@aws-cdk/cfn-property-mixins 2.259.0 → 2.261.0

package/lib/services/aws-bedrockagentcore/cfn-props-mixins.generated.d.ts

@@ -31,6 +31,27 @@ export declare class CfnApiKeyCredentialProviderPropsMixin extends cdk.Mixin imp
     applyTo(construct: constructs.IConstruct): void;
 }
 export declare namespace CfnApiKeyCredentialProviderPropsMixin {
+    /**
+     * A reference to a customer-provided secret stored in AWS Secrets Manager.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-apikeycredentialprovider-secretreference.html
+     */
+    interface SecretReferenceProperty {
+        /**
+         * The JSON key within the secret that contains the credential value.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-apikeycredentialprovider-secretreference.html#cfn-bedrockagentcore-apikeycredentialprovider-secretreference-jsonkey
+         */
+        readonly jsonKey?: string;
+        /**
+         * The ID or ARN of the secret in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-apikeycredentialprovider-secretreference.html#cfn-bedrockagentcore-apikeycredentialprovider-secretreference-secretid
+         */
+        readonly secretId?: string;
+    }
     /**
      * Contains information about the API key secret in AWS Secrets Manager.
      *
@@ -61,6 +82,20 @@ export interface CfnApiKeyCredentialProviderMixinProps {
      * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-apikeycredentialprovider.html#cfn-bedrockagentcore-apikeycredentialprovider-apikey
      */
     readonly apiKey?: string;
+    /**
+     * A reference to a customer-provided secret stored in AWS Secrets Manager.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-apikeycredentialprovider.html#cfn-bedrockagentcore-apikeycredentialprovider-apikeysecretconfig
+     */
+    readonly apiKeySecretConfig?: cdk.IResolvable | CfnApiKeyCredentialProviderPropsMixin.SecretReferenceProperty;
+    /**
+     * The source of the API key secret.
+     *
+     * Use MANAGED for service-managed secrets or EXTERNAL for customer-provided secrets.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-apikeycredentialprovider.html#cfn-bedrockagentcore-apikeycredentialprovider-apikeysecretsource
+     */
+    readonly apiKeySecretSource?: string;
     /**
      * The name of the API key credential provider.
      *
@@ -574,6 +609,164 @@ export interface CfnCodeInterpreterCustomMixinProps {
      */
     readonly tags?: Record<string, string>;
 }
+/**
+ * Definition of AWS::BedrockAgentCore::ConfigurationBundle Resource Type.
+ *
+ * @cloudformationResource AWS::BedrockAgentCore::ConfigurationBundle
+ * @mixin true
+ * @stability external
+ * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-configurationbundle.html
+ */
+export declare class CfnConfigurationBundlePropsMixin extends cdk.Mixin implements constructs.IMixin {
+    protected static readonly CFN_PROPERTY_KEYS: Array<string>;
+    protected readonly props: CfnConfigurationBundleMixinProps;
+    protected readonly strategy: cdk.IMergeStrategy;
+    /**
+     * Create a mixin to apply properties to `AWS::BedrockAgentCore::ConfigurationBundle`.
+     *
+     * @param props L1 properties to apply
+     * @param options Mixin options
+     */
+    constructor(props: CfnConfigurationBundleMixinProps, options?: mixins.CfnPropertyMixinOptions);
+    /**
+     * Check if this mixin supports the given construct
+     */
+    supports(construct: constructs.IConstruct): construct is service.CfnConfigurationBundle;
+    /**
+     * Apply the mixin properties to the construct
+     */
+    applyTo(construct: constructs.IConstruct): void;
+}
+export declare namespace CfnConfigurationBundlePropsMixin {
+    /**
+     * The configuration for a component within a configuration bundle.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-configurationbundle-componentconfiguration.html
+     */
+    interface ComponentConfigurationProperty {
+        /**
+         * The configuration values as a flexible JSON document.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-configurationbundle-componentconfiguration.html#cfn-bedrockagentcore-configurationbundle-componentconfiguration-configuration
+         */
+        readonly configuration?: any | cdk.IResolvable;
+    }
+    /**
+     * The source that created a configuration bundle version.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-configurationbundle-versioncreatedbysource.html
+     */
+    interface VersionCreatedBySourceProperty {
+        /**
+         * The Amazon Resource Name (ARN) of the source, if applicable.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-configurationbundle-versioncreatedbysource.html#cfn-bedrockagentcore-configurationbundle-versioncreatedbysource-arn
+         */
+        readonly arn?: string;
+        /**
+         * The name of the source (for example, user, optimization-job, or system).
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-configurationbundle-versioncreatedbysource.html#cfn-bedrockagentcore-configurationbundle-versioncreatedbysource-name
+         */
+        readonly name?: string;
+    }
+    /**
+     * The version lineage metadata that tracks parent versions and creation source.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-configurationbundle-versionlineagemetadata.html
+     */
+    interface VersionLineageMetadataProperty {
+        /**
+         * The branch name for this version.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-configurationbundle-versionlineagemetadata.html#cfn-bedrockagentcore-configurationbundle-versionlineagemetadata-branchname
+         */
+        readonly branchName?: string;
+        /**
+         * A commit message describing the changes in this version.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-configurationbundle-versionlineagemetadata.html#cfn-bedrockagentcore-configurationbundle-versionlineagemetadata-commitmessage
+         */
+        readonly commitMessage?: string;
+        /**
+         * The source that created a configuration bundle version.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-configurationbundle-versionlineagemetadata.html#cfn-bedrockagentcore-configurationbundle-versionlineagemetadata-createdby
+         */
+        readonly createdBy?: cdk.IResolvable | CfnConfigurationBundlePropsMixin.VersionCreatedBySourceProperty;
+        /**
+         * A list of parent version identifiers.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-configurationbundle-versionlineagemetadata.html#cfn-bedrockagentcore-configurationbundle-versionlineagemetadata-parentversionids
+         */
+        readonly parentVersionIds?: Array<string>;
+    }
+}
+/**
+ * Properties for CfnConfigurationBundlePropsMixin
+ *
+ * @struct
+ * @stability external
+ * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-configurationbundle.html
+ */
+export interface CfnConfigurationBundleMixinProps {
+    /**
+     * The branch name for version tracking.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-configurationbundle.html#cfn-bedrockagentcore-configurationbundle-branchname
+     */
+    readonly branchName?: string;
+    /**
+     * The name for the configuration bundle.
+     *
+     * Names must be unique within your account.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-configurationbundle.html#cfn-bedrockagentcore-configurationbundle-bundlename
+     */
+    readonly bundleName?: string;
+    /**
+     * A commit message describing the version of the configuration bundle.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-configurationbundle.html#cfn-bedrockagentcore-configurationbundle-commitmessage
+     */
+    readonly commitMessage?: string;
+    /**
+     * A map of component identifiers to their configurations.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-configurationbundle.html#cfn-bedrockagentcore-configurationbundle-components
+     */
+    readonly components?: cdk.IResolvable | Record<string, CfnConfigurationBundlePropsMixin.ComponentConfigurationProperty | cdk.IResolvable>;
+    /**
+     * The source that created a configuration bundle version.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-configurationbundle.html#cfn-bedrockagentcore-configurationbundle-createdby
+     */
+    readonly createdBy?: cdk.IResolvable | CfnConfigurationBundlePropsMixin.VersionCreatedBySourceProperty;
+    /**
+     * The description for the configuration bundle.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-configurationbundle.html#cfn-bedrockagentcore-configurationbundle-description
+     */
+    readonly description?: string;
+    /**
+     * The ARN of the KMS key used to encrypt component configurations.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-configurationbundle.html#cfn-bedrockagentcore-configurationbundle-kmskeyarn
+     */
+    readonly kmsKeyArn?: string;
+    /**
+     * Tags to assign to the configuration bundle.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-configurationbundle.html#cfn-bedrockagentcore-configurationbundle-tags
+     */
+    readonly tags?: Array<cdk.CfnTag>;
+}
 /**
  * Definition of AWS::BedrockAgentCore::Dataset Resource Type.
  *
@@ -1261,6 +1454,14 @@ export declare namespace CfnGatewayPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gateway-mcpgatewayconfiguration.html#cfn-bedrockagentcore-gateway-mcpgatewayconfiguration-searchtype
          */
         readonly searchType?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gateway-mcpgatewayconfiguration.html#cfn-bedrockagentcore-gateway-mcpgatewayconfiguration-sessionconfiguration
+         */
+        readonly sessionConfiguration?: cdk.IResolvable | CfnGatewayPropsMixin.SessionConfigurationProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gateway-mcpgatewayconfiguration.html#cfn-bedrockagentcore-gateway-mcpgatewayconfiguration-streamingconfiguration
+         */
+        readonly streamingConfiguration?: cdk.IResolvable | CfnGatewayPropsMixin.StreamingConfigurationProperty;
         /**
          * The supported versions for the MCP configuration for the gateway target.
          *
@@ -1268,6 +1469,28 @@ export declare namespace CfnGatewayPropsMixin {
          */
         readonly supportedVersions?: Array<string>;
     }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gateway-sessionconfiguration.html
+     */
+    interface SessionConfigurationProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gateway-sessionconfiguration.html#cfn-bedrockagentcore-gateway-sessionconfiguration-sessiontimeoutinseconds
+         */
+        readonly sessionTimeoutInSeconds?: number;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gateway-streamingconfiguration.html
+     */
+    interface StreamingConfigurationProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gateway-streamingconfiguration.html#cfn-bedrockagentcore-gateway-streamingconfiguration-enableresponsestreaming
+         */
+        readonly enableResponseStreaming?: boolean | cdk.IResolvable;
+    }
     /**
      * The workload identity details for the gateway.
      *
@@ -1540,6 +1763,59 @@ export declare namespace CfnGatewayTargetPropsMixin {
          */
         readonly allowedResponseHeaders?: Array<string>;
     }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-privateendpoint.html
+     */
+    interface PrivateEndpointProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-privateendpoint.html#cfn-bedrockagentcore-gatewaytarget-privateendpoint-managedvpcresource
+         */
+        readonly managedVpcResource?: cdk.IResolvable | CfnGatewayTargetPropsMixin.ManagedVpcResourceProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-privateendpoint.html#cfn-bedrockagentcore-gatewaytarget-privateendpoint-selfmanagedlatticeresource
+         */
+        readonly selfManagedLatticeResource?: cdk.IResolvable | CfnGatewayTargetPropsMixin.SelfManagedLatticeResourceProperty;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-selfmanagedlatticeresource.html
+     */
+    interface SelfManagedLatticeResourceProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-selfmanagedlatticeresource.html#cfn-bedrockagentcore-gatewaytarget-selfmanagedlatticeresource-resourceconfigurationidentifier
+         */
+        readonly resourceConfigurationIdentifier?: string;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-managedvpcresource.html
+     */
+    interface ManagedVpcResourceProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-managedvpcresource.html#cfn-bedrockagentcore-gatewaytarget-managedvpcresource-endpointipaddresstype
+         */
+        readonly endpointIpAddressType?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-managedvpcresource.html#cfn-bedrockagentcore-gatewaytarget-managedvpcresource-routingdomain
+         */
+        readonly routingDomain?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-managedvpcresource.html#cfn-bedrockagentcore-gatewaytarget-managedvpcresource-securitygroupids
+         */
+        readonly securityGroupIds?: Array<string>;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-managedvpcresource.html#cfn-bedrockagentcore-gatewaytarget-managedvpcresource-subnetids
+         */
+        readonly subnetIds?: Array<string>;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-managedvpcresource.html#cfn-bedrockagentcore-gatewaytarget-managedvpcresource-vpcidentifier
+         */
+        readonly vpcIdentifier?: string;
+    }
     /**
      * The target configuration.
      *
@@ -1571,6 +1847,10 @@ export declare namespace CfnGatewayTargetPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-mcptargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-mcptargetconfiguration-apigateway
          */
         readonly apiGateway?: CfnGatewayTargetPropsMixin.ApiGatewayTargetConfigurationProperty | cdk.IResolvable;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-mcptargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-mcptargetconfiguration-connector
+         */
+        readonly connector?: CfnGatewayTargetPropsMixin.ConnectorTargetConfigurationProperty | cdk.IResolvable;
         /**
          * The Lambda MCP configuration for the gateway target.
          *
@@ -1764,6 +2044,10 @@ export declare namespace CfnGatewayTargetPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-mcpservertargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-mcpservertargetconfiguration-mcptoolschema
          */
         readonly mcpToolSchema?: cdk.IResolvable | CfnGatewayTargetPropsMixin.McpToolSchemaConfigurationProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-mcpservertargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-mcpservertargetconfiguration-resourcepriority
+         */
+        readonly resourcePriority?: number;
     }
     /**
      * @struct
@@ -1852,6 +2136,78 @@ export declare namespace CfnGatewayTargetPropsMixin {
          */
         readonly methods?: Array<string>;
     }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectortargetconfiguration.html
+     */
+    interface ConnectorTargetConfigurationProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectortargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-connectortargetconfiguration-configurations
+         */
+        readonly configurations?: Array<CfnGatewayTargetPropsMixin.ConnectorConfigurationProperty | cdk.IResolvable> | cdk.IResolvable;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectortargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-connectortargetconfiguration-enabled
+         */
+        readonly enabled?: Array<string>;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectortargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-connectortargetconfiguration-source
+         */
+        readonly source?: CfnGatewayTargetPropsMixin.ConnectorSourceProperty | cdk.IResolvable;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectorsource.html
+     */
+    interface ConnectorSourceProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectorsource.html#cfn-bedrockagentcore-gatewaytarget-connectorsource-connectorid
+         */
+        readonly connectorId?: string;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectorconfiguration.html
+     */
+    interface ConnectorConfigurationProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectorconfiguration.html#cfn-bedrockagentcore-gatewaytarget-connectorconfiguration-description
+         */
+        readonly description?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectorconfiguration.html#cfn-bedrockagentcore-gatewaytarget-connectorconfiguration-name
+         */
+        readonly name?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectorconfiguration.html#cfn-bedrockagentcore-gatewaytarget-connectorconfiguration-parameteroverrides
+         */
+        readonly parameterOverrides?: Array<CfnGatewayTargetPropsMixin.ConnectorParameterOverrideProperty | cdk.IResolvable> | cdk.IResolvable;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectorconfiguration.html#cfn-bedrockagentcore-gatewaytarget-connectorconfiguration-parametervalues
+         */
+        readonly parameterValues?: any | cdk.IResolvable;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectorparameteroverride.html
+     */
+    interface ConnectorParameterOverrideProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectorparameteroverride.html#cfn-bedrockagentcore-gatewaytarget-connectorparameteroverride-description
+         */
+        readonly description?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectorparameteroverride.html#cfn-bedrockagentcore-gatewaytarget-connectorparameteroverride-path
+         */
+        readonly path?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-connectorparameteroverride.html#cfn-bedrockagentcore-gatewaytarget-connectorparameteroverride-visible
+         */
+        readonly visible?: boolean | cdk.IResolvable;
+    }
     /**
      * @struct
      * @stability external
@@ -1862,6 +2218,10 @@ export declare namespace CfnGatewayTargetPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-httptargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-httptargetconfiguration-agentcoreruntime
          */
         readonly agentcoreRuntime?: cdk.IResolvable | CfnGatewayTargetPropsMixin.RuntimeTargetConfigurationProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-httptargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-httptargetconfiguration-passthrough
+         */
+        readonly passthrough?: cdk.IResolvable | CfnGatewayTargetPropsMixin.PassthroughTargetConfigurationProperty;
     }
     /**
      * @struct
@@ -1877,52 +2237,124 @@ export declare namespace CfnGatewayTargetPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-runtimetargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-runtimetargetconfiguration-qualifier
          */
         readonly qualifier?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-runtimetargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-runtimetargetconfiguration-schema
+         */
+        readonly schema?: CfnGatewayTargetPropsMixin.HttpApiSchemaConfigurationProperty | cdk.IResolvable;
     }
     /**
      * @struct
      * @stability external
-     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-authorizationdata.html
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-httpapischemaconfiguration.html
      */
-    interface AuthorizationDataProperty {
+    interface HttpApiSchemaConfigurationProperty {
         /**
-         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-authorizationdata.html#cfn-bedrockagentcore-gatewaytarget-authorizationdata-oauth2
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-httpapischemaconfiguration.html#cfn-bedrockagentcore-gatewaytarget-httpapischemaconfiguration-source
          */
-        readonly oauth2?: cdk.IResolvable | CfnGatewayTargetPropsMixin.OAuth2AuthorizationDataProperty;
+        readonly source?: CfnGatewayTargetPropsMixin.ApiSchemaConfigurationProperty | cdk.IResolvable;
     }
     /**
      * @struct
      * @stability external
-     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-oauth2authorizationdata.html
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-passthroughtargetconfiguration.html
      */
-    interface OAuth2AuthorizationDataProperty {
+    interface PassthroughTargetConfigurationProperty {
         /**
-         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-oauth2authorizationdata.html#cfn-bedrockagentcore-gatewaytarget-oauth2authorizationdata-authorizationurl
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-passthroughtargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-passthroughtargetconfiguration-endpoint
          */
-        readonly authorizationUrl?: string;
+        readonly endpoint?: string;
         /**
-         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-oauth2authorizationdata.html#cfn-bedrockagentcore-gatewaytarget-oauth2authorizationdata-userid
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-passthroughtargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-passthroughtargetconfiguration-protocoltype
          */
-        readonly userId?: string;
+        readonly protocolType?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-passthroughtargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-passthroughtargetconfiguration-schema
+         */
+        readonly schema?: CfnGatewayTargetPropsMixin.HttpApiSchemaConfigurationProperty | cdk.IResolvable;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-passthroughtargetconfiguration.html#cfn-bedrockagentcore-gatewaytarget-passthroughtargetconfiguration-stickinessconfiguration
+         */
+        readonly stickinessConfiguration?: cdk.IResolvable | CfnGatewayTargetPropsMixin.StickinessConfigurationProperty;
     }
-}
-/**
- * Properties for CfnGatewayTargetPropsMixin
- *
- * @struct
- * @stability external
- * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-gatewaytarget.html
- */
-export interface CfnGatewayTargetMixinProps {
     /**
-     * The OAuth credential provider configuration.
-     *
-     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-gatewaytarget.html#cfn-bedrockagentcore-gatewaytarget-credentialproviderconfigurations
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-stickinessconfiguration.html
      */
-    readonly credentialProviderConfigurations?: Array<CfnGatewayTargetPropsMixin.CredentialProviderConfigurationProperty | cdk.IResolvable> | cdk.IResolvable;
+    interface StickinessConfigurationProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-stickinessconfiguration.html#cfn-bedrockagentcore-gatewaytarget-stickinessconfiguration-identifier
+         */
+        readonly identifier?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-stickinessconfiguration.html#cfn-bedrockagentcore-gatewaytarget-stickinessconfiguration-timeout
+         */
+        readonly timeout?: number;
+    }
     /**
-     * The description for the gateway target.
-     *
-     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-gatewaytarget.html#cfn-bedrockagentcore-gatewaytarget-description
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-managedresourcedetails.html
+     */
+    interface ManagedResourceDetailsProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-managedresourcedetails.html#cfn-bedrockagentcore-gatewaytarget-managedresourcedetails-domain
+         */
+        readonly domain?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-managedresourcedetails.html#cfn-bedrockagentcore-gatewaytarget-managedresourcedetails-resourceassociationarn
+         */
+        readonly resourceAssociationArn?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-managedresourcedetails.html#cfn-bedrockagentcore-gatewaytarget-managedresourcedetails-resourcegatewayarn
+         */
+        readonly resourceGatewayArn?: string;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-authorizationdata.html
+     */
+    interface AuthorizationDataProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-authorizationdata.html#cfn-bedrockagentcore-gatewaytarget-authorizationdata-oauth2
+         */
+        readonly oauth2?: cdk.IResolvable | CfnGatewayTargetPropsMixin.OAuth2AuthorizationDataProperty;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-oauth2authorizationdata.html
+     */
+    interface OAuth2AuthorizationDataProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-oauth2authorizationdata.html#cfn-bedrockagentcore-gatewaytarget-oauth2authorizationdata-authorizationurl
+         */
+        readonly authorizationUrl?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-oauth2authorizationdata.html#cfn-bedrockagentcore-gatewaytarget-oauth2authorizationdata-userid
+         */
+        readonly userId?: string;
+    }
+}
+/**
+ * Properties for CfnGatewayTargetPropsMixin
+ *
+ * @struct
+ * @stability external
+ * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-gatewaytarget.html
+ */
+export interface CfnGatewayTargetMixinProps {
+    /**
+     * The OAuth credential provider configuration.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-gatewaytarget.html#cfn-bedrockagentcore-gatewaytarget-credentialproviderconfigurations
+     */
+    readonly credentialProviderConfigurations?: Array<CfnGatewayTargetPropsMixin.CredentialProviderConfigurationProperty | cdk.IResolvable> | cdk.IResolvable;
+    /**
+     * The description for the gateway target.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-gatewaytarget.html#cfn-bedrockagentcore-gatewaytarget-description
      */
     readonly description?: string;
     /**
@@ -1941,6 +2373,10 @@ export interface CfnGatewayTargetMixinProps {
      * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-gatewaytarget.html#cfn-bedrockagentcore-gatewaytarget-name
      */
     readonly name?: string;
+    /**
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-gatewaytarget.html#cfn-bedrockagentcore-gatewaytarget-privateendpoint
+     */
+    readonly privateEndpoint?: cdk.IResolvable | CfnGatewayTargetPropsMixin.PrivateEndpointProperty;
     /**
      * The target configuration for the Smithy model target.
      *
@@ -1949,7 +2385,7 @@ export interface CfnGatewayTargetMixinProps {
     readonly targetConfiguration?: cdk.IResolvable | CfnGatewayTargetPropsMixin.TargetConfigurationProperty;
 }
 /**
- * Definition of AWS::BedrockAgentCore::Harness resource type - a managed agentic loop service that provides a turnkey solution for running stateful, tool-equipped AI agents.
+ * Resource Type definition for AWS::BedrockAgentCore::Harness - a managed agentic loop service that provides a turnkey solution for running stateful, tool-equipped AI agents.
  *
  * @cloudformationResource AWS::BedrockAgentCore::Harness
  * @mixin true
@@ -2076,6 +2512,18 @@ export declare namespace CfnHarnessPropsMixin {
      * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-filesystemconfiguration.html
      */
     interface FilesystemConfigurationProperty {
+        /**
+         * Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-filesystemconfiguration.html#cfn-bedrockagentcore-harness-filesystemconfiguration-efsaccesspoint
+         */
+        readonly efsAccessPoint?: CfnHarnessPropsMixin.EfsAccessPointConfigurationProperty | cdk.IResolvable;
+        /**
+         * Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-filesystemconfiguration.html#cfn-bedrockagentcore-harness-filesystemconfiguration-s3filesaccesspoint
+         */
+        readonly s3FilesAccessPoint?: cdk.IResolvable | CfnHarnessPropsMixin.S3FilesAccessPointConfigurationProperty;
         /**
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-filesystemconfiguration.html#cfn-bedrockagentcore-harness-filesystemconfiguration-sessionstorage
          */
@@ -2092,6 +2540,40 @@ export declare namespace CfnHarnessPropsMixin {
          */
         readonly mountPath?: string;
     }
+    /**
+     * Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-s3filesaccesspointconfiguration.html
+     */
+    interface S3FilesAccessPointConfigurationProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-s3filesaccesspointconfiguration.html#cfn-bedrockagentcore-harness-s3filesaccesspointconfiguration-accesspointarn
+         */
+        readonly accessPointArn?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-s3filesaccesspointconfiguration.html#cfn-bedrockagentcore-harness-s3filesaccesspointconfiguration-mountpath
+         */
+        readonly mountPath?: string;
+    }
+    /**
+     * Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-efsaccesspointconfiguration.html
+     */
+    interface EfsAccessPointConfigurationProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-efsaccesspointconfiguration.html#cfn-bedrockagentcore-harness-efsaccesspointconfiguration-accesspointarn
+         */
+        readonly accessPointArn?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-efsaccesspointconfiguration.html#cfn-bedrockagentcore-harness-efsaccesspointconfiguration-mountpath
+         */
+        readonly mountPath?: string;
+    }
     /**
      * @struct
      * @stability external
@@ -2153,6 +2635,16 @@ export declare namespace CfnHarnessPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-customjwtauthorizerconfiguration.html#cfn-bedrockagentcore-harness-customjwtauthorizerconfiguration-discoveryurl
          */
         readonly discoveryUrl?: string;
+        /**
+         * Private endpoint configuration for connecting to the OpenID Connect discovery endpoint over a private network.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-customjwtauthorizerconfiguration.html#cfn-bedrockagentcore-harness-customjwtauthorizerconfiguration-privateendpoint
+         */
+        readonly privateEndpoint?: cdk.IResolvable | CfnHarnessPropsMixin.PrivateEndpointProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-customjwtauthorizerconfiguration.html#cfn-bedrockagentcore-harness-customjwtauthorizerconfiguration-privateendpointoverrides
+         */
+        readonly privateEndpointOverrides?: Array<cdk.IResolvable | CfnHarnessPropsMixin.PrivateEndpointOverrideProperty> | cdk.IResolvable;
     }
     /**
      * @struct
@@ -2203,6 +2695,92 @@ export declare namespace CfnHarnessPropsMixin {
          */
         readonly matchValueStringList?: Array<string>;
     }
+    /**
+     * Private endpoint configuration for connecting to the OpenID Connect discovery endpoint over a private network.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-privateendpoint.html
+     */
+    interface PrivateEndpointProperty {
+        /**
+         * Configuration for a service-managed VPC endpoint.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-privateendpoint.html#cfn-bedrockagentcore-harness-privateendpoint-managedvpcresource
+         */
+        readonly managedVpcResource?: cdk.IResolvable | CfnHarnessPropsMixin.ManagedVpcResourceProperty;
+        /**
+         * Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-privateendpoint.html#cfn-bedrockagentcore-harness-privateendpoint-selfmanagedlatticeresource
+         */
+        readonly selfManagedLatticeResource?: cdk.IResolvable | CfnHarnessPropsMixin.SelfManagedLatticeResourceProperty;
+    }
+    /**
+     * Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-selfmanagedlatticeresource.html
+     */
+    interface SelfManagedLatticeResourceProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-selfmanagedlatticeresource.html#cfn-bedrockagentcore-harness-selfmanagedlatticeresource-resourceconfigurationidentifier
+         */
+        readonly resourceConfigurationIdentifier?: string;
+    }
+    /**
+     * Configuration for a service-managed VPC endpoint.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-managedvpcresource.html
+     */
+    interface ManagedVpcResourceProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-managedvpcresource.html#cfn-bedrockagentcore-harness-managedvpcresource-endpointipaddresstype
+         */
+        readonly endpointIpAddressType?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-managedvpcresource.html#cfn-bedrockagentcore-harness-managedvpcresource-routingdomain
+         */
+        readonly routingDomain?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-managedvpcresource.html#cfn-bedrockagentcore-harness-managedvpcresource-securitygroupids
+         */
+        readonly securityGroupIds?: Array<string>;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-managedvpcresource.html#cfn-bedrockagentcore-harness-managedvpcresource-subnetids
+         */
+        readonly subnetIds?: Array<string>;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-managedvpcresource.html#cfn-bedrockagentcore-harness-managedvpcresource-tags
+         */
+        readonly tags?: Record<string, string>;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-managedvpcresource.html#cfn-bedrockagentcore-harness-managedvpcresource-vpcidentifier
+         */
+        readonly vpcIdentifier?: string;
+    }
+    /**
+     * Maps a domain to a private endpoint for resolving that domain over a private network.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-privateendpointoverride.html
+     */
+    interface PrivateEndpointOverrideProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-privateendpointoverride.html#cfn-bedrockagentcore-harness-privateendpointoverride-domain
+         */
+        readonly domain?: string;
+        /**
+         * Private endpoint configuration for connecting to the OpenID Connect discovery endpoint over a private network.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-privateendpointoverride.html#cfn-bedrockagentcore-harness-privateendpointoverride-privateendpoint
+         */
+        readonly privateEndpoint?: cdk.IResolvable | CfnHarnessPropsMixin.PrivateEndpointProperty;
+    }
     /**
      * @struct
      * @stability external
@@ -2217,6 +2795,10 @@ export declare namespace CfnHarnessPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessmodelconfiguration.html#cfn-bedrockagentcore-harness-harnessmodelconfiguration-geminimodelconfig
          */
         readonly geminiModelConfig?: CfnHarnessPropsMixin.HarnessGeminiModelConfigProperty | cdk.IResolvable;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessmodelconfiguration.html#cfn-bedrockagentcore-harness-harnessmodelconfiguration-litellmmodelconfig
+         */
+        readonly liteLlmModelConfig?: CfnHarnessPropsMixin.HarnessLiteLlmModelConfigProperty | cdk.IResolvable;
         /**
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessmodelconfiguration.html#cfn-bedrockagentcore-harness-harnessmodelconfiguration-openaimodelconfig
          */
@@ -2228,6 +2810,10 @@ export declare namespace CfnHarnessPropsMixin {
      * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessbedrockmodelconfig.html
      */
     interface HarnessBedrockModelConfigProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessbedrockmodelconfig.html#cfn-bedrockagentcore-harness-harnessbedrockmodelconfig-apiformat
+         */
+        readonly apiFormat?: string;
         /**
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessbedrockmodelconfig.html#cfn-bedrockagentcore-harness-harnessbedrockmodelconfig-maxtokens
          */
@@ -2251,6 +2837,10 @@ export declare namespace CfnHarnessPropsMixin {
      * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessopenaimodelconfig.html
      */
     interface HarnessOpenAiModelConfigProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessopenaimodelconfig.html#cfn-bedrockagentcore-harness-harnessopenaimodelconfig-apiformat
+         */
+        readonly apiFormat?: string;
         /**
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessopenaimodelconfig.html#cfn-bedrockagentcore-harness-harnessopenaimodelconfig-apikeyarn
          */
@@ -2303,6 +2893,37 @@ export declare namespace CfnHarnessPropsMixin {
          */
         readonly topP?: number;
     }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesslitellmmodelconfig.html
+     */
+    interface HarnessLiteLlmModelConfigProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesslitellmmodelconfig.html#cfn-bedrockagentcore-harness-harnesslitellmmodelconfig-apibase
+         */
+        readonly apiBase?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesslitellmmodelconfig.html#cfn-bedrockagentcore-harness-harnesslitellmmodelconfig-apikeyarn
+         */
+        readonly apiKeyArn?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesslitellmmodelconfig.html#cfn-bedrockagentcore-harness-harnesslitellmmodelconfig-maxtokens
+         */
+        readonly maxTokens?: number;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesslitellmmodelconfig.html#cfn-bedrockagentcore-harness-harnesslitellmmodelconfig-modelid
+         */
+        readonly modelId?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesslitellmmodelconfig.html#cfn-bedrockagentcore-harness-harnesslitellmmodelconfig-temperature
+         */
+        readonly temperature?: number;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesslitellmmodelconfig.html#cfn-bedrockagentcore-harness-harnesslitellmmodelconfig-topp
+         */
+        readonly topP?: number;
+    }
     /**
      * @struct
      * @stability external
@@ -2483,12 +3104,110 @@ export declare namespace CfnHarnessPropsMixin {
      * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskill.html
      */
     interface HarnessSkillProperty {
+        /**
+         * AWS Skills baked into the Harness's underlying Runtime.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskill.html#cfn-bedrockagentcore-harness-harnessskill-awsskills
+         */
+        readonly awsSkills?: CfnHarnessPropsMixin.HarnessSkillAwsSkillsSourceProperty | cdk.IResolvable;
+        /**
+         * A git repository containing the skill, cloned over HTTPS.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskill.html#cfn-bedrockagentcore-harness-harnessskill-git
+         */
+        readonly git?: CfnHarnessPropsMixin.HarnessSkillGitSourceProperty | cdk.IResolvable;
         /**
          * The filesystem path to the skill definition.
          *
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskill.html#cfn-bedrockagentcore-harness-harnessskill-path
          */
         readonly path?: string;
+        /**
+         * An S3 source containing the skill.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskill.html#cfn-bedrockagentcore-harness-harnessskill-s3
+         */
+        readonly s3?: CfnHarnessPropsMixin.HarnessSkillS3SourceProperty | cdk.IResolvable;
+    }
+    /**
+     * An S3 source containing the skill.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskills3source.html
+     */
+    interface HarnessSkillS3SourceProperty {
+        /**
+         * The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskills3source.html#cfn-bedrockagentcore-harness-harnessskills3source-uri
+         */
+        readonly uri?: string;
+    }
+    /**
+     * A git repository containing the skill, cloned over HTTPS.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskillgitsource.html
+     */
+    interface HarnessSkillGitSourceProperty {
+        /**
+         * Authentication configuration for accessing a private git repository.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskillgitsource.html#cfn-bedrockagentcore-harness-harnessskillgitsource-auth
+         */
+        readonly auth?: CfnHarnessPropsMixin.HarnessSkillGitAuthProperty | cdk.IResolvable;
+        /**
+         * Subdirectory within the repository containing the skill.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskillgitsource.html#cfn-bedrockagentcore-harness-harnessskillgitsource-path
+         */
+        readonly path?: string;
+        /**
+         * The HTTPS URL of the git repository.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskillgitsource.html#cfn-bedrockagentcore-harness-harnessskillgitsource-url
+         */
+        readonly url?: string;
+    }
+    /**
+     * Authentication configuration for accessing a private git repository.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskillgitauth.html
+     */
+    interface HarnessSkillGitAuthProperty {
+        /**
+         * The ARN of the credential in AgentCore Identity containing the password or personal access token.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskillgitauth.html#cfn-bedrockagentcore-harness-harnessskillgitauth-credentialarn
+         */
+        readonly credentialArn?: string;
+        /**
+         * Username for authentication.
+         *
+         * Defaults to 'oauth2' if not specified.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskillgitauth.html#cfn-bedrockagentcore-harness-harnessskillgitauth-username
+         */
+        readonly username?: string;
+    }
+    /**
+     * AWS Skills baked into the Harness's underlying Runtime.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskillawsskillssource.html
+     */
+    interface HarnessSkillAwsSkillsSourceProperty {
+        /**
+         * Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessskillawsskillssource.html#cfn-bedrockagentcore-harness-harnessskillawsskillssource-paths
+         */
+        readonly paths?: Array<string>;
     }
     /**
      * @struct
@@ -2500,6 +3219,20 @@ export declare namespace CfnHarnessPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessmemoryconfiguration.html#cfn-bedrockagentcore-harness-harnessmemoryconfiguration-agentcorememoryconfiguration
          */
         readonly agentCoreMemoryConfiguration?: CfnHarnessPropsMixin.HarnessAgentCoreMemoryConfigurationProperty | cdk.IResolvable;
+        /**
+         * Explicitly opt out of memory.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessmemoryconfiguration.html#cfn-bedrockagentcore-harness-harnessmemoryconfiguration-disabled
+         */
+        readonly disabled?: any | cdk.IResolvable;
+        /**
+         * Configuration for managed memory.
+         *
+         * The harness creates and manages a memory resource in the customer's account.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessmemoryconfiguration.html#cfn-bedrockagentcore-harness-harnessmemoryconfiguration-managedmemoryconfiguration
+         */
+        readonly managedMemoryConfiguration?: CfnHarnessPropsMixin.HarnessManagedMemoryConfigurationProperty | cdk.IResolvable;
     }
     /**
      * @struct
@@ -2533,7 +3266,7 @@ export declare namespace CfnHarnessPropsMixin {
         /**
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessagentcorememoryretrievalconfig.html#cfn-bedrockagentcore-harness-harnessagentcorememoryretrievalconfig-relevancescore
          */
-        readonly relevanceScore?: number;
+        readonly relevanceScore?: cdk.IResolvable | number | string;
         /**
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessagentcorememoryretrievalconfig.html#cfn-bedrockagentcore-harness-harnessagentcorememoryretrievalconfig-strategyid
          */
@@ -2541,28 +3274,71 @@ export declare namespace CfnHarnessPropsMixin {
         /**
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessagentcorememoryretrievalconfig.html#cfn-bedrockagentcore-harness-harnessagentcorememoryretrievalconfig-topk
          */
-        readonly topK?: number;
+        readonly topK?: cdk.IResolvable | number | string;
     }
     /**
+     * Configuration for managed memory.
+     *
+     * The harness creates and manages a memory resource in the customer's account.
+     *
      * @struct
      * @stability external
-     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesstruncationconfiguration.html
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessmanagedmemoryconfiguration.html
      */
-    interface HarnessTruncationConfigurationProperty {
+    interface HarnessManagedMemoryConfigurationProperty {
         /**
-         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesstruncationconfiguration.html#cfn-bedrockagentcore-harness-harnesstruncationconfiguration-config
+         * The ARN of the managed memory resource.
+         *
+         * Read-only, populated by the service.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessmanagedmemoryconfiguration.html#cfn-bedrockagentcore-harness-harnessmanagedmemoryconfiguration-arn
          */
-        readonly config?: CfnHarnessPropsMixin.HarnessTruncationStrategyConfigurationProperty | cdk.IResolvable;
+        readonly arn?: string;
         /**
-         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesstruncationconfiguration.html#cfn-bedrockagentcore-harness-harnesstruncationconfiguration-strategy
+         * Customer-managed KMS key ARN.
+         *
+         * Defaults to AWS-owned key. Not updatable after creation.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessmanagedmemoryconfiguration.html#cfn-bedrockagentcore-harness-harnessmanagedmemoryconfiguration-encryptionkeyarn
          */
-        readonly strategy?: string;
-    }
-    /**
-     * @struct
-     * @stability external
-     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesstruncationstrategyconfiguration.html
-     */
+        readonly encryptionKeyArn?: string;
+        /**
+         * Event retention in days.
+         *
+         * Defaults to 30.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessmanagedmemoryconfiguration.html#cfn-bedrockagentcore-harness-harnessmanagedmemoryconfiguration-eventexpiryduration
+         */
+        readonly eventExpiryDuration?: number;
+        /**
+         * Strategy types to enable.
+         *
+         * Defaults to [SEMANTIC, SUMMARIZATION].
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnessmanagedmemoryconfiguration.html#cfn-bedrockagentcore-harness-harnessmanagedmemoryconfiguration-strategies
+         */
+        readonly strategies?: Array<string>;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesstruncationconfiguration.html
+     */
+    interface HarnessTruncationConfigurationProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesstruncationconfiguration.html#cfn-bedrockagentcore-harness-harnesstruncationconfiguration-config
+         */
+        readonly config?: CfnHarnessPropsMixin.HarnessTruncationStrategyConfigurationProperty | cdk.IResolvable;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesstruncationconfiguration.html#cfn-bedrockagentcore-harness-harnesstruncationconfiguration-strategy
+         */
+        readonly strategy?: string;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesstruncationstrategyconfiguration.html
+     */
     interface HarnessTruncationStrategyConfigurationProperty {
         /**
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-harness-harnesstruncationstrategyconfiguration.html#cfn-bedrockagentcore-harness-harnesstruncationstrategyconfiguration-slidingwindow
@@ -3911,6 +4687,12 @@ export declare namespace CfnOAuth2CredentialProviderPropsMixin {
      * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-customoauth2providerconfiginput.html
      */
     interface CustomOauth2ProviderConfigInputProperty {
+        /**
+         * The client authentication method to use when authenticating with the token endpoint.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-customoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-customoauth2providerconfiginput-clientauthenticationmethod
+         */
+        readonly clientAuthenticationMethod?: string;
         /**
          * The client ID for the custom OAuth2 provider.
          *
@@ -3923,6 +4705,18 @@ export declare namespace CfnOAuth2CredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-customoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-customoauth2providerconfiginput-clientsecret
          */
         readonly clientSecret?: string;
+        /**
+         * A reference to a customer-provided secret stored in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-customoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-customoauth2providerconfiginput-clientsecretconfig
+         */
+        readonly clientSecretConfig?: cdk.IResolvable | CfnOAuth2CredentialProviderPropsMixin.SecretReferenceProperty;
+        /**
+         * The source of the client secret.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-customoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-customoauth2providerconfiginput-clientsecretsource
+         */
+        readonly clientSecretSource?: string;
         /**
          * Discovery information for an OAuth2 provider.
          *
@@ -3990,6 +4784,27 @@ export declare namespace CfnOAuth2CredentialProviderPropsMixin {
          */
         readonly tokenEndpoint?: string;
     }
+    /**
+     * A reference to a customer-provided secret stored in AWS Secrets Manager.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-secretreference.html
+     */
+    interface SecretReferenceProperty {
+        /**
+         * The JSON key within the secret that contains the credential value.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-secretreference.html#cfn-bedrockagentcore-oauth2credentialprovider-secretreference-jsonkey
+         */
+        readonly jsonKey?: string;
+        /**
+         * The ID or ARN of the secret in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-secretreference.html#cfn-bedrockagentcore-oauth2credentialprovider-secretreference-secretid
+         */
+        readonly secretId?: string;
+    }
     /**
      * Configuration for on-behalf-of token exchange.
      *
@@ -4050,6 +4865,16 @@ export declare namespace CfnOAuth2CredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-googleoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-googleoauth2providerconfiginput-clientsecret
          */
         readonly clientSecret?: string;
+        /**
+         * A reference to a customer-provided secret stored in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-googleoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-googleoauth2providerconfiginput-clientsecretconfig
+         */
+        readonly clientSecretConfig?: cdk.IResolvable | CfnOAuth2CredentialProviderPropsMixin.SecretReferenceProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-googleoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-googleoauth2providerconfiginput-clientsecretsource
+         */
+        readonly clientSecretSource?: string;
     }
     /**
      * Input configuration for a GitHub OAuth2 provider.
@@ -4067,6 +4892,16 @@ export declare namespace CfnOAuth2CredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-githuboauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-githuboauth2providerconfiginput-clientsecret
          */
         readonly clientSecret?: string;
+        /**
+         * A reference to a customer-provided secret stored in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-githuboauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-githuboauth2providerconfiginput-clientsecretconfig
+         */
+        readonly clientSecretConfig?: cdk.IResolvable | CfnOAuth2CredentialProviderPropsMixin.SecretReferenceProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-githuboauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-githuboauth2providerconfiginput-clientsecretsource
+         */
+        readonly clientSecretSource?: string;
     }
     /**
      * Input configuration for a Slack OAuth2 provider.
@@ -4084,6 +4919,16 @@ export declare namespace CfnOAuth2CredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-slackoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-slackoauth2providerconfiginput-clientsecret
          */
         readonly clientSecret?: string;
+        /**
+         * A reference to a customer-provided secret stored in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-slackoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-slackoauth2providerconfiginput-clientsecretconfig
+         */
+        readonly clientSecretConfig?: cdk.IResolvable | CfnOAuth2CredentialProviderPropsMixin.SecretReferenceProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-slackoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-slackoauth2providerconfiginput-clientsecretsource
+         */
+        readonly clientSecretSource?: string;
     }
     /**
      * Input configuration for a Salesforce OAuth2 provider.
@@ -4101,6 +4946,16 @@ export declare namespace CfnOAuth2CredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-salesforceoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-salesforceoauth2providerconfiginput-clientsecret
          */
         readonly clientSecret?: string;
+        /**
+         * A reference to a customer-provided secret stored in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-salesforceoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-salesforceoauth2providerconfiginput-clientsecretconfig
+         */
+        readonly clientSecretConfig?: cdk.IResolvable | CfnOAuth2CredentialProviderPropsMixin.SecretReferenceProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-salesforceoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-salesforceoauth2providerconfiginput-clientsecretsource
+         */
+        readonly clientSecretSource?: string;
     }
     /**
      * Input configuration for a Microsoft OAuth2 provider.
@@ -4118,6 +4973,16 @@ export declare namespace CfnOAuth2CredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-microsoftoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-microsoftoauth2providerconfiginput-clientsecret
          */
         readonly clientSecret?: string;
+        /**
+         * A reference to a customer-provided secret stored in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-microsoftoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-microsoftoauth2providerconfiginput-clientsecretconfig
+         */
+        readonly clientSecretConfig?: cdk.IResolvable | CfnOAuth2CredentialProviderPropsMixin.SecretReferenceProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-microsoftoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-microsoftoauth2providerconfiginput-clientsecretsource
+         */
+        readonly clientSecretSource?: string;
         /**
          * The Microsoft Entra ID tenant ID.
          *
@@ -4141,6 +5006,16 @@ export declare namespace CfnOAuth2CredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-atlassianoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-atlassianoauth2providerconfiginput-clientsecret
          */
         readonly clientSecret?: string;
+        /**
+         * A reference to a customer-provided secret stored in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-atlassianoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-atlassianoauth2providerconfiginput-clientsecretconfig
+         */
+        readonly clientSecretConfig?: cdk.IResolvable | CfnOAuth2CredentialProviderPropsMixin.SecretReferenceProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-atlassianoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-atlassianoauth2providerconfiginput-clientsecretsource
+         */
+        readonly clientSecretSource?: string;
     }
     /**
      * Input configuration for a LinkedIn OAuth2 provider.
@@ -4158,6 +5033,16 @@ export declare namespace CfnOAuth2CredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-linkedinoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-linkedinoauth2providerconfiginput-clientsecret
          */
         readonly clientSecret?: string;
+        /**
+         * A reference to a customer-provided secret stored in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-linkedinoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-linkedinoauth2providerconfiginput-clientsecretconfig
+         */
+        readonly clientSecretConfig?: cdk.IResolvable | CfnOAuth2CredentialProviderPropsMixin.SecretReferenceProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-linkedinoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-linkedinoauth2providerconfiginput-clientsecretsource
+         */
+        readonly clientSecretSource?: string;
     }
     /**
      * Input configuration for a supported non-custom OAuth2 provider.
@@ -4181,6 +5066,16 @@ export declare namespace CfnOAuth2CredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-includedoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-includedoauth2providerconfiginput-clientsecret
          */
         readonly clientSecret?: string;
+        /**
+         * A reference to a customer-provided secret stored in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-includedoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-includedoauth2providerconfiginput-clientsecretconfig
+         */
+        readonly clientSecretConfig?: cdk.IResolvable | CfnOAuth2CredentialProviderPropsMixin.SecretReferenceProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-includedoauth2providerconfiginput.html#cfn-bedrockagentcore-oauth2credentialprovider-includedoauth2providerconfiginput-clientsecretsource
+         */
+        readonly clientSecretSource?: string;
         /**
          * Token issuer of your isolated OAuth2 application tenant.
          *
@@ -4217,6 +5112,12 @@ export declare namespace CfnOAuth2CredentialProviderPropsMixin {
      * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-oauth2providerconfigoutput.html
      */
     interface Oauth2ProviderConfigOutputProperty {
+        /**
+         * The client authentication method used when authenticating with the token endpoint.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-oauth2providerconfigoutput.html#cfn-bedrockagentcore-oauth2credentialprovider-oauth2providerconfigoutput-clientauthenticationmethod
+         */
+        readonly clientAuthenticationMethod?: string;
         /**
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-oauth2credentialprovider-oauth2providerconfigoutput.html#cfn-bedrockagentcore-oauth2credentialprovider-oauth2providerconfigoutput-clientid
          */
@@ -4459,6 +5360,36 @@ export declare namespace CfnOnlineEvaluationConfigPropsMixin {
          */
         readonly sessionTimeoutMinutes?: number;
     }
+    /**
+     * An insight configuration for failure analysis.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-onlineevaluationconfig-insight.html
+     */
+    interface InsightProperty {
+        /**
+         * The unique identifier of the insight.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-onlineevaluationconfig-insight.html#cfn-bedrockagentcore-onlineevaluationconfig-insight-insightid
+         */
+        readonly insightId?: string;
+    }
+    /**
+     * The configuration for clustering analysis of evaluation results.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-onlineevaluationconfig-clusteringconfig.html
+     */
+    interface ClusteringConfigProperty {
+        /**
+         * The list of frequencies at which clustering reports are generated.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-onlineevaluationconfig-clusteringconfig.html#cfn-bedrockagentcore-onlineevaluationconfig-clusteringconfig-frequencies
+         */
+        readonly frequencies?: Array<string>;
+    }
     /**
      * The configuration that specifies where evaluation results should be written.
      *
@@ -4498,6 +5429,12 @@ export declare namespace CfnOnlineEvaluationConfigPropsMixin {
  * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-onlineevaluationconfig.html
  */
 export interface CfnOnlineEvaluationConfigMixinProps {
+    /**
+     * The configuration for clustering analysis of evaluation results.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-onlineevaluationconfig.html#cfn-bedrockagentcore-onlineevaluationconfig-clusteringconfig
+     */
+    readonly clusteringConfig?: CfnOnlineEvaluationConfigPropsMixin.ClusteringConfigProperty | cdk.IResolvable;
     /**
      * The configuration that specifies where to read agent traces for online evaluation.
      *
@@ -4526,6 +5463,12 @@ export interface CfnOnlineEvaluationConfigMixinProps {
      * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-onlineevaluationconfig.html#cfn-bedrockagentcore-onlineevaluationconfig-executionstatus
      */
     readonly executionStatus?: string;
+    /**
+     * The list of insights to enable for failure analysis.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-onlineevaluationconfig.html#cfn-bedrockagentcore-onlineevaluationconfig-insights
+     */
+    readonly insights?: Array<CfnOnlineEvaluationConfigPropsMixin.InsightProperty | cdk.IResolvable> | cdk.IResolvable;
     /**
      * The name of the online evaluation configuration.
      *
@@ -4547,6 +5490,101 @@ export interface CfnOnlineEvaluationConfigMixinProps {
      */
     readonly tags?: Array<cdk.CfnTag>;
 }
+/**
+ * Resource Type definition for AWS::BedrockAgentCore::PaymentConnector.
+ *
+ * @cloudformationResource AWS::BedrockAgentCore::PaymentConnector
+ * @mixin true
+ * @stability external
+ * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentconnector.html
+ */
+export declare class CfnPaymentConnectorPropsMixin extends cdk.Mixin implements constructs.IMixin {
+    protected static readonly CFN_PROPERTY_KEYS: Array<string>;
+    protected readonly props: CfnPaymentConnectorMixinProps;
+    protected readonly strategy: cdk.IMergeStrategy;
+    /**
+     * Create a mixin to apply properties to `AWS::BedrockAgentCore::PaymentConnector`.
+     *
+     * @param props L1 properties to apply
+     * @param options Mixin options
+     */
+    constructor(props: CfnPaymentConnectorMixinProps, options?: mixins.CfnPropertyMixinOptions);
+    /**
+     * Check if this mixin supports the given construct
+     */
+    supports(construct: constructs.IConstruct): construct is service.CfnPaymentConnector;
+    /**
+     * Apply the mixin properties to the construct
+     */
+    applyTo(construct: constructs.IConstruct): void;
+}
+export declare namespace CfnPaymentConnectorPropsMixin {
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentconnector-credentialsproviderconfiguration.html
+     */
+    interface CredentialsProviderConfigurationProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentconnector-credentialsproviderconfiguration.html#cfn-bedrockagentcore-paymentconnector-credentialsproviderconfiguration-coinbasecdp
+         */
+        readonly coinbaseCdp?: cdk.IResolvable | CfnPaymentConnectorPropsMixin.PaymentCredentialProviderConfigurationProperty;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentconnector-credentialsproviderconfiguration.html#cfn-bedrockagentcore-paymentconnector-credentialsproviderconfiguration-stripeprivy
+         */
+        readonly stripePrivy?: cdk.IResolvable | CfnPaymentConnectorPropsMixin.PaymentCredentialProviderConfigurationProperty;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentconnector-paymentcredentialproviderconfiguration.html
+     */
+    interface PaymentCredentialProviderConfigurationProperty {
+        /**
+         * The ARN of the payment credential provider.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentconnector-paymentcredentialproviderconfiguration.html#cfn-bedrockagentcore-paymentconnector-paymentcredentialproviderconfiguration-credentialproviderarn
+         */
+        readonly credentialProviderArn?: string;
+    }
+}
+/**
+ * Properties for CfnPaymentConnectorPropsMixin
+ *
+ * @struct
+ * @stability external
+ * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentconnector.html
+ */
+export interface CfnPaymentConnectorMixinProps {
+    /**
+     * The name of the payment connector.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentconnector.html#cfn-bedrockagentcore-paymentconnector-connectorname
+     */
+    readonly connectorName?: string;
+    /**
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentconnector.html#cfn-bedrockagentcore-paymentconnector-connectortype
+     */
+    readonly connectorType?: string;
+    /**
+     * The credential provider configurations for the connector.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentconnector.html#cfn-bedrockagentcore-paymentconnector-credentialproviderconfigurations
+     */
+    readonly credentialProviderConfigurations?: Array<CfnPaymentConnectorPropsMixin.CredentialsProviderConfigurationProperty | cdk.IResolvable> | cdk.IResolvable;
+    /**
+     * A description of the payment connector.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentconnector.html#cfn-bedrockagentcore-paymentconnector-description
+     */
+    readonly description?: string;
+    /**
+     * The identifier of the parent payment manager.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentconnector.html#cfn-bedrockagentcore-paymentconnector-paymentmanagerid
+     */
+    readonly paymentManagerId?: string;
+}
 /**
  * Resource Type definition for AWS::BedrockAgentCore::PaymentCredentialProvider.
  *
@@ -4617,12 +5655,61 @@ export declare namespace CfnPaymentCredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationinput.html#cfn-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationinput-apikeysecret
          */
         readonly apiKeySecret?: string;
+        /**
+         * A reference to a customer-provided secret stored in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationinput.html#cfn-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationinput-apikeysecretconfig
+         */
+        readonly apiKeySecretConfig?: cdk.IResolvable | CfnPaymentCredentialProviderPropsMixin.SecretReferenceProperty;
+        /**
+         * The source of the secret.
+         *
+         * Use MANAGED for service-managed secrets or EXTERNAL for customer-provided secrets.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationinput.html#cfn-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationinput-apikeysecretsource
+         */
+        readonly apiKeySecretSource?: string;
         /**
          * The Coinbase CDP wallet secret.
          *
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationinput.html#cfn-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationinput-walletsecret
          */
         readonly walletSecret?: string;
+        /**
+         * A reference to a customer-provided secret stored in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationinput.html#cfn-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationinput-walletsecretconfig
+         */
+        readonly walletSecretConfig?: cdk.IResolvable | CfnPaymentCredentialProviderPropsMixin.SecretReferenceProperty;
+        /**
+         * The source of the secret.
+         *
+         * Use MANAGED for service-managed secrets or EXTERNAL for customer-provided secrets.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationinput.html#cfn-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationinput-walletsecretsource
+         */
+        readonly walletSecretSource?: string;
+    }
+    /**
+     * A reference to a customer-provided secret stored in AWS Secrets Manager.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-secretreference.html
+     */
+    interface SecretReferenceProperty {
+        /**
+         * The JSON key within the secret that contains the credential value.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-secretreference.html#cfn-bedrockagentcore-paymentcredentialprovider-secretreference-jsonkey
+         */
+        readonly jsonKey?: string;
+        /**
+         * The ID or ARN of the secret in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-secretreference.html#cfn-bedrockagentcore-paymentcredentialprovider-secretreference-secretid
+         */
+        readonly secretId?: string;
     }
     /**
      * Stripe Privy configuration with credentials.
@@ -4644,6 +5731,20 @@ export declare namespace CfnPaymentCredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationinput.html#cfn-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationinput-appsecret
          */
         readonly appSecret?: string;
+        /**
+         * A reference to a customer-provided secret stored in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationinput.html#cfn-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationinput-appsecretconfig
+         */
+        readonly appSecretConfig?: cdk.IResolvable | CfnPaymentCredentialProviderPropsMixin.SecretReferenceProperty;
+        /**
+         * The source of the secret.
+         *
+         * Use MANAGED for service-managed secrets or EXTERNAL for customer-provided secrets.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationinput.html#cfn-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationinput-appsecretsource
+         */
+        readonly appSecretSource?: string;
         /**
          * The authorization ID for the Stripe Privy integration.
          *
@@ -4656,6 +5757,20 @@ export declare namespace CfnPaymentCredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationinput.html#cfn-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationinput-authorizationprivatekey
          */
         readonly authorizationPrivateKey?: string;
+        /**
+         * A reference to a customer-provided secret stored in AWS Secrets Manager.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationinput.html#cfn-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationinput-authorizationprivatekeyconfig
+         */
+        readonly authorizationPrivateKeyConfig?: cdk.IResolvable | CfnPaymentCredentialProviderPropsMixin.SecretReferenceProperty;
+        /**
+         * The source of the secret.
+         *
+         * Use MANAGED for service-managed secrets or EXTERNAL for customer-provided secrets.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationinput.html#cfn-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationinput-authorizationprivatekeysource
+         */
+        readonly authorizationPrivateKeySource?: string;
     }
     /**
      * Provider configuration output containing secret ARNs (no raw secrets).
@@ -4698,12 +5813,40 @@ export declare namespace CfnPaymentCredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationoutput.html#cfn-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationoutput-apikeysecretarn
          */
         readonly apiKeySecretArn?: cdk.IResolvable | CfnPaymentCredentialProviderPropsMixin.SecretInfoProperty;
+        /**
+         * The JSON key within the secret that contains the API key secret value.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationoutput.html#cfn-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationoutput-apikeysecretjsonkey
+         */
+        readonly apiKeySecretJsonKey?: string;
+        /**
+         * The source of the secret.
+         *
+         * Use MANAGED for service-managed secrets or EXTERNAL for customer-provided secrets.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationoutput.html#cfn-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationoutput-apikeysecretsource
+         */
+        readonly apiKeySecretSource?: string;
         /**
          * Contains information about a secret in AWS Secrets Manager.
          *
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationoutput.html#cfn-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationoutput-walletsecretarn
          */
         readonly walletSecretArn?: cdk.IResolvable | CfnPaymentCredentialProviderPropsMixin.SecretInfoProperty;
+        /**
+         * The JSON key within the secret that contains the wallet secret value.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationoutput.html#cfn-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationoutput-walletsecretjsonkey
+         */
+        readonly walletSecretJsonKey?: string;
+        /**
+         * The source of the secret.
+         *
+         * Use MANAGED for service-managed secrets or EXTERNAL for customer-provided secrets.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationoutput.html#cfn-bedrockagentcore-paymentcredentialprovider-coinbasecdpconfigurationoutput-walletsecretsource
+         */
+        readonly walletSecretSource?: string;
     }
     /**
      * Contains information about a secret in AWS Secrets Manager.
@@ -4740,6 +5883,20 @@ export declare namespace CfnPaymentCredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationoutput.html#cfn-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationoutput-appsecretarn
          */
         readonly appSecretArn?: cdk.IResolvable | CfnPaymentCredentialProviderPropsMixin.SecretInfoProperty;
+        /**
+         * The JSON key within the secret that contains the app secret value.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationoutput.html#cfn-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationoutput-appsecretjsonkey
+         */
+        readonly appSecretJsonKey?: string;
+        /**
+         * The source of the secret.
+         *
+         * Use MANAGED for service-managed secrets or EXTERNAL for customer-provided secrets.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationoutput.html#cfn-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationoutput-appsecretsource
+         */
+        readonly appSecretSource?: string;
         /**
          * The authorization ID for the Stripe Privy integration.
          *
@@ -4752,6 +5909,20 @@ export declare namespace CfnPaymentCredentialProviderPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationoutput.html#cfn-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationoutput-authorizationprivatekeyarn
          */
         readonly authorizationPrivateKeyArn?: cdk.IResolvable | CfnPaymentCredentialProviderPropsMixin.SecretInfoProperty;
+        /**
+         * The JSON key within the secret that contains the authorization private key value.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationoutput.html#cfn-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationoutput-authorizationprivatekeyjsonkey
+         */
+        readonly authorizationPrivateKeyJsonKey?: string;
+        /**
+         * The source of the secret.
+         *
+         * Use MANAGED for service-managed secrets or EXTERNAL for customer-provided secrets.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationoutput.html#cfn-bedrockagentcore-paymentcredentialprovider-stripeprivyconfigurationoutput-authorizationprivatekeysource
+         */
+        readonly authorizationPrivateKeySource?: string;
     }
 }
 /**
@@ -4787,6 +5958,175 @@ export interface CfnPaymentCredentialProviderMixinProps {
      */
     readonly tags?: Array<cdk.CfnTag>;
 }
+/**
+ * Resource Type definition for AWS::BedrockAgentCore::PaymentManager.
+ *
+ * @cloudformationResource AWS::BedrockAgentCore::PaymentManager
+ * @mixin true
+ * @stability external
+ * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentmanager.html
+ */
+export declare class CfnPaymentManagerPropsMixin extends cdk.Mixin implements constructs.IMixin {
+    protected static readonly CFN_PROPERTY_KEYS: Array<string>;
+    protected readonly props: CfnPaymentManagerMixinProps;
+    protected readonly strategy: cdk.IMergeStrategy;
+    /**
+     * Create a mixin to apply properties to `AWS::BedrockAgentCore::PaymentManager`.
+     *
+     * @param props L1 properties to apply
+     * @param options Mixin options
+     */
+    constructor(props: CfnPaymentManagerMixinProps, options?: mixins.CfnPropertyMixinOptions);
+    /**
+     * Check if this mixin supports the given construct
+     */
+    supports(construct: constructs.IConstruct): construct is service.CfnPaymentManager;
+    /**
+     * Apply the mixin properties to the construct
+     */
+    applyTo(construct: constructs.IConstruct): void;
+}
+export declare namespace CfnPaymentManagerPropsMixin {
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-authorizerconfiguration.html
+     */
+    interface AuthorizerConfigurationProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-authorizerconfiguration.html#cfn-bedrockagentcore-paymentmanager-authorizerconfiguration-customjwtauthorizer
+         */
+        readonly customJwtAuthorizer?: CfnPaymentManagerPropsMixin.CustomJWTAuthorizerConfigurationProperty | cdk.IResolvable;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-customjwtauthorizerconfiguration.html
+     */
+    interface CustomJWTAuthorizerConfigurationProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-customjwtauthorizerconfiguration.html#cfn-bedrockagentcore-paymentmanager-customjwtauthorizerconfiguration-allowedaudience
+         */
+        readonly allowedAudience?: Array<string>;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-customjwtauthorizerconfiguration.html#cfn-bedrockagentcore-paymentmanager-customjwtauthorizerconfiguration-allowedclients
+         */
+        readonly allowedClients?: Array<string>;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-customjwtauthorizerconfiguration.html#cfn-bedrockagentcore-paymentmanager-customjwtauthorizerconfiguration-allowedscopes
+         */
+        readonly allowedScopes?: Array<string>;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-customjwtauthorizerconfiguration.html#cfn-bedrockagentcore-paymentmanager-customjwtauthorizerconfiguration-customclaims
+         */
+        readonly customClaims?: Array<CfnPaymentManagerPropsMixin.CustomClaimValidationTypeProperty | cdk.IResolvable> | cdk.IResolvable;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-customjwtauthorizerconfiguration.html#cfn-bedrockagentcore-paymentmanager-customjwtauthorizerconfiguration-discoveryurl
+         */
+        readonly discoveryUrl?: string;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-customclaimvalidationtype.html
+     */
+    interface CustomClaimValidationTypeProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-customclaimvalidationtype.html#cfn-bedrockagentcore-paymentmanager-customclaimvalidationtype-authorizingclaimmatchvalue
+         */
+        readonly authorizingClaimMatchValue?: CfnPaymentManagerPropsMixin.AuthorizingClaimMatchValueTypeProperty | cdk.IResolvable;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-customclaimvalidationtype.html#cfn-bedrockagentcore-paymentmanager-customclaimvalidationtype-inboundtokenclaimname
+         */
+        readonly inboundTokenClaimName?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-customclaimvalidationtype.html#cfn-bedrockagentcore-paymentmanager-customclaimvalidationtype-inboundtokenclaimvaluetype
+         */
+        readonly inboundTokenClaimValueType?: string;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-authorizingclaimmatchvaluetype.html
+     */
+    interface AuthorizingClaimMatchValueTypeProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-authorizingclaimmatchvaluetype.html#cfn-bedrockagentcore-paymentmanager-authorizingclaimmatchvaluetype-claimmatchoperator
+         */
+        readonly claimMatchOperator?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-authorizingclaimmatchvaluetype.html#cfn-bedrockagentcore-paymentmanager-authorizingclaimmatchvaluetype-claimmatchvalue
+         */
+        readonly claimMatchValue?: CfnPaymentManagerPropsMixin.ClaimMatchValueTypeProperty | cdk.IResolvable;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-claimmatchvaluetype.html
+     */
+    interface ClaimMatchValueTypeProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-claimmatchvaluetype.html#cfn-bedrockagentcore-paymentmanager-claimmatchvaluetype-matchvaluestring
+         */
+        readonly matchValueString?: string;
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-claimmatchvaluetype.html#cfn-bedrockagentcore-paymentmanager-claimmatchvaluetype-matchvaluestringlist
+         */
+        readonly matchValueStringList?: Array<string>;
+    }
+    /**
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-workloadidentitydetails.html
+     */
+    interface WorkloadIdentityDetailsProperty {
+        /**
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-paymentmanager-workloadidentitydetails.html#cfn-bedrockagentcore-paymentmanager-workloadidentitydetails-workloadidentityarn
+         */
+        readonly workloadIdentityArn?: string;
+    }
+}
+/**
+ * Properties for CfnPaymentManagerPropsMixin
+ *
+ * @struct
+ * @stability external
+ * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentmanager.html
+ */
+export interface CfnPaymentManagerMixinProps {
+    /**
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentmanager.html#cfn-bedrockagentcore-paymentmanager-authorizerconfiguration
+     */
+    readonly authorizerConfiguration?: CfnPaymentManagerPropsMixin.AuthorizerConfigurationProperty | cdk.IResolvable;
+    /**
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentmanager.html#cfn-bedrockagentcore-paymentmanager-authorizertype
+     */
+    readonly authorizerType?: string;
+    /**
+     * A description of the payment manager.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentmanager.html#cfn-bedrockagentcore-paymentmanager-description
+     */
+    readonly description?: string;
+    /**
+     * The name of the payment manager.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentmanager.html#cfn-bedrockagentcore-paymentmanager-name
+     */
+    readonly name?: string;
+    /**
+     * The ARN of the IAM role for the payment manager.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentmanager.html#cfn-bedrockagentcore-paymentmanager-rolearn
+     */
+    readonly roleArn?: string;
+    /**
+     * Tags to assign to the payment manager.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-paymentmanager.html#cfn-bedrockagentcore-paymentmanager-tags
+     */
+    readonly tags?: Array<cdk.CfnTag>;
+}
 /**
  * Resource Type definition for AWS::BedrockAgentCore::Policy.
  *
@@ -4832,6 +6172,12 @@ export declare namespace CfnPolicyPropsMixin {
          * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-policy-policydefinition.html#cfn-bedrockagentcore-policy-policydefinition-cedar
          */
         readonly cedar?: CfnPolicyPropsMixin.CedarPolicyProperty | cdk.IResolvable;
+        /**
+         * A policy statement within the AgentCore Policy system.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-policy-policydefinition.html#cfn-bedrockagentcore-policy-policydefinition-policy
+         */
+        readonly policy?: cdk.IResolvable | CfnPolicyPropsMixin.PolicyStatementProperty;
     }
     /**
      * A Cedar policy statement within the AgentCore Policy system.
@@ -4848,6 +6194,21 @@ export declare namespace CfnPolicyPropsMixin {
          */
         readonly statement?: string;
     }
+    /**
+     * A policy statement within the AgentCore Policy system.
+     *
+     * @struct
+     * @stability external
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-policy-policystatement.html
+     */
+    interface PolicyStatementProperty {
+        /**
+         * The policy statement.
+         *
+         * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-policy-policystatement.html#cfn-bedrockagentcore-policy-policystatement-statement
+         */
+        readonly statement?: string;
+    }
 }
 /**
  * Properties for CfnPolicyPropsMixin
@@ -4871,6 +6232,15 @@ export interface CfnPolicyMixinProps {
      * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-policy.html#cfn-bedrockagentcore-policy-description
      */
     readonly description?: string;
+    /**
+     * Whether the policy contributes to the enforce decision returned to Gateway.
+     *
+     * LOG_ONLY policies are still evaluated but their decisions are observed only, allowing customers to validate a policy against real traffic before promoting it.
+     *
+     * @default - "ACTIVE"
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-policy.html#cfn-bedrockagentcore-policy-enforcementmode
+     */
+    readonly enforcementMode?: string;
     /**
      * The customer-assigned immutable name for the policy.
      *
@@ -4955,6 +6325,55 @@ export interface CfnPolicyEngineMixinProps {
      */
     readonly tags?: Array<cdk.CfnTag>;
 }
+/**
+ * Resource Type definition for AWS::BedrockAgentCore::ResourcePolicy.
+ *
+ * @cloudformationResource AWS::BedrockAgentCore::ResourcePolicy
+ * @mixin true
+ * @stability external
+ * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-resourcepolicy.html
+ */
+export declare class CfnResourcePolicyPropsMixin extends cdk.Mixin implements constructs.IMixin {
+    protected static readonly CFN_PROPERTY_KEYS: Array<string>;
+    protected readonly props: CfnResourcePolicyMixinProps;
+    protected readonly strategy: cdk.IMergeStrategy;
+    /**
+     * Create a mixin to apply properties to `AWS::BedrockAgentCore::ResourcePolicy`.
+     *
+     * @param props L1 properties to apply
+     * @param options Mixin options
+     */
+    constructor(props: CfnResourcePolicyMixinProps, options?: mixins.CfnPropertyMixinOptions);
+    /**
+     * Check if this mixin supports the given construct
+     */
+    supports(construct: constructs.IConstruct): construct is service.CfnResourcePolicy;
+    /**
+     * Apply the mixin properties to the construct
+     */
+    applyTo(construct: constructs.IConstruct): void;
+}
+/**
+ * Properties for CfnResourcePolicyPropsMixin
+ *
+ * @struct
+ * @stability external
+ * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-resourcepolicy.html
+ */
+export interface CfnResourcePolicyMixinProps {
+    /**
+     * The resource policy to create or update.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-resourcepolicy.html#cfn-bedrockagentcore-resourcepolicy-policy
+     */
+    readonly policy?: string;
+    /**
+     * The Amazon Resource Name (ARN) of the resource for which to create or update the resource policy.
+     *
+     * @see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-resourcepolicy.html#cfn-bedrockagentcore-resourcepolicy-resourcearn
+     */
+    readonly resourceArn?: string;
+}
 /**
  * Contains information about an agent runtime. An agent runtime is the execution environment for a Amazon Bedrock Agent.
  *