst oauthSecretArn = \"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-oauth-secret-abc123\";\n\n// Add an MCP server target directly to the gateway\nconst mcpTarget = gateway.addMcpServerTarget(\"MyMcpServer\", {\n  gatewayTargetName: \"my-mcp-server\",\n  description: \"External MCP server integration\",\n  endpoint: \"https://my-mcp-server.example.com\",\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromOauthIdentityArn({\n      providerArn: oauthProviderArn,\n      secretArn: oauthSecretArn,\n      scopes:['mcp-runtime-server/invoke']\n    }),\n  ],\n});\n\n// Grant sync permission to a Lambda function that will trigger synchronization\nconst syncFunction = new lambda.Function(this, \"SyncFunction\", {\n  runtime: lambda.Runtime.PYTHON_3_12,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\nimport boto3\n\ndef handler(event, context):\n    client = boto3.client('bedrock-agentcore')\n    response = client.synchronize_gateway_targets(\n        gatewayIdentifier=event['gatewayId'],\n        targetIds=[event['targetId']]\n    )\n    return response\n  `),\n});\n\nmcpTarget.grantSync(syncFunction);",
-        "custom": {
-          "exampleMetadata": "fixture=default infused"
-        }
+        "summary": "Factory class for creating different Gateway Credential Providers."
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCredentialProvider",
       "initializer": {
@@ -21233,9 +21205,9 @@
         "remarks": "Custom claims allow you to validate additional fields in JWT tokens beyond\nthe standard audience, client, and scope validations.",
         "stability": "experimental",
         "summary": "Represents a custom claim validation configuration for Gateway JWT authorizers.",
-        "example": "\n// Optional: Create custom claims (CustomClaimOperator and GatewayCustomClaim from agentcore)\nconst customClaims = [\n  agentcore.GatewayCustomClaim.withStringValue('department', 'engineering'),\n  agentcore.GatewayCustomClaim.withStringArrayValue('roles', ['admin'], agentcore.CustomClaimOperator.CONTAINS),\n  agentcore.GatewayCustomClaim.withStringArrayValue('permissions', ['read', 'write'], agentcore.CustomClaimOperator.CONTAINS_ANY),\n];\n\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({\n    discoveryUrl: \"https://auth.example.com/.well-known/openid-configuration\",\n    allowedAudience: [\"my-app\"],\n    allowedClients: [\"my-client-id\"],\n    allowedScopes: [\"read\", \"write\"],\n    customClaims: customClaims, // Optional custom claims\n  }),\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst gatewayCustomClaim = bedrock_agentcore_alpha.GatewayCustomClaim.withStringArrayValue('name', ['values'], /* all optional props */ bedrock_agentcore_alpha.CustomClaimOperator.EQUALS);",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCustomClaim",
@@ -21347,11 +21319,7 @@
       "assembly": "@aws-cdk/aws-bedrock-agentcore-alpha",
       "docs": {
         "stability": "experimental",
-        "summary": "Exception levels for gateway.",
-        "example": "// Create a KMS key for encryption\nconst encryptionKey = new kms.Key(this, \"GatewayEncryptionKey\", {\n  enableKeyRotation: true,\n  description: \"KMS key for gateway encryption\",\n});\n\n// Create gateway with KMS encryption\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-encrypted-gateway\",\n  description: \"Gateway with KMS encryption\",\n  protocolConfiguration: new agentcore.McpProtocolConfiguration({\n    instructions: \"Use this gateway to connect to external MCP tools\",\n    searchType: agentcore.McpGatewaySearchType.SEMANTIC,\n    supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],\n  }),\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({\n    discoveryUrl: \"https://auth.example.com/.well-known/openid-configuration\",\n    allowedAudience: [\"my-app\"],\n    allowedClients: [\"my-client-id\"],\n    allowedScopes: [\"read\", \"write\"],\n  }),\n  kmsKey: encryptionKey,\n  exceptionLevel: agentcore.GatewayExceptionLevel.DEBUG,\n});",
-        "custom": {
-          "exampleMetadata": "fixture=default infused"
-        }
+        "summary": "Exception levels for gateway."
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayExceptionLevel",
       "kind": "enum",
@@ -21535,7 +21503,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for defining a Gateway.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst policyEngine = new agentcore.PolicyEngine(this, \"MyPolicyEngine\", {\n  policyEngineName: \"my_policy_engine\",\n});\n\nconst allowAllPolicy = new agentcore.Policy(this, \"AllowAllPolicy\", {\n  policyEngine: policyEngine,\n  policyName: \"allow_all\",\n  statement: agentcore.PolicyStatement.permit()\n    .forAllPrincipals() // ** This will give overly permission to all principals\n    .onAllActions()\n    .onResource('AgentCore::Gateway', gateway.gatewayArn),\n  description: \"Allow all actions on specific gateway (development only)\",\n  validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS,\n});\n\n// Generated Cedar:\n// permit(\n//   principal,\n//   action,\n//   resource == AgentCore::Gateway::\"arn:aws:bedrock-agentcore:region:account:gateway/gateway-id\"\n// );",
+        "example": "\n// Create a Policy engine\nconst policyEngine = new agentcore.PolicyEngine(this, \"MyPolicyEngine\", {\n  policyEngineName: \"my_policy_engine\",\n  description: \"Policy engine for access control\",\n});\n\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  policyEngineConfiguration: {\n    policyEngine: policyEngine,\n    mode: agentcore.PolicyEngineMode.ENFORCE, // Default is LOG_ONLY\n  },\n});\n\n// Add policy to policy engine\npolicyEngine.addPolicy(\"AllowAllActions\", {\n  definition: `\n    permit(\n      principal,\n      action,\n      resource == AgentCore::Gateway::\"${gateway.gatewayArn}\"\n    );\n  `,\n  description: \"Allow all actions on specific gateway (development)\",\n  validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS, // This will ignore all cedar warnings\n});\n\n// you can add multiple policies to the policy engine\npolicyEngine.addPolicy(\"SpecificToolPolicy\", {\n  definition: `\n    permit(\n      principal is AgentCore::OAuthUser,\n      action == AgentCore::Action::\"WeatherTool__get_forecast\",\n      resource == AgentCore::Gateway::\"${gateway.gatewayArn}\"\n    );\n  `,\n  description: \"Allow specific weather tool access\",\n  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS, // This will fail policy creation for any cedar warning\n});",
         "custom": {
           "exampleMetadata": "fixture=default infused"
         }
@@ -21803,13 +21771,13 @@
       "docs": {
         "custom": {
           "resource": "AWS::BedrockAgentCore::GatewayTarget",
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         },
         "remarks": "Supports multiple target types:\n- Lambda: Wraps a Lambda function as MCP tools\n- OpenAPI: Exposes an OpenAPI/REST API as MCP tools\n- Smithy: Exposes a Smithy-modeled API as MCP tools",
         "see": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-building-adding-targets.html",
         "stability": "experimental",
         "summary": "Defines tools that your gateway will host.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst lambdaFunction = new lambda.Function(this, \"MyFunction\", {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\n        exports.handler = async (event) => {\n            return {\n                statusCode: 200,\n                body: JSON.stringify({ message: 'Hello from Lambda!' })\n            };\n        };\n    `),\n});\n\n// Create a gateway target with Lambda and tool schema\nconst target = agentcore.GatewayTarget.forLambda(this, \"MyLambdaTarget\", {\n  gatewayTargetName: \"my-lambda-target\",\n  description: \"Target for Lambda function integration\",\n  gateway: gateway,\n  lambdaFunction: lambdaFunction,\n  toolSchema: agentcore.ToolSchema.fromLocalAsset(\n    path.join(__dirname, \"schemas\", \"my-tool-schema.json\")\n  ),\n});"
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\ndeclare const credentialProviderConfig: bedrock_agentcore_alpha.ICredentialProviderConfig;\ndeclare const gateway: bedrock_agentcore_alpha.Gateway;\ndeclare const targetConfiguration: bedrock_agentcore_alpha.ITargetConfiguration;\nconst gatewayTarget = new bedrock_agentcore_alpha.GatewayTarget(this, 'MyGatewayTarget', {\n  gateway: gateway,\n  targetConfiguration: targetConfiguration,\n\n  // the properties below are optional\n  credentialProviderConfigurations: [credentialProviderConfig],\n  description: 'description',\n  gatewayTargetName: 'gatewayTargetName',\n});"
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayTarget",
       "initializer": {
@@ -22414,9 +22382,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for creating an API Gateway-based Gateway Target.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst api = new apigateway.RestApi(this, 'MyApi', {\n  restApiName: 'my-api',\n});\n\n// Create a gateway target using the static factory method\nconst apiGatewayTarget = agentcore.GatewayTarget.forApiGateway(this, \"MyApiGatewayTarget\", {\n  gatewayTargetName: \"my-api-gateway-target\",\n  description: \"Target for API Gateway REST API integration\",\n  gateway: gateway,\n  restApi: api,\n  apiGatewayToolConfiguration: {\n    toolFilters: [\n      {\n        filterPath: \"/pets/*\",\n        methods: [agentcore.ApiGatewayHttpMethod.GET, agentcore.ApiGatewayHttpMethod.POST],\n      },\n    ],\n  },\n  metadataConfiguration: {\n    allowedRequestHeaders: [\"X-User-Id\"],\n    allowedQueryParameters: [\"limit\"],\n  },\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_apigateway as apigateway } from 'aws-cdk-lib';\n\ndeclare const credentialProviderConfig: bedrock_agentcore_alpha.ICredentialProviderConfig;\ndeclare const gateway: bedrock_agentcore_alpha.Gateway;\ndeclare const restApi: apigateway.RestApi;\nconst gatewayTargetApiGatewayProps: bedrock_agentcore_alpha.GatewayTargetApiGatewayProps = {\n  apiGatewayToolConfiguration: {\n    toolFilters: [{\n      filterPath: 'filterPath',\n      methods: [bedrock_agentcore_alpha.ApiGatewayHttpMethod.GET],\n    }],\n\n    // the properties below are optional\n    toolOverrides: [{\n      method: bedrock_agentcore_alpha.ApiGatewayHttpMethod.GET,\n      name: 'name',\n      path: 'path',\n\n      // the properties below are optional\n      description: 'description',\n    }],\n  },\n  gateway: gateway,\n  restApi: restApi,\n\n  // the properties below are optional\n  credentialProviderConfigurations: [credentialProviderConfig],\n  description: 'description',\n  gatewayTargetName: 'gatewayTargetName',\n  metadataConfiguration: {\n    allowedQueryParameters: ['allowedQueryParameters'],\n    allowedRequestHeaders: ['allowedRequestHeaders'],\n    allowedResponseHeaders: ['allowedResponseHeaders'],\n  },\n  stage: 'stage',\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayTargetApiGatewayProps",
@@ -23116,9 +23084,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for creating a Lambda-based Gateway Target Convenience interface for the most common use case.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst lambdaFunction = new lambda.Function(this, \"MyFunction\", {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\n        exports.handler = async (event) => {\n            return {\n                statusCode: 200,\n                body: JSON.stringify({ message: 'Hello from Lambda!' })\n            };\n        };\n    `),\n});\n\n// Create a gateway target with Lambda and tool schema\nconst target = agentcore.GatewayTarget.forLambda(this, \"MyLambdaTarget\", {\n  gatewayTargetName: \"my-lambda-target\",\n  description: \"Target for Lambda function integration\",\n  gateway: gateway,\n  lambdaFunction: lambdaFunction,\n  toolSchema: agentcore.ToolSchema.fromLocalAsset(\n    path.join(__dirname, \"schemas\", \"my-tool-schema.json\")\n  ),\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_lambda as lambda } from 'aws-cdk-lib';\n\ndeclare const credentialProviderConfig: bedrock_agentcore_alpha.ICredentialProviderConfig;\ndeclare const function_: lambda.Function;\ndeclare const gateway: bedrock_agentcore_alpha.Gateway;\ndeclare const toolSchema: bedrock_agentcore_alpha.ToolSchema;\nconst gatewayTargetLambdaProps: bedrock_agentcore_alpha.GatewayTargetLambdaProps = {\n  gateway: gateway,\n  lambdaFunction: function_,\n  toolSchema: toolSchema,\n\n  // the properties below are optional\n  credentialProviderConfigurations: [credentialProviderConfig],\n  description: 'description',\n  gatewayTargetName: 'gatewayTargetName',\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayTargetLambdaProps",
@@ -23212,9 +23180,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for creating an MCP Server-based Gateway Target.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// OAuth2 (recommended): use OAuth2CredentialProvider + bindForGatewayOAuthTarget, or ARNs from console/API\nconst oauthProviderArn = \"arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/oauth2credentialprovider/my-oauth\";\nconst oauthSecretArn = \"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-oauth-secret-abc123\";\n\n// Create a gateway target with MCP Server\nconst mcpTarget = agentcore.GatewayTarget.forMcpServer(this, \"MyMcpServer\", {\n  gatewayTargetName: \"my-mcp-server\",\n  description: \"External MCP server integration\",\n  gateway: gateway,\n  endpoint: \"https://my-mcp-server.example.com\",\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromOauthIdentityArn({\n      providerArn: oauthProviderArn,\n      secretArn: oauthSecretArn,\n      scopes:['mcp-runtime-server/invoke']\n    }),\n  ],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\ndeclare const credentialProviderConfig: bedrock_agentcore_alpha.ICredentialProviderConfig;\ndeclare const gateway: bedrock_agentcore_alpha.Gateway;\nconst gatewayTargetMcpServerProps: bedrock_agentcore_alpha.GatewayTargetMcpServerProps = {\n  credentialProviderConfigurations: [credentialProviderConfig],\n  endpoint: 'endpoint',\n  gateway: gateway,\n\n  // the properties below are optional\n  description: 'description',\n  gatewayTargetName: 'gatewayTargetName',\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayTargetMcpServerProps",
@@ -23291,9 +23259,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for creating an OpenAPI-based Gateway Target.",
-        "example": "\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// Outbound auth: ApiKeyCredentialProvider + bindForGatewayApiKeyTarget, or ARNs from console/API\nconst apiKeyIdentityArn = \"arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/apikeycredentialprovider/my-apikey\"\nconst apiKeySecretArn = \"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-apikey-secret-abc123\"\n\nconst opneapiSchema = agentcore.ApiSchema.fromLocalAsset(path.join(__dirname, \"mySchema.yml\"));\nopneapiSchema.bind(this);\n\n// Create a gateway target with OpenAPI Schema\nconst target = agentcore.GatewayTarget.forOpenApi(this, \"MyTarget\", {\n  gatewayTargetName: \"my-api-target\",\n  description: \"Target for external API integration\",\n  gateway: gateway,  // Note: you need to pass the gateway reference\n  apiSchema: opneapiSchema,\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromApiKeyIdentityArn({\n     providerArn: apiKeyIdentityArn,\n     secretArn: apiKeySecretArn\n    }),\n  ],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\ndeclare const apiSchema: bedrock_agentcore_alpha.ApiSchema;\ndeclare const credentialProviderConfig: bedrock_agentcore_alpha.ICredentialProviderConfig;\ndeclare const gateway: bedrock_agentcore_alpha.Gateway;\nconst gatewayTargetOpenApiProps: bedrock_agentcore_alpha.GatewayTargetOpenApiProps = {\n  apiSchema: apiSchema,\n  gateway: gateway,\n\n  // the properties below are optional\n  credentialProviderConfigurations: [credentialProviderConfig],\n  description: 'description',\n  gatewayTargetName: 'gatewayTargetName',\n  validateOpenApiSchema: false,\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayTargetOpenApiProps",
@@ -23390,9 +23358,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for creating a Gateway Target resource.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst myLambdaFunction = new lambda.Function(this, \"MyFunction\", {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\n    exports.handler = async (event) => ({ statusCode: 200 });\n  `),\n});\n\nconst myToolSchema = agentcore.ToolSchema.fromInline([{\n  name: \"my_tool\",\n  description: \"My custom tool\",\n  inputSchema: {\n    type: agentcore.SchemaDefinitionType.OBJECT,\n    properties: {},\n  },\n}]);\n\n// Create a custom Lambda configuration\nconst customConfig = agentcore.LambdaTargetConfiguration.create(\n  myLambdaFunction,\n  myToolSchema\n);\n\n// Use the GatewayTarget constructor directly\nconst target = new agentcore.GatewayTarget(this, \"AdvancedTarget\", {\n  gateway: gateway,\n  gatewayTargetName: \"advanced-target\",\n  targetConfiguration: customConfig,  // Manually created configuration\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromIamRole()\n  ]\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\ndeclare const credentialProviderConfig: bedrock_agentcore_alpha.ICredentialProviderConfig;\ndeclare const gateway: bedrock_agentcore_alpha.Gateway;\ndeclare const targetConfiguration: bedrock_agentcore_alpha.ITargetConfiguration;\nconst gatewayTargetProps: bedrock_agentcore_alpha.GatewayTargetProps = {\n  gateway: gateway,\n  targetConfiguration: targetConfiguration,\n\n  // the properties below are optional\n  credentialProviderConfigurations: [credentialProviderConfig],\n  description: 'description',\n  gatewayTargetName: 'gatewayTargetName',\n};",
         "custom": {
-          "exampleMetadata": "infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayTargetProps",
@@ -23494,9 +23462,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for creating a Smithy-based Gateway Target.",
-        "example": "\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst smithySchema = agentcore.ApiSchema.fromLocalAsset(\n  path.join(__dirname, \"models\", \"smithy-model.json\")\n);\nsmithySchema.bind(this);\n\n// Create a gateway target with Smithy Model and OAuth\nconst target = agentcore.GatewayTarget.forSmithy(this, \"MySmithyTarget\", {\n  gatewayTargetName: \"my-smithy-target\",\n  description: \"Target for Smithy model integration\",\n  gateway: gateway,\n  smithyModel: smithySchema,\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\ndeclare const apiSchema: bedrock_agentcore_alpha.ApiSchema;\ndeclare const credentialProviderConfig: bedrock_agentcore_alpha.ICredentialProviderConfig;\ndeclare const gateway: bedrock_agentcore_alpha.Gateway;\nconst gatewayTargetSmithyProps: bedrock_agentcore_alpha.GatewayTargetSmithyProps = {\n  gateway: gateway,\n  smithyModel: apiSchema,\n\n  // the properties below are optional\n  credentialProviderConfigurations: [credentialProviderConfig],\n  description: 'description',\n  gatewayTargetName: 'gatewayTargetName',\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayTargetSmithyProps",
@@ -23574,9 +23542,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Props for {@link OAuth2CredentialProvider.usingGithub}.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst oauth = agentcore.OAuth2CredentialProvider.usingGithub(this, \"GhOAuth\", {\n  oAuth2CredentialProviderName: \"github-oauth\",\n  clientId: \"your-client-id\",\n  clientSecret: cdk.SecretValue.unsafePlainText(\"your-client-secret\"),\n});\n\ngateway.addMcpServerTarget(\"Mcp\", {\n  gatewayTargetName: \"mcp-server\",\n  description: \"MCP with GitHub OAuth\",\n  endpoint: \"https://my-mcp-server.example.com\",\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromOauthIdentity(oauth, {\n      scopes: [\"read:user\"],\n    }),\n  ],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\n\ndeclare const secretValue: cdk.SecretValue;\nconst githubOAuth2CredentialProviderProps: bedrock_agentcore_alpha.GithubOAuth2CredentialProviderProps = {\n  clientId: 'clientId',\n  clientSecret: secretValue,\n\n  // the properties below are optional\n  oAuth2CredentialProviderName: 'oAuth2CredentialProviderName',\n  tags: {\n    tagsKey: 'tags',\n  },\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.GithubOAuth2CredentialProviderProps",
@@ -29646,9 +29614,9 @@
         "remarks": "The schema can be provided directly as a string.\nValidation is performed at the target configuration level where the schema type is known.",
         "stability": "experimental",
         "summary": "Class to define an API Schema from an inline string.",
-        "example": "const inlineSchema = agentcore.ApiSchema.fromInline(`\nopenapi: 3.0.3\ninfo:\n  title: Library API\n  version: 1.0.0\npaths:\n  /search:\n    get:\n      summary: Search for books\n      operationId: searchBooks\n      parameters:\n        - name: query\n          in: query\n          required: true\n          schema:\n            type: string\n`);",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst inlineApiSchema = new bedrock_agentcore_alpha.InlineApiSchema('schema');",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.InlineApiSchema",
@@ -29726,9 +29694,9 @@
         "remarks": "The schema can be provided directly as a string in either JSON or YAML format.",
         "stability": "experimental",
         "summary": "Class to define a Tool Schema from an inline string.",
-        "example": "const toolSchema = agentcore.ToolSchema.fromInline([{\n      name: \"hello_world\",\n      description: \"A simple hello world tool\",\n      inputSchema: {\n        type: agentcore.SchemaDefinitionType.OBJECT,\n        properties: {\n          name: {\n            type: agentcore.SchemaDefinitionType.STRING,\n            description: \"The name to greet\",\n          },\n        },\n        required: [\"name\"],\n      },\n    }]);",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\ndeclare const schemaDefinition_: bedrock_agentcore_alpha.SchemaDefinition;\nconst inlineToolSchema = new bedrock_agentcore_alpha.InlineToolSchema([{\n  description: 'description',\n  inputSchema: {\n    type: bedrock_agentcore_alpha.SchemaDefinitionType.STRING,\n\n    // the properties below are optional\n    description: 'description',\n    items: schemaDefinition_,\n    properties: {\n      propertiesKey: schemaDefinition_,\n    },\n    required: ['required'],\n  },\n  name: 'name',\n\n  // the properties below are optional\n  outputSchema: {\n    type: bedrock_agentcore_alpha.SchemaDefinitionType.STRING,\n\n    // the properties below are optional\n    description: 'description',\n    items: schemaDefinition_,\n    properties: {\n      propertiesKey: schemaDefinition_,\n    },\n    required: ['required'],\n  },\n}]);",
         "custom": {
-          "exampleMetadata": "infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.InlineToolSchema",
@@ -29879,9 +29847,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Options for configuring an interceptor.",
-        "example": "// Create Lambda functions for interceptors\nconst requestInterceptorFn = new lambda.Function(this, \"RequestInterceptor\", {\n  runtime: lambda.Runtime.PYTHON_3_12,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\ndef handler(event, context):\n    # Validate and transform request\n    return {\n        \"interceptorOutputVersion\": \"1.0\",\n        \"mcp\": {\n            \"transformedGatewayRequest\": event[\"mcp\"][\"gatewayRequest\"]\n        }\n    }\n  `),\n});\n\nconst responseInterceptorFn = new lambda.Function(this, \"ResponseInterceptor\", {\n  runtime: lambda.Runtime.PYTHON_3_12,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\ndef handler(event, context):\n    # Filter or transform response\n    return {\n        \"interceptorOutputVersion\": \"1.0\",\n        \"mcp\": {\n            \"transformedGatewayResponse\": event[\"mcp\"][\"gatewayResponse\"]\n        }\n    }\n  `),\n});\n\n// Create gateway with interceptors\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  interceptorConfigurations: [\n    agentcore.LambdaInterceptor.forRequest(requestInterceptorFn, {\n      passRequestHeaders: true  // Only if you need to inspect headers\n    }),\n    agentcore.LambdaInterceptor.forResponse(responseInterceptorFn)\n  ]\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst interceptorOptions: bedrock_agentcore_alpha.InterceptorOptions = {\n  passRequestHeaders: false,\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.InterceptorOptions",
@@ -29920,9 +29888,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Invocation configuration for self managed memory strategy.",
-        "example": "\nconst bucket = new s3.Bucket(this, 'memoryBucket', {\n  bucketName: 'test-memory',\n  removalPolicy: cdk.RemovalPolicy.DESTROY,\n  autoDeleteObjects: true,\n});\n\nconst topic = new sns.Topic(this, 'topic');\n\n// Create a custom semantic memory strategy\nconst selfManagedStrategy = agentcore.MemoryStrategy.usingSelfManaged({\n  name: \"selfManagedStrategy\",\n  description: \"self managed memory strategy\",\n  historicalContextWindowSize: 5,\n  invocationConfiguration: {\n    topic: topic,\n    s3Location: {\n      bucketName: bucket.bucketName,\n      objectKey: 'memory/',\n    }\n  },\n  triggerConditions: {\n    messageBasedTrigger: 1,\n    timeBasedTrigger: cdk.Duration.seconds(10),\n    tokenBasedTrigger: 100\n  }\n});\n\n// Create memory with custom strategy\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my-custom-memory\",\n  description: \"Memory with custom strategy\",\n  expirationDuration: cdk.Duration.days(90),\n  memoryStrategies: [selfManagedStrategy],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_sns as sns } from 'aws-cdk-lib';\n\ndeclare const topic: sns.Topic;\nconst invocationConfiguration: bedrock_agentcore_alpha.InvocationConfiguration = {\n  s3Location: {\n    bucketName: 'bucketName',\n    objectKey: 'objectKey',\n\n    // the properties below are optional\n    objectVersion: 'objectVersion',\n  },\n  topic: topic,\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.InvocationConfiguration",
@@ -29975,9 +29943,9 @@
         "see": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-interceptors.html",
         "stability": "experimental",
         "summary": "A Lambda-based interceptor for Gateway.",
-        "example": "// Create Lambda functions for interceptors\nconst requestInterceptorFn = new lambda.Function(this, \"RequestInterceptor\", {\n  runtime: lambda.Runtime.PYTHON_3_12,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\ndef handler(event, context):\n    # Validate and transform request\n    return {\n        \"interceptorOutputVersion\": \"1.0\",\n        \"mcp\": {\n            \"transformedGatewayRequest\": event[\"mcp\"][\"gatewayRequest\"]\n        }\n    }\n  `),\n});\n\nconst responseInterceptorFn = new lambda.Function(this, \"ResponseInterceptor\", {\n  runtime: lambda.Runtime.PYTHON_3_12,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\ndef handler(event, context):\n    # Filter or transform response\n    return {\n        \"interceptorOutputVersion\": \"1.0\",\n        \"mcp\": {\n            \"transformedGatewayResponse\": event[\"mcp\"][\"gatewayResponse\"]\n        }\n    }\n  `),\n});\n\n// Create gateway with interceptors\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n  interceptorConfigurations: [\n    agentcore.LambdaInterceptor.forRequest(requestInterceptorFn, {\n      passRequestHeaders: true  // Only if you need to inspect headers\n    }),\n    agentcore.LambdaInterceptor.forResponse(responseInterceptorFn)\n  ]\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_lambda as lambda } from 'aws-cdk-lib';\n\ndeclare const function_: lambda.Function;\nconst lambdaInterceptor = bedrock_agentcore_alpha.LambdaInterceptor.forRequest(function_, /* all optional props */ {\n  passRequestHeaders: false,\n});",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.LambdaInterceptor",
@@ -30138,9 +30106,9 @@
         "remarks": "This configuration wraps a Lambda function as MCP tools,\nallowing the gateway to invoke the function to provide tool capabilities.",
         "stability": "experimental",
         "summary": "Configuration for Lambda-based MCP targets.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst myLambdaFunction = new lambda.Function(this, \"MyFunction\", {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\n    exports.handler = async (event) => ({ statusCode: 200 });\n  `),\n});\n\nconst myToolSchema = agentcore.ToolSchema.fromInline([{\n  name: \"my_tool\",\n  description: \"My custom tool\",\n  inputSchema: {\n    type: agentcore.SchemaDefinitionType.OBJECT,\n    properties: {},\n  },\n}]);\n\n// Create a custom Lambda configuration\nconst customConfig = agentcore.LambdaTargetConfiguration.create(\n  myLambdaFunction,\n  myToolSchema\n);\n\n// Use the GatewayTarget constructor directly\nconst target = new agentcore.GatewayTarget(this, \"AdvancedTarget\", {\n  gateway: gateway,\n  gatewayTargetName: \"advanced-target\",\n  targetConfiguration: customConfig,  // Manually created configuration\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromIamRole()\n  ]\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_lambda as lambda } from 'aws-cdk-lib';\n\ndeclare const function_: lambda.Function;\ndeclare const toolSchema: bedrock_agentcore_alpha.ToolSchema;\nconst lambdaTargetConfiguration = new bedrock_agentcore_alpha.LambdaTargetConfiguration(function_, toolSchema);",
         "custom": {
-          "exampleMetadata": "infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.LambdaTargetConfiguration",
@@ -30325,9 +30293,9 @@
         "remarks": "This configuration helps optimize resource utilization by automatically cleaning up idle sessions and preventing\nlong-running instances from consuming resources indefinitely.",
         "stability": "experimental",
         "summary": "LifecycleConfiguration lets you manage the lifecycle of runtime sessions and resources in AgentCore Runtime.",
-        "example": "const repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\n\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\nnew agentcore.Runtime(this, 'test-runtime', {\n  runtimeName: 'test_runtime',\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  lifecycleConfiguration: {\n    idleRuntimeSessionTimeout: Duration.minutes(10),\n    maxLifetime: Duration.hours(4),\n  },\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\nconst lifecycleConfiguration: bedrock_agentcore_alpha.LifecycleConfiguration = {\n  idleRuntimeSessionTimeout: cdk.Duration.minutes(30),\n  maxLifetime: cdk.Duration.minutes(30),\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.LifecycleConfiguration",
@@ -30524,9 +30492,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Log types for AgentCore Runtime observability.",
-        "example": "const repository = new ecr.Repository(this, 'TestRepository', {\n  repositoryName: 'test-agent-runtime',\n});\n\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, 'v1.0.0');\n\n// Create logging destinations\nconst logGroup = new logs.LogGroup(this, 'RuntimeLogGroup');\nconst logBucket = new s3.Bucket(this, 'RuntimeLogBucket');\nconst firehoseStream = new firehose.DeliveryStream(this, 'RuntimeLogStream', {\n  destination: new firehose.S3Bucket(logBucket),\n});\n\nnew agentcore.Runtime(this, 'test-runtime', {\n  runtimeName: 'test_runtime',\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  tracingEnabled: true,\n  loggingConfigs: [\n    {\n      logType: agentcore.LogType.APPLICATION_LOGS,\n      destination: agentcore.LoggingDestination.cloudWatchLogs(logGroup),\n    },\n    {\n      logType: agentcore.LogType.APPLICATION_LOGS,\n      destination: agentcore.LoggingDestination.s3(logBucket),\n    },\n    {\n      logType: agentcore.LogType.APPLICATION_LOGS,\n      destination: agentcore.LoggingDestination.firehose(firehoseStream),\n    },\n  ],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst logType = bedrock_agentcore_alpha.LogType.of('value');",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.LogType",
@@ -30680,9 +30648,9 @@
         "remarks": "Use the static factory methods to create instances:\n- `LoggingDestination.cloudWatchLogs(logGroup)` - Send logs to CloudWatch Logs\n- `LoggingDestination.s3(bucket)` - Send logs to S3\n- `LoggingDestination.firehose(stream)` - Send logs to Kinesis Data Firehose",
         "stability": "experimental",
         "summary": "Represents a logging destination for AgentCore Runtime.",
-        "example": "const repository = new ecr.Repository(this, 'TestRepository', {\n  repositoryName: 'test-agent-runtime',\n});\n\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, 'v1.0.0');\n\n// Create logging destinations\nconst logGroup = new logs.LogGroup(this, 'RuntimeLogGroup');\nconst logBucket = new s3.Bucket(this, 'RuntimeLogBucket');\nconst firehoseStream = new firehose.DeliveryStream(this, 'RuntimeLogStream', {\n  destination: new firehose.S3Bucket(logBucket),\n});\n\nnew agentcore.Runtime(this, 'test-runtime', {\n  runtimeName: 'test_runtime',\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  tracingEnabled: true,\n  loggingConfigs: [\n    {\n      logType: agentcore.LogType.APPLICATION_LOGS,\n      destination: agentcore.LoggingDestination.cloudWatchLogs(logGroup),\n    },\n    {\n      logType: agentcore.LogType.APPLICATION_LOGS,\n      destination: agentcore.LoggingDestination.s3(logBucket),\n    },\n    {\n      logType: agentcore.LogType.APPLICATION_LOGS,\n      destination: agentcore.LoggingDestination.firehose(firehoseStream),\n    },\n  ],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_logs as logs } from 'aws-cdk-lib';\n\ndeclare const logGroup: logs.LogGroup;\nconst loggingDestination = bedrock_agentcore_alpha.LoggingDestination.cloudWatchLogs(logGroup);",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.LoggingDestination",
@@ -30790,11 +30758,7 @@
       "docs": {
         "remarks": "The Model Context Protocol uses string-based version identifiers following the format YYYY-MM-DD,\nto indicate the last date backwards incompatible changes were made.\nVersions are available at https://github.com/modelcontextprotocol/modelcontextprotocol/releases",
         "stability": "experimental",
-        "summary": "MCP protocol versions.",
-        "example": "// Create a KMS key for encryption\nconst encryptionKey = new kms.Key(this, \"GatewayEncryptionKey\", {\n  enableKeyRotation: true,\n  description: \"KMS key for gateway encryption\",\n});\n\n// Create gateway with KMS encryption\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-encrypted-gateway\",\n  description: \"Gateway with KMS encryption\",\n  protocolConfiguration: new agentcore.McpProtocolConfiguration({\n    instructions: \"Use this gateway to connect to external MCP tools\",\n    searchType: agentcore.McpGatewaySearchType.SEMANTIC,\n    supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],\n  }),\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({\n    discoveryUrl: \"https://auth.example.com/.well-known/openid-configuration\",\n    allowedAudience: [\"my-app\"],\n    allowedClients: [\"my-client-id\"],\n    allowedScopes: [\"read\", \"write\"],\n  }),\n  kmsKey: encryptionKey,\n  exceptionLevel: agentcore.GatewayExceptionLevel.DEBUG,\n});",
-        "custom": {
-          "exampleMetadata": "fixture=default infused"
-        }
+        "summary": "MCP protocol versions."
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.MCPProtocolVersion",
       "kind": "enum",
@@ -30827,9 +30791,9 @@
         "remarks": "This strategy can be used for quick setup with built-in defaults or customized\nwith specific models and prompt templates.",
         "stability": "experimental",
         "summary": "Managed memory strategy that handles both built-in and override configurations.",
-        "example": "// Create a custom semantic memory strategy\nconst customSemanticStrategy = agentcore.MemoryStrategy.usingSemantic({\n  name: \"customSemanticStrategy\",\n  description: \"Custom semantic memory strategy\",\n  namespaces: [\"/custom/strategies/{memoryStrategyId}/actors/{actorId}\"],\n  customConsolidation: {\n    model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V1_0,\n    appendToPrompt: \"Custom consolidation prompt for semantic memory\",\n  },\n  customExtraction: {\n    model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V1_0,\n    appendToPrompt: \"Custom extraction prompt for semantic memory\",\n  },\n});\n\n// Create memory with custom strategy\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my-custom-memory\",\n  description: \"Memory with custom strategy\",\n  expirationDuration: cdk.Duration.days(90),\n  memoryStrategies: [customSemanticStrategy],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as bedrock_alpha from '@aws-cdk/aws-bedrock-alpha';\n\ndeclare const bedrockInvokable: bedrock_alpha.IBedrockInvokable;\nconst managedMemoryStrategy = new bedrock_agentcore_alpha.ManagedMemoryStrategy(bedrock_agentcore_alpha.MemoryStrategyType.SUMMARIZATION, {\n  name: 'name',\n  namespaces: ['namespaces'],\n\n  // the properties below are optional\n  customConsolidation: {\n    appendToPrompt: 'appendToPrompt',\n    model: bedrockInvokable,\n  },\n  customExtraction: {\n    appendToPrompt: 'appendToPrompt',\n    model: bedrockInvokable,\n  },\n  description: 'description',\n  reflectionConfiguration: {\n    namespaces: ['namespaces'],\n  },\n});",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.ManagedMemoryStrategy",
@@ -31050,9 +31014,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Configuration parameters for a memory strategy that can override existing built-in default prompts/models.",
-        "example": "// Create memory with custom strategies\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my_memory\",\n  description: \"Memory with custom strategies\",\n  expirationDuration: cdk.Duration.days(90),\n  memoryStrategies: [\n    agentcore.MemoryStrategy.usingUserPreference({\n        name: \"CustomerPreferences\",\n        namespaces: [\"support/customer/{actorId}/preferences\"]\n    }),\n    agentcore.MemoryStrategy.usingSemantic({\n        name: \"CustomerSupportSemantic\",\n        namespaces: [\"support/customer/{actorId}/semantic\"]\n    }),\n     agentcore.MemoryStrategy.usingEpisodic({\n        name: \"customerJourneyEpisodic\",\n        namespaces: [\"/journey/customer/{actorId}/episodes\"],\n        reflectionConfiguration: {\n            namespaces: [\"/journey/customer/{actorId}/reflections\"]\n        }\n    }),\n  ],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as bedrock_alpha from '@aws-cdk/aws-bedrock-alpha';\n\ndeclare const bedrockInvokable: bedrock_alpha.IBedrockInvokable;\nconst managedStrategyProps: bedrock_agentcore_alpha.ManagedStrategyProps = {\n  name: 'name',\n  namespaces: ['namespaces'],\n\n  // the properties below are optional\n  customConsolidation: {\n    appendToPrompt: 'appendToPrompt',\n    model: bedrockInvokable,\n  },\n  customExtraction: {\n    appendToPrompt: 'appendToPrompt',\n    model: bedrockInvokable,\n  },\n  description: 'description',\n  reflectionConfiguration: {\n    namespaces: ['namespaces'],\n  },\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.ManagedStrategyProps",
@@ -31154,9 +31118,9 @@
         "remarks": "This protocol enables communication between Amazon Bedrock Agent and external tools.",
         "stability": "experimental",
         "summary": "MCP protocol configuration The configuration for the Model Context Protocol (MCP).",
-        "example": "// Create a KMS key for encryption\nconst encryptionKey = new kms.Key(this, \"GatewayEncryptionKey\", {\n  enableKeyRotation: true,\n  description: \"KMS key for gateway encryption\",\n});\n\n// Create gateway with KMS encryption\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-encrypted-gateway\",\n  description: \"Gateway with KMS encryption\",\n  protocolConfiguration: new agentcore.McpProtocolConfiguration({\n    instructions: \"Use this gateway to connect to external MCP tools\",\n    searchType: agentcore.McpGatewaySearchType.SEMANTIC,\n    supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],\n  }),\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({\n    discoveryUrl: \"https://auth.example.com/.well-known/openid-configuration\",\n    allowedAudience: [\"my-app\"],\n    allowedClients: [\"my-client-id\"],\n    allowedScopes: [\"read\", \"write\"],\n  }),\n  kmsKey: encryptionKey,\n  exceptionLevel: agentcore.GatewayExceptionLevel.DEBUG,\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst mcpConfiguration: bedrock_agentcore_alpha.McpConfiguration = {\n  instructions: 'instructions',\n  searchType: bedrock_agentcore_alpha.McpGatewaySearchType.SEMANTIC,\n  supportedVersions: [bedrock_agentcore_alpha.MCPProtocolVersion.MCP_2025_06_18],\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.McpConfiguration",
@@ -31236,11 +31200,7 @@
       "assembly": "@aws-cdk/aws-bedrock-agentcore-alpha",
       "docs": {
         "stability": "experimental",
-        "summary": "Search types supported by MCP gateway.",
-        "example": "// Create a KMS key for encryption\nconst encryptionKey = new kms.Key(this, \"GatewayEncryptionKey\", {\n  enableKeyRotation: true,\n  description: \"KMS key for gateway encryption\",\n});\n\n// Create gateway with KMS encryption\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-encrypted-gateway\",\n  description: \"Gateway with KMS encryption\",\n  protocolConfiguration: new agentcore.McpProtocolConfiguration({\n    instructions: \"Use this gateway to connect to external MCP tools\",\n    searchType: agentcore.McpGatewaySearchType.SEMANTIC,\n    supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],\n  }),\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({\n    discoveryUrl: \"https://auth.example.com/.well-known/openid-configuration\",\n    allowedAudience: [\"my-app\"],\n    allowedClients: [\"my-client-id\"],\n    allowedScopes: [\"read\", \"write\"],\n  }),\n  kmsKey: encryptionKey,\n  exceptionLevel: agentcore.GatewayExceptionLevel.DEBUG,\n});",
-        "custom": {
-          "exampleMetadata": "fixture=default infused"
-        }
+        "summary": "Search types supported by MCP gateway."
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.McpGatewaySearchType",
       "kind": "enum",
@@ -31266,9 +31226,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "MCP (Model Context Protocol) configuration implementation.",
-        "example": "// Create a KMS key for encryption\nconst encryptionKey = new kms.Key(this, \"GatewayEncryptionKey\", {\n  enableKeyRotation: true,\n  description: \"KMS key for gateway encryption\",\n});\n\n// Create gateway with KMS encryption\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-encrypted-gateway\",\n  description: \"Gateway with KMS encryption\",\n  protocolConfiguration: new agentcore.McpProtocolConfiguration({\n    instructions: \"Use this gateway to connect to external MCP tools\",\n    searchType: agentcore.McpGatewaySearchType.SEMANTIC,\n    supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],\n  }),\n  authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({\n    discoveryUrl: \"https://auth.example.com/.well-known/openid-configuration\",\n    allowedAudience: [\"my-app\"],\n    allowedClients: [\"my-client-id\"],\n    allowedScopes: [\"read\", \"write\"],\n  }),\n  kmsKey: encryptionKey,\n  exceptionLevel: agentcore.GatewayExceptionLevel.DEBUG,\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst mcpProtocolConfiguration = new bedrock_agentcore_alpha.McpProtocolConfiguration(/* all optional props */ {\n  instructions: 'instructions',\n  searchType: bedrock_agentcore_alpha.McpGatewaySearchType.SEMANTIC,\n  supportedVersions: [bedrock_agentcore_alpha.MCPProtocolVersion.MCP_2025_06_18],\n});",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.McpProtocolConfiguration",
@@ -31682,13 +31642,13 @@
       "docs": {
         "custom": {
           "resource": "AWS::BedrockAgentCore::Memory",
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         },
         "remarks": "Enables knowledge retention across sessions by storing user preferences (e.g. coding style),\nsemantic facts (e.g. learned info) and interaction summaries for context optimization.",
         "see": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/memory.html",
         "stability": "experimental",
         "summary": "Long-term memory store for extracted insights like user preferences, semantic facts and summaries.",
-        "example": "// Create a custom execution role\nconst executionRole = new iam.Role(this, \"MemoryExecutionRole\", {\n  assumedBy: new iam.ServicePrincipal(\"bedrock-agentcore.amazonaws.com\"),\n  managedPolicies: [\n    iam.ManagedPolicy.fromAwsManagedPolicyName(\n      \"AmazonBedrockAgentCoreMemoryBedrockModelInferenceExecutionRolePolicy\"\n    ),\n  ],\n});\n\n// Create memory with custom execution role\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my_memory\",\n  description: \"Memory with custom execution role\",\n  expirationDuration: cdk.Duration.days(90),\n  executionRole: executionRole,\n});"
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\nimport { aws_iam as iam } from 'aws-cdk-lib';\nimport { aws_kms as kms } from 'aws-cdk-lib';\n\ndeclare const key: kms.Key;\ndeclare const memoryStrategy: bedrock_agentcore_alpha.IMemoryStrategy;\ndeclare const role: iam.Role;\nconst memory = new bedrock_agentcore_alpha.Memory(this, 'MyMemory', /* all optional props */ {\n  description: 'description',\n  executionRole: role,\n  expirationDuration: cdk.Duration.minutes(30),\n  kmsKey: key,\n  memoryName: 'memoryName',\n  memoryStrategies: [memoryStrategy],\n  tags: {\n    tagsKey: 'tags',\n  },\n});"
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.Memory",
       "initializer": {
@@ -32970,9 +32930,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for creating a Memory resource.",
-        "example": "// Create a custom execution role\nconst executionRole = new iam.Role(this, \"MemoryExecutionRole\", {\n  assumedBy: new iam.ServicePrincipal(\"bedrock-agentcore.amazonaws.com\"),\n  managedPolicies: [\n    iam.ManagedPolicy.fromAwsManagedPolicyName(\n      \"AmazonBedrockAgentCoreMemoryBedrockModelInferenceExecutionRolePolicy\"\n    ),\n  ],\n});\n\n// Create memory with custom execution role\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my_memory\",\n  description: \"Memory with custom execution role\",\n  expirationDuration: cdk.Duration.days(90),\n  executionRole: executionRole,\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\nimport { aws_iam as iam } from 'aws-cdk-lib';\nimport { aws_kms as kms } from 'aws-cdk-lib';\n\ndeclare const key: kms.Key;\ndeclare const memoryStrategy: bedrock_agentcore_alpha.IMemoryStrategy;\ndeclare const role: iam.Role;\nconst memoryProps: bedrock_agentcore_alpha.MemoryProps = {\n  description: 'description',\n  executionRole: role,\n  expirationDuration: cdk.Duration.minutes(30),\n  kmsKey: key,\n  memoryName: 'memoryName',\n  memoryStrategies: [memoryStrategy],\n  tags: {\n    tagsKey: 'tags',\n  },\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.MemoryProps",
@@ -33130,9 +33090,9 @@
         "see": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/memory-strategies.html",
         "stability": "experimental",
         "summary": "Factory class for creating memory strategies If you need long-term memory for context recall across sessions, you can setup memory extraction strategies to extract the relevant memory from the raw events.",
-        "example": "// Create a custom semantic memory strategy\nconst customSemanticStrategy = agentcore.MemoryStrategy.usingSemantic({\n  name: \"customSemanticStrategy\",\n  description: \"Custom semantic memory strategy\",\n  namespaces: [\"/custom/strategies/{memoryStrategyId}/actors/{actorId}\"],\n  customConsolidation: {\n    model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V1_0,\n    appendToPrompt: \"Custom consolidation prompt for semantic memory\",\n  },\n  customExtraction: {\n    model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V1_0,\n    appendToPrompt: \"Custom extraction prompt for semantic memory\",\n  },\n});\n\n// Create memory with custom strategy\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my-custom-memory\",\n  description: \"Memory with custom strategy\",\n  expirationDuration: cdk.Duration.days(90),\n  memoryStrategies: [customSemanticStrategy],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst memoryStrategy = new bedrock_agentcore_alpha.MemoryStrategy();",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.MemoryStrategy",
@@ -33491,9 +33451,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Configuration for passing metadata (headers and query parameters) to the API Gateway target.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst api = new apigateway.RestApi(this, 'MyApi', {\n  restApiName: 'my-api',\n});\n\n// Create a gateway target using the static factory method\nconst apiGatewayTarget = agentcore.GatewayTarget.forApiGateway(this, \"MyApiGatewayTarget\", {\n  gatewayTargetName: \"my-api-gateway-target\",\n  description: \"Target for API Gateway REST API integration\",\n  gateway: gateway,\n  restApi: api,\n  apiGatewayToolConfiguration: {\n    toolFilters: [\n      {\n        filterPath: \"/pets/*\",\n        methods: [agentcore.ApiGatewayHttpMethod.GET, agentcore.ApiGatewayHttpMethod.POST],\n      },\n    ],\n  },\n  metadataConfiguration: {\n    allowedRequestHeaders: [\"X-User-Id\"],\n    allowedQueryParameters: [\"limit\"],\n  },\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst metadataConfiguration: bedrock_agentcore_alpha.MetadataConfiguration = {\n  allowedQueryParameters: ['allowedQueryParameters'],\n  allowedRequestHeaders: ['allowedRequestHeaders'],\n  allowedResponseHeaders: ['allowedResponseHeaders'],\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.MetadataConfiguration",
@@ -33890,9 +33850,9 @@
         "see": "https://www.rfc-editor.org/rfc/rfc8414",
         "stability": "experimental",
         "summary": "Static OAuth2 authorization server metadata for custom credential providers.",
-        "example": "agentcore.OAuth2CredentialProvider.usingCustom(this, \"CustomOAuthMeta\", {\n  clientId: \"your-client-id\",\n  clientSecret: cdk.SecretValue.unsafePlainText(\"your-client-secret\"),\n  authorizationServerMetadata: {\n    issuer: \"https://idp.example.com\",\n    authorizationEndpoint: \"https://idp.example.com/oauth2/authorize\",\n    tokenEndpoint: \"https://idp.example.com/oauth2/token\",\n  },\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst oAuth2AuthorizationServerMetadata: bedrock_agentcore_alpha.OAuth2AuthorizationServerMetadata = {\n  authorizationEndpoint: 'authorizationEndpoint',\n  issuer: 'issuer',\n  tokenEndpoint: 'tokenEndpoint',\n\n  // the properties below are optional\n  responseTypes: ['responseTypes'],\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.OAuth2AuthorizationServerMetadata",
@@ -34038,13 +33998,13 @@
       "docs": {
         "custom": {
           "resource": "AWS::BedrockAgentCore::OAuth2CredentialProvider",
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         },
         "remarks": "Prefer the static factories (for example {@link OAuth2CredentialProvider.usingSlack}) so you only pass\nthe OAuth2 settings that apply to that vendor. To attach the identity to a gateway target, use\n{@link GatewayCredentialProvider.fromOauthIdentity } with this construct, or\n{@link OAuth2CredentialProvider.bindForGatewayOAuthTarget} with {@link GatewayCredentialProvider.fromOauthIdentityArn }.",
         "see": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-oauth2credentialprovider.html",
         "stability": "experimental",
         "summary": "L2 construct for `AWS::BedrockAgentCore::OAuth2CredentialProvider`.",
-        "example": "agentcore.OAuth2CredentialProvider.usingCustom(this, \"CustomOAuthMeta\", {\n  clientId: \"your-client-id\",\n  clientSecret: cdk.SecretValue.unsafePlainText(\"your-client-secret\"),\n  authorizationServerMetadata: {\n    issuer: \"https://idp.example.com\",\n    authorizationEndpoint: \"https://idp.example.com/oauth2/authorize\",\n    tokenEndpoint: \"https://idp.example.com/oauth2/token\",\n  },\n});"
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst oAuth2CredentialProvider = new bedrock_agentcore_alpha.OAuth2CredentialProvider(this, 'MyOAuth2CredentialProvider', {\n  credentialProviderVendor: 'credentialProviderVendor',\n  oauth2ProviderConfigInput: {\n    atlassianOauth2ProviderConfig: {\n      clientId: 'clientId',\n      clientSecret: 'clientSecret',\n    },\n    customOauth2ProviderConfig: {\n      oauthDiscovery: {\n        authorizationServerMetadata: {\n          authorizationEndpoint: 'authorizationEndpoint',\n          issuer: 'issuer',\n          tokenEndpoint: 'tokenEndpoint',\n\n          // the properties below are optional\n          responseTypes: ['responseTypes'],\n        },\n        discoveryUrl: 'discoveryUrl',\n      },\n\n      // the properties below are optional\n      clientId: 'clientId',\n      clientSecret: 'clientSecret',\n      onBehalfOfTokenExchangeConfig: {\n        grantType: 'grantType',\n\n        // the properties below are optional\n        tokenExchangeGrantTypeConfig: {\n          actorTokenContent: 'actorTokenContent',\n\n          // the properties below are optional\n          actorTokenScopes: ['actorTokenScopes'],\n        },\n      },\n    },\n    githubOauth2ProviderConfig: {\n      clientId: 'clientId',\n      clientSecret: 'clientSecret',\n    },\n    googleOauth2ProviderConfig: {\n      clientId: 'clientId',\n      clientSecret: 'clientSecret',\n    },\n    includedOauth2ProviderConfig: {\n      clientId: 'clientId',\n      clientSecret: 'clientSecret',\n\n      // the properties below are optional\n      authorizationEndpoint: 'authorizationEndpoint',\n      issuer: 'issuer',\n      tokenEndpoint: 'tokenEndpoint',\n    },\n    linkedinOauth2ProviderConfig: {\n      clientId: 'clientId',\n      clientSecret: 'clientSecret',\n    },\n    microsoftOauth2ProviderConfig: {\n      clientId: 'clientId',\n      clientSecret: 'clientSecret',\n\n      // the properties below are optional\n      tenantId: 'tenantId',\n    },\n    salesforceOauth2ProviderConfig: {\n      clientId: 'clientId',\n      clientSecret: 'clientSecret',\n    },\n    slackOauth2ProviderConfig: {\n      clientId: 'clientId',\n      clientSecret: 'clientSecret',\n    },\n  },\n\n  // the properties below are optional\n  oAuth2CredentialProviderName: 'oAuth2CredentialProviderName',\n  tags: {\n    tagsKey: 'tags',\n  },\n});"
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.OAuth2CredentialProvider",
       "initializer": {
@@ -36054,9 +36014,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "OAuth configuration.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// OAuth2 (recommended): use OAuth2CredentialProvider + bindForGatewayOAuthTarget, or ARNs from console/API\nconst oauthProviderArn = \"arn:aws:bedrock-agentcore:us-east-1:123456789012:token-vault/abc123/oauth2credentialprovider/my-oauth\";\nconst oauthSecretArn = \"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-oauth-secret-abc123\";\n\n// Add an MCP server target directly to the gateway\nconst mcpTarget = gateway.addMcpServerTarget(\"MyMcpServer\", {\n  gatewayTargetName: \"my-mcp-server\",\n  description: \"External MCP server integration\",\n  endpoint: \"https://my-mcp-server.example.com\",\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromOauthIdentityArn({\n      providerArn: oauthProviderArn,\n      secretArn: oauthSecretArn,\n      scopes:['mcp-runtime-server/invoke']\n    }),\n  ],\n});\n\n// Grant sync permission to a Lambda function that will trigger synchronization\nconst syncFunction = new lambda.Function(this, \"SyncFunction\", {\n  runtime: lambda.Runtime.PYTHON_3_12,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\nimport boto3\n\ndef handler(event, context):\n    client = boto3.client('bedrock-agentcore')\n    response = client.synchronize_gateway_targets(\n        gatewayIdentifier=event['gatewayId'],\n        targetIds=[event['targetId']]\n    )\n    return response\n  `),\n});\n\nmcpTarget.grantSync(syncFunction);",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst oAuthConfiguration: bedrock_agentcore_alpha.OAuthConfiguration = {\n  providerArn: 'providerArn',\n  scopes: ['scopes'],\n  secretArn: 'secretArn',\n\n  // the properties below are optional\n  customParameters: {\n    customParametersKey: 'customParameters',\n  },\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.OAuthConfiguration",
@@ -37061,9 +37021,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for creating an OnlineEvaluationConfig.",
-        "example": "declare const customEvaluator: agentcore.Evaluator;\n\nconst evaluation = new agentcore.OnlineEvaluationConfig(this, 'MixedEvaluation', {\n  onlineEvaluationConfigName: 'mixed_evaluation',\n  evaluators: [\n    // Built-in evaluators\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.CORRECTNESS),\n    // Custom evaluator\n    agentcore.EvaluatorReference.custom(customEvaluator),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: ['/aws/bedrock-agentcore/my-agent'],\n    serviceNames: ['my-agent.default'],\n  }),\n});",
+        "example": "// Create a custom LLM-as-a-Judge evaluator\nconst evaluator = new agentcore.Evaluator(this, 'MyEvaluator', {\n  evaluatorName: 'my_custom_evaluator',\n  level: agentcore.EvaluationLevel.SESSION,\n  evaluatorConfig: agentcore.EvaluatorConfig.llmAsAJudge({\n    instructions: 'Evaluate whether the agent response is helpful and accurate.',\n    modelId: 'us.anthropic.claude-sonnet-4-6',\n    ratingScale: agentcore.EvaluatorRatingScale.categorical([\n      { label: 'Good', definition: 'The response is helpful and accurate.' },\n      { label: 'Bad', definition: 'The response is not helpful or contains errors.' },\n    ]),\n  }),\n});\n\n// Use the custom evaluator in an online evaluation configuration\nnew agentcore.OnlineEvaluationConfig(this, 'MyEvaluation', {\n  onlineEvaluationConfigName: 'my_evaluation',\n  evaluators: [\n    agentcore.EvaluatorReference.builtin(agentcore.BuiltinEvaluator.HELPFULNESS),\n    agentcore.EvaluatorReference.custom(evaluator),\n  ],\n  dataSource: agentcore.DataSourceConfig.fromCloudWatchLogs({\n    logGroupNames: ['/aws/bedrock-agentcore/my-agent'],\n    serviceNames: ['my-agent.default'],\n  }),\n});",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "infused"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.OnlineEvaluationConfigProps",
@@ -37326,9 +37286,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Configuration for overriding model and prompt template.",
-        "example": "// Create a custom semantic memory strategy\nconst customSemanticStrategy = agentcore.MemoryStrategy.usingSemantic({\n  name: \"customSemanticStrategy\",\n  description: \"Custom semantic memory strategy\",\n  namespaces: [\"/custom/strategies/{memoryStrategyId}/actors/{actorId}\"],\n  customConsolidation: {\n    model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V1_0,\n    appendToPrompt: \"Custom consolidation prompt for semantic memory\",\n  },\n  customExtraction: {\n    model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V1_0,\n    appendToPrompt: \"Custom extraction prompt for semantic memory\",\n  },\n});\n\n// Create memory with custom strategy\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my-custom-memory\",\n  description: \"Memory with custom strategy\",\n  expirationDuration: cdk.Duration.days(90),\n  memoryStrategies: [customSemanticStrategy],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as bedrock_alpha from '@aws-cdk/aws-bedrock-alpha';\n\ndeclare const bedrockInvokable: bedrock_alpha.IBedrockInvokable;\nconst overrideConfig: bedrock_agentcore_alpha.OverrideConfig = {\n  appendToPrompt: 'appendToPrompt',\n  model: bedrockInvokable,\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.OverrideConfig",
@@ -39783,9 +39743,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Recording configuration for browser.",
-        "example": "// Create an S3 bucket for recordings\nconst recordingBucket = new s3.Bucket(this, \"RecordingBucket\", {\n  bucketName: \"my-browser-recordings\",\n  removalPolicy: RemovalPolicy.DESTROY, // For demo purposes\n});\n\n// Create browser with recording enabled\nconst browser = new agentcore.BrowserCustom(this, \"MyBrowser\", {\n  browserCustomName: \"my_browser\",\n  description: \"Browser with recording enabled\",\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingPublicNetwork(),\n  recordingConfig: {\n    enabled: true,\n    s3Location: {\n      bucketName: recordingBucket.bucketName,\n      objectKey: \"browser-recordings/\",\n    },\n  },\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst recordingConfig: bedrock_agentcore_alpha.RecordingConfig = {\n  enabled: false,\n  s3Location: {\n    bucketName: 'bucketName',\n    objectKey: 'objectKey',\n\n    // the properties below are optional\n    objectVersion: 'objectVersion',\n  },\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.RecordingConfig",
@@ -39865,9 +39825,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Configuration for HTTP request headers that will be passed through to the runtime.",
-        "example": "const repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\n\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\nnew agentcore.Runtime(this, 'test-runtime', {\n  runtimeName: 'test_runtime',\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  requestHeaderConfiguration: {\n    allowlistedHeaders: ['X-Amzn-Bedrock-AgentCore-Runtime-Custom-H1'],\n  },\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst requestHeaderConfiguration: bedrock_agentcore_alpha.RequestHeaderConfiguration = {\n  allowlistedHeaders: ['allowlistedHeaders'],\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.RequestHeaderConfiguration",
@@ -39910,12 +39870,12 @@
       "docs": {
         "custom": {
           "resource": "AWS::BedrockAgentCore::Runtime",
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         },
         "see": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime.html",
         "stability": "experimental",
         "summary": "Bedrock Agent Core Runtime Enables running containerized agents with specific network configurations, security settings, and runtime artifacts.",
-        "example": "// S3 bucket containing the agent core\nconst codeBucket = new s3.Bucket(this, \"AgentCode\", {\n  bucketName: \"my-code-bucket\",\n  removalPolicy: RemovalPolicy.DESTROY, // For demo purposes\n});\n\n// the bucket above needs to contain the agent code\n\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromS3(\n  {\n    bucketName: codeBucket.bucketName,\n    objectKey: 'deployment_package.zip',\n  },\n  agentcore.AgentCoreRuntime.PYTHON_3_12,\n  ['opentelemetry-instrument', 'main.py']\n);\n\nconst runtimeInstance = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n});"
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\nimport { aws_iam as iam } from 'aws-cdk-lib';\n\ndeclare const agentRuntimeArtifact: bedrock_agentcore_alpha.AgentRuntimeArtifact;\ndeclare const loggingDestination: bedrock_agentcore_alpha.LoggingDestination;\ndeclare const logType: bedrock_agentcore_alpha.LogType;\ndeclare const role: iam.Role;\ndeclare const runtimeAuthorizerConfiguration: bedrock_agentcore_alpha.RuntimeAuthorizerConfiguration;\ndeclare const runtimeNetworkConfiguration: bedrock_agentcore_alpha.RuntimeNetworkConfiguration;\nconst runtime = new bedrock_agentcore_alpha.Runtime(this, 'MyRuntime', {\n  agentRuntimeArtifact: agentRuntimeArtifact,\n\n  // the properties below are optional\n  authorizerConfiguration: runtimeAuthorizerConfiguration,\n  description: 'description',\n  environmentVariables: {\n    environmentVariablesKey: 'environmentVariables',\n  },\n  executionRole: role,\n  lifecycleConfiguration: {\n    idleRuntimeSessionTimeout: cdk.Duration.minutes(30),\n    maxLifetime: cdk.Duration.minutes(30),\n  },\n  loggingConfigs: [{\n    destination: loggingDestination,\n    logType: logType,\n  }],\n  networkConfiguration: runtimeNetworkConfiguration,\n  protocolConfiguration: bedrock_agentcore_alpha.ProtocolType.MCP,\n  requestHeaderConfiguration: {\n    allowlistedHeaders: ['allowlistedHeaders'],\n  },\n  runtimeName: 'runtimeName',\n  tags: {\n    tagsKey: 'tags',\n  },\n  tracingEnabled: false,\n});"
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.Runtime",
       "initializer": {
@@ -40275,9 +40235,9 @@
         "remarks": "Provides static factory methods to create different authentication types.",
         "stability": "experimental",
         "summary": "Abstract base class for runtime authorizer configurations.",
-        "example": "const repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\n// String claim - validates that the claim exactly equals the specified value\n// Uses EQUALS operator automatically\nconst departmentClaim = agentcore.RuntimeCustomClaim.withStringValue('department', 'engineering');\n\n// String array claim with CONTAINS operator (default)\n// Validates that the claim array contains a specific string value\n// IMPORTANT: CONTAINS requires exactly one value in the array parameter\nconst rolesClaim = agentcore.RuntimeCustomClaim.withStringArrayValue('roles', ['admin']);\n\n// String array claim with CONTAINS_ANY operator\n// Validates that the claim array contains at least one of the specified values\n// Use this when you want to check for multiple possible values\nconst permissionsClaim = agentcore.RuntimeCustomClaim.withStringArrayValue(\n  'permissions',\n  ['read', 'write'],\n  agentcore.CustomClaimOperator.CONTAINS_ANY\n);\n\n// Use custom claims in authorizer configuration\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingJWT(\n    \"https://example.com/.well-known/openid-configuration\",\n    [\"client1\", \"client2\"],\n    [\"audience1\"],\n    [\"read\", \"write\"],\n    [departmentClaim, rolesClaim, permissionsClaim] // Custom claims\n  ),\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_cognito as cognito } from 'aws-cdk-lib';\n\ndeclare const runtimeCustomClaim: bedrock_agentcore_alpha.RuntimeCustomClaim;\ndeclare const userPool: cognito.UserPool;\ndeclare const userPoolClient: cognito.UserPoolClient;\nconst runtimeAuthorizerConfiguration = bedrock_agentcore_alpha.RuntimeAuthorizerConfiguration.usingCognito(userPool, [userPoolClient], /* all optional props */ ['allowedAudience'], /* all optional props */ ['allowedScopes'], /* all optional props */ [runtimeCustomClaim]);",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.RuntimeAuthorizerConfiguration",
@@ -41270,9 +41230,9 @@
         "remarks": "Custom claims allow you to validate additional fields in JWT tokens beyond\nthe standard audience, client, and scope validations.",
         "stability": "experimental",
         "summary": "Represents a custom claim validation configuration for Runtime JWT authorizers.",
-        "example": "declare const userPool: cognito.UserPool;\ndeclare const userPoolClient: cognito.UserPoolClient;\ndeclare const anotherUserPoolClient: cognito.UserPoolClient;\n\nconst repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\n// Optional: Create custom claims for additional validation\nconst customClaims = [\n  agentcore.RuntimeCustomClaim.withStringValue('department', 'engineering'),\n  agentcore.RuntimeCustomClaim.withStringArrayValue('roles', ['admin'], agentcore.CustomClaimOperator.CONTAINS),\n  agentcore.RuntimeCustomClaim.withStringArrayValue('permissions', ['read', 'write'], agentcore.CustomClaimOperator.CONTAINS_ANY),\n];\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingCognito(\n    userPool, // User Pool (required)\n    [userPoolClient, anotherUserPoolClient], // User Pool Clients\n    [\"audience1\"], // Allowed Audiences (optional)\n    [\"read\", \"write\"], // Allowed Scopes (optional)\n    customClaims, // Custom claims (optional) - see Custom Claims Validation section\n  ),\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst runtimeCustomClaim = bedrock_agentcore_alpha.RuntimeCustomClaim.withStringArrayValue('name', ['values'], /* all optional props */ bedrock_agentcore_alpha.CustomClaimOperator.EQUALS);",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.RuntimeCustomClaim",
@@ -41386,12 +41346,12 @@
       "docs": {
         "custom": {
           "resource": "AWS::BedrockAgentCore::RuntimeEndpoint",
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "infused"
         },
         "see": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-endpoint.html",
         "stability": "experimental",
         "summary": "Bedrock Agent Core Runtime Endpoint Provides a stable endpoint for invoking agent runtimes with versioning support.",
-        "example": "const repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\n\nconst agentRuntimeArtifactNew = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v2.0.0\");\n\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifactNew,\n});\n\nconst stagingEndpoint = runtime.addEndpoint(\"staging\", {\n  version: \"2\",\n  description: \"Staging environment for testing new version\"\n});"
+        "example": "// Using a specific endpoint\ndeclare const runtime: agentcore.Runtime;\nconst endpoint = runtime.addEndpoint('PROD');\nconst dataSource = agentcore.DataSourceConfig.fromAgentRuntimeEndpoint(runtime, endpoint);"
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.RuntimeEndpoint",
       "initializer": {
@@ -42140,9 +42100,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for creating a Bedrock Agent Core Runtime Endpoint resource.",
-        "example": "// Reference an existing runtime by its ID\nconst existingRuntimeId = \"abc123-runtime-id\"; // The ID of an existing runtime\n\n// Create a standalone endpoint\nconst endpoint = new agentcore.RuntimeEndpoint(this, \"MyEndpoint\", {\n  endpointName: \"production\",\n  agentRuntimeId: existingRuntimeId,\n  agentRuntimeVersion: \"1\", // Specify which version to use\n  description: \"Production endpoint for existing runtime\"\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst runtimeEndpointProps: bedrock_agentcore_alpha.RuntimeEndpointProps = {\n  agentRuntimeId: 'agentRuntimeId',\n\n  // the properties below are optional\n  agentRuntimeVersion: 'agentRuntimeVersion',\n  description: 'description',\n  endpointName: 'endpointName',\n  tags: {\n    tagsKey: 'tags',\n  },\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.RuntimeEndpointProps",
@@ -42256,9 +42216,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Network configuration for the Runtime.",
-        "example": "const repository = new ecr.Repository(this, \"TestRepository\", {\n  repositoryName: \"test-agent-runtime\",\n});\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, \"v1.0.0\");\n\n// Create or use an existing VPC\nconst vpc = new ec2.Vpc(this, 'MyVpc', {\n  maxAzs: 2,\n});\n\n// Configure runtime with VPC\nconst runtime = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n  networkConfiguration: agentcore.RuntimeNetworkConfiguration.usingVpc(this, {\n    vpc: vpc,\n    vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },\n    // Optionally specify security groups, or one will be created automatically\n    // securityGroups: [mySecurityGroup],\n  }),\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst runtimeNetworkConfiguration = bedrock_agentcore_alpha.RuntimeNetworkConfiguration.usingPublicNetwork();",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.RuntimeNetworkConfiguration",
@@ -42371,9 +42331,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for creating a Bedrock Agent Core Runtime resource.",
-        "example": "// S3 bucket containing the agent core\nconst codeBucket = new s3.Bucket(this, \"AgentCode\", {\n  bucketName: \"my-code-bucket\",\n  removalPolicy: RemovalPolicy.DESTROY, // For demo purposes\n});\n\n// the bucket above needs to contain the agent code\n\nconst agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromS3(\n  {\n    bucketName: codeBucket.bucketName,\n    objectKey: 'deployment_package.zip',\n  },\n  agentcore.AgentCoreRuntime.PYTHON_3_12,\n  ['opentelemetry-instrument', 'main.py']\n);\n\nconst runtimeInstance = new agentcore.Runtime(this, \"MyAgentRuntime\", {\n  runtimeName: \"myAgent\",\n  agentRuntimeArtifact: agentRuntimeArtifact,\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\nimport { aws_iam as iam } from 'aws-cdk-lib';\n\ndeclare const agentRuntimeArtifact: bedrock_agentcore_alpha.AgentRuntimeArtifact;\ndeclare const loggingDestination: bedrock_agentcore_alpha.LoggingDestination;\ndeclare const logType: bedrock_agentcore_alpha.LogType;\ndeclare const role: iam.Role;\ndeclare const runtimeAuthorizerConfiguration: bedrock_agentcore_alpha.RuntimeAuthorizerConfiguration;\ndeclare const runtimeNetworkConfiguration: bedrock_agentcore_alpha.RuntimeNetworkConfiguration;\nconst runtimeProps: bedrock_agentcore_alpha.RuntimeProps = {\n  agentRuntimeArtifact: agentRuntimeArtifact,\n\n  // the properties below are optional\n  authorizerConfiguration: runtimeAuthorizerConfiguration,\n  description: 'description',\n  environmentVariables: {\n    environmentVariablesKey: 'environmentVariables',\n  },\n  executionRole: role,\n  lifecycleConfiguration: {\n    idleRuntimeSessionTimeout: cdk.Duration.minutes(30),\n    maxLifetime: cdk.Duration.minutes(30),\n  },\n  loggingConfigs: [{\n    destination: loggingDestination,\n    logType: logType,\n  }],\n  networkConfiguration: runtimeNetworkConfiguration,\n  protocolConfiguration: bedrock_agentcore_alpha.ProtocolType.MCP,\n  requestHeaderConfiguration: {\n    allowlistedHeaders: ['allowlistedHeaders'],\n  },\n  runtimeName: 'runtimeName',\n  tags: {\n    tagsKey: 'tags',\n  },\n  tracingEnabled: false,\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.RuntimeProps",
@@ -42644,9 +42604,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Class to define an API Schema from an S3 object.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\n// Create an API key credential provider in Token Vault\nconst apiKeyProvider = new agentcore.ApiKeyCredentialProvider(this, \"MyApiKeyProvider\", {\n  apiKeyCredentialProviderName: \"my-apikey\",\n});\n\nconst bucket = s3.Bucket.fromBucketName(this, \"ExistingBucket\", \"my-schema-bucket\");\nconst s3mySchema = agentcore.ApiSchema.fromS3File(bucket, \"schemas/myschema.yaml\");\n\n// Add an OpenAPI target using the L2 construct directly\nconst target = gateway.addOpenApiTarget(\"MyTarget\", {\n  gatewayTargetName: \"my-api-target\",\n  description: \"Target for external API integration\",\n  apiSchema: s3mySchema,\n  credentialProviderConfigurations: [\n    agentcore.GatewayCredentialProvider.fromApiKeyIdentity(apiKeyProvider, {\n      credentialLocation: agentcore.ApiKeyCredentialLocation.header({\n        credentialParameterName: \"X-API-Key\",\n      }),\n    }),\n  ],\n});\n\n// This makes sure your s3 bucket is available before target\ntarget.node.addDependency(bucket);",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst s3ApiSchema = new bedrock_agentcore_alpha.S3ApiSchema({\n  bucketName: 'bucketName',\n  objectKey: 'objectKey',\n\n  // the properties below are optional\n  objectVersion: 'objectVersion',\n}, /* all optional props */ 'bucketOwnerAccountId');",
         "custom": {
-          "exampleMetadata": "infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.S3ApiSchema",
@@ -42752,9 +42712,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Class to define a Tool Schema from an S3 object.",
-        "example": "\nconst toolSchema = agentcore.ToolSchema.fromS3File(\n    s3.Bucket.fromBucketName(this, \"SchemasBucket\", \"my-schemas-bucket\"),\n    \"tools/complex-tool-schema.json\",\n    \"123456789012\"\n  );",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst s3ToolSchema = new bedrock_agentcore_alpha.S3ToolSchema({\n  bucketName: 'bucketName',\n  objectKey: 'objectKey',\n\n  // the properties below are optional\n  objectVersion: 'objectVersion',\n}, /* all optional props */ 'bucketOwnerAccountId');",
         "custom": {
-          "exampleMetadata": "infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.S3ToolSchema",
@@ -42883,9 +42843,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Schema definition for tool input/output.",
-        "example": "// Create a gateway first\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst lambdaFunction = new lambda.Function(this, \"MyFunction\", {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\n    exports.handler = async (event) => {\n      return {\n        statusCode: 200,\n        body: JSON.stringify({ message: 'Hello from Lambda!' })\n      };\n    };\n  `),\n});\n\nconst lambdaTarget = gateway.addLambdaTarget(\"MyLambdaTarget\", {\n  gatewayTargetName: \"my-lambda-target\",\n  description: \"Lambda function target\",\n  lambdaFunction: lambdaFunction,\n  toolSchema: agentcore.ToolSchema.fromInline([\n    {\n      name: \"hello_world\",\n      description: \"A simple hello world tool\",\n      inputSchema: {\n        type: agentcore.SchemaDefinitionType.OBJECT,\n        properties: {\n          name: {\n            type: agentcore.SchemaDefinitionType.STRING,\n            description: \"The name to greet\",\n          },\n        },\n        required: [\"name\"],\n      },\n    },\n  ]),\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\n\ndeclare const schemaDefinition_: bedrock_agentcore_alpha.SchemaDefinition;\nconst schemaDefinition: bedrock_agentcore_alpha.SchemaDefinition = {\n  type: bedrock_agentcore_alpha.SchemaDefinitionType.STRING,\n\n  // the properties below are optional\n  description: 'description',\n  items: schemaDefinition_,\n  properties: {\n    propertiesKey: schemaDefinition_,\n  },\n  required: ['required'],\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.SchemaDefinition",
@@ -43006,11 +42966,7 @@
       "assembly": "@aws-cdk/aws-bedrock-agentcore-alpha",
       "docs": {
         "stability": "experimental",
-        "summary": "Schema definition types.",
-        "example": "// Create a gateway first\nconst gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst lambdaFunction = new lambda.Function(this, \"MyFunction\", {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\n    exports.handler = async (event) => {\n      return {\n        statusCode: 200,\n        body: JSON.stringify({ message: 'Hello from Lambda!' })\n      };\n    };\n  `),\n});\n\nconst lambdaTarget = gateway.addLambdaTarget(\"MyLambdaTarget\", {\n  gatewayTargetName: \"my-lambda-target\",\n  description: \"Lambda function target\",\n  lambdaFunction: lambdaFunction,\n  toolSchema: agentcore.ToolSchema.fromInline([\n    {\n      name: \"hello_world\",\n      description: \"A simple hello world tool\",\n      inputSchema: {\n        type: agentcore.SchemaDefinitionType.OBJECT,\n        properties: {\n          name: {\n            type: agentcore.SchemaDefinitionType.STRING,\n            description: \"The name to greet\",\n          },\n        },\n        required: [\"name\"],\n      },\n    },\n  ]),\n});",
-        "custom": {
-          "exampleMetadata": "fixture=default infused"
-        }
+        "summary": "Schema definition types."
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.SchemaDefinitionType",
       "kind": "enum",
@@ -43071,9 +43027,9 @@
         "remarks": "Define memory processing logic in your own environment.",
         "stability": "experimental",
         "summary": "Use AgentCore memory for event storage with custom triggers.",
-        "example": "\nconst bucket = new s3.Bucket(this, 'memoryBucket', {\n  bucketName: 'test-memory',\n  removalPolicy: cdk.RemovalPolicy.DESTROY,\n  autoDeleteObjects: true,\n});\n\nconst topic = new sns.Topic(this, 'topic');\n\n// Create a custom semantic memory strategy\nconst selfManagedStrategy = agentcore.MemoryStrategy.usingSelfManaged({\n  name: \"selfManagedStrategy\",\n  description: \"self managed memory strategy\",\n  historicalContextWindowSize: 5,\n  invocationConfiguration: {\n    topic: topic,\n    s3Location: {\n      bucketName: bucket.bucketName,\n      objectKey: 'memory/',\n    }\n  },\n  triggerConditions: {\n    messageBasedTrigger: 1,\n    timeBasedTrigger: cdk.Duration.seconds(10),\n    tokenBasedTrigger: 100\n  }\n});\n\n// Create memory with custom strategy\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my-custom-memory\",\n  description: \"Memory with custom strategy\",\n  expirationDuration: cdk.Duration.days(90),\n  memoryStrategies: [selfManagedStrategy],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\nimport { aws_sns as sns } from 'aws-cdk-lib';\n\ndeclare const topic: sns.Topic;\nconst selfManagedMemoryStrategy = new bedrock_agentcore_alpha.SelfManagedMemoryStrategy(bedrock_agentcore_alpha.MemoryStrategyType.SUMMARIZATION, {\n  invocationConfiguration: {\n    s3Location: {\n      bucketName: 'bucketName',\n      objectKey: 'objectKey',\n\n      // the properties below are optional\n      objectVersion: 'objectVersion',\n    },\n    topic: topic,\n  },\n  name: 'name',\n\n  // the properties below are optional\n  description: 'description',\n  historicalContextWindowSize: 123,\n  triggerConditions: {\n    messageBasedTrigger: 123,\n    timeBasedTrigger: cdk.Duration.minutes(30),\n    tokenBasedTrigger: 123,\n  },\n});",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.SelfManagedMemoryStrategy",
@@ -43266,9 +43222,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Configuration parameters for a self managed memory strategy existing built-in default prompts/models.",
-        "example": "\nconst bucket = new s3.Bucket(this, 'memoryBucket', {\n  bucketName: 'test-memory',\n  removalPolicy: cdk.RemovalPolicy.DESTROY,\n  autoDeleteObjects: true,\n});\n\nconst topic = new sns.Topic(this, 'topic');\n\n// Create a custom semantic memory strategy\nconst selfManagedStrategy = agentcore.MemoryStrategy.usingSelfManaged({\n  name: \"selfManagedStrategy\",\n  description: \"self managed memory strategy\",\n  historicalContextWindowSize: 5,\n  invocationConfiguration: {\n    topic: topic,\n    s3Location: {\n      bucketName: bucket.bucketName,\n      objectKey: 'memory/',\n    }\n  },\n  triggerConditions: {\n    messageBasedTrigger: 1,\n    timeBasedTrigger: cdk.Duration.seconds(10),\n    tokenBasedTrigger: 100\n  }\n});\n\n// Create memory with custom strategy\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my-custom-memory\",\n  description: \"Memory with custom strategy\",\n  expirationDuration: cdk.Duration.days(90),\n  memoryStrategies: [selfManagedStrategy],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\nimport { aws_sns as sns } from 'aws-cdk-lib';\n\ndeclare const topic: sns.Topic;\nconst selfManagedStrategyProps: bedrock_agentcore_alpha.SelfManagedStrategyProps = {\n  invocationConfiguration: {\n    s3Location: {\n      bucketName: 'bucketName',\n      objectKey: 'objectKey',\n\n      // the properties below are optional\n      objectVersion: 'objectVersion',\n    },\n    topic: topic,\n  },\n  name: 'name',\n\n  // the properties below are optional\n  description: 'description',\n  historicalContextWindowSize: 123,\n  triggerConditions: {\n    messageBasedTrigger: 123,\n    timeBasedTrigger: cdk.Duration.minutes(30),\n    tokenBasedTrigger: 123,\n  },\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.SelfManagedStrategyProps",
@@ -43678,9 +43634,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "****************************************************************************                      TOOL SCHEMA CLASS ***************************************************************************.",
-        "example": "const gateway = new agentcore.Gateway(this, \"MyGateway\", {\n  gatewayName: \"my-gateway\",\n});\n\nconst lambdaFunction = new lambda.Function(this, \"MyFunction\", {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: \"index.handler\",\n  code: lambda.Code.fromInline(`\n        exports.handler = async (event) => {\n            return {\n                statusCode: 200,\n                body: JSON.stringify({ message: 'Hello from Lambda!' })\n            };\n        };\n    `),\n});\n\n// Create a gateway target with Lambda and tool schema\nconst target = agentcore.GatewayTarget.forLambda(this, \"MyLambdaTarget\", {\n  gatewayTargetName: \"my-lambda-target\",\n  description: \"Target for Lambda function integration\",\n  gateway: gateway,\n  lambdaFunction: lambdaFunction,\n  toolSchema: agentcore.ToolSchema.fromLocalAsset(\n    path.join(__dirname, \"schemas\", \"my-tool-schema.json\")\n  ),\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst toolSchema = bedrock_agentcore_alpha.ToolSchema.fromLocalAsset('path');",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.ToolSchema",
@@ -43944,9 +43900,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Trigger conditions for self managed memory strategy When first condition is met, batched payloads are sent to specified S3 bucket.",
-        "example": "\nconst bucket = new s3.Bucket(this, 'memoryBucket', {\n  bucketName: 'test-memory',\n  removalPolicy: cdk.RemovalPolicy.DESTROY,\n  autoDeleteObjects: true,\n});\n\nconst topic = new sns.Topic(this, 'topic');\n\n// Create a custom semantic memory strategy\nconst selfManagedStrategy = agentcore.MemoryStrategy.usingSelfManaged({\n  name: \"selfManagedStrategy\",\n  description: \"self managed memory strategy\",\n  historicalContextWindowSize: 5,\n  invocationConfiguration: {\n    topic: topic,\n    s3Location: {\n      bucketName: bucket.bucketName,\n      objectKey: 'memory/',\n    }\n  },\n  triggerConditions: {\n    messageBasedTrigger: 1,\n    timeBasedTrigger: cdk.Duration.seconds(10),\n    tokenBasedTrigger: 100\n  }\n});\n\n// Create memory with custom strategy\nconst memory = new agentcore.Memory(this, \"MyMemory\", {\n  memoryName: \"my-custom-memory\",\n  description: \"Memory with custom strategy\",\n  expirationDuration: cdk.Duration.days(90),\n  memoryStrategies: [selfManagedStrategy],\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport * as cdk from 'aws-cdk-lib';\nconst triggerConditions: bedrock_agentcore_alpha.TriggerConditions = {\n  messageBasedTrigger: 123,\n  timeBasedTrigger: cdk.Duration.minutes(30),\n  tokenBasedTrigger: 123,\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.TriggerConditions",
@@ -44046,9 +44002,9 @@
         "remarks": "Only used when network mode is VPC.",
         "stability": "experimental",
         "summary": "VPC configuration properties.",
-        "example": "const vpc = new ec2.Vpc(this, 'testVPC');\n\nconst codeInterpreter = new agentcore.CodeInterpreterCustom(this, \"MyCodeInterpreter\", {\n  codeInterpreterCustomName: \"my_sandbox_interpreter\",\n  description: \"Code interpreter with isolated network access\",\n  networkConfiguration: agentcore.BrowserNetworkConfiguration.usingVpc(this, {\n    vpc: vpc,\n  }),\n});\n\ncodeInterpreter.connections.addSecurityGroup(new ec2.SecurityGroup(this, 'AdditionalGroup', { vpc }));",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nimport { aws_ec2 as ec2 } from 'aws-cdk-lib';\n\ndeclare const securityGroup: ec2.SecurityGroup;\ndeclare const subnet: ec2.Subnet;\ndeclare const subnetFilter: ec2.SubnetFilter;\ndeclare const vpc: ec2.Vpc;\nconst vpcConfigProps: bedrock_agentcore_alpha.VpcConfigProps = {\n  vpc: vpc,\n\n  // the properties below are optional\n  allowAllOutbound: false,\n  securityGroups: [securityGroup],\n  vpcSubnets: {\n    availabilityZones: ['availabilityZones'],\n    onePerAz: false,\n    subnetFilters: [subnetFilter],\n    subnetGroupName: 'subnetGroupName',\n    subnets: [subnet],\n    subnetType: ec2.SubnetType.PRIVATE_ISOLATED,\n  },\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.VpcConfigProps",
@@ -44146,13 +44102,13 @@
       "docs": {
         "custom": {
           "resource": "AWS::BedrockAgentCore::WorkloadIdentity",
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         },
         "remarks": "A workload identity is the stable identity of an agent in an AWS account. It ties together\nIAM roles, OAuth2 flows, API keys, and workload access tokens for consistent authentication\nacross environments.",
         "see": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-workloadidentity.html",
         "stability": "experimental",
         "summary": "L2 construct for `AWS::BedrockAgentCore::WorkloadIdentity`.",
-        "example": "new agentcore.WorkloadIdentity(this, \"MyWorkloadIdentity\", {\n  workloadIdentityName: \"customer-support-agent-prod\",\n  allowedResourceOauth2ReturnUrls: [\"https://app.example.com/oauth/callback\"],\n  tags: { team: \"agents\", env: \"prod\" },\n});"
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst workloadIdentity = new bedrock_agentcore_alpha.WorkloadIdentity(this, 'MyWorkloadIdentity', /* all optional props */ {\n  allowedResourceOauth2ReturnUrls: ['allowedResourceOauth2ReturnUrls'],\n  tags: {\n    tagsKey: 'tags',\n  },\n  workloadIdentityName: 'workloadIdentityName',\n});"
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.WorkloadIdentity",
       "initializer": {
@@ -44711,9 +44667,9 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for a new {@link WorkloadIdentity}.",
-        "example": "new agentcore.WorkloadIdentity(this, \"MyWorkloadIdentity\", {\n  workloadIdentityName: \"customer-support-agent-prod\",\n  allowedResourceOauth2ReturnUrls: [\"https://app.example.com/oauth/callback\"],\n  tags: { team: \"agents\", env: \"prod\" },\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as bedrock_agentcore_alpha from '@aws-cdk/aws-bedrock-agentcore-alpha';\nconst workloadIdentityProps: bedrock_agentcore_alpha.WorkloadIdentityProps = {\n  allowedResourceOauth2ReturnUrls: ['allowedResourceOauth2ReturnUrls'],\n  tags: {\n    tagsKey: 'tags',\n  },\n  workloadIdentityName: 'workloadIdentityName',\n};",
         "custom": {
-          "exampleMetadata": "fixture=default infused"
+          "exampleMetadata": "fixture=_generated"
         }
       },
       "fqn": "@aws-cdk/aws-bedrock-agentcore-alpha.WorkloadIdentityProps",
@@ -44864,6 +44820,6 @@
       "symbolId": "lib/identity/oauth2-credential-provider:ZoomOAuth2CredentialProviderProps"
     }
   },
-  "version": "2.254.0-alpha.0",
+  "version": "2.256.0-alpha.0",
   "fingerprint": "**********"
 }