Package com.pulumi.aws.bedrock

Class AgentcoreGateway

  • public class AgentcoreGateway
extends com.pulumi.resources.CustomResource
    Manages an AWS Bedrock AgentCore Gateway. With Gateway, developers can convert APIs, Lambda functions, and existing services into Model Context Protocol (MCP)-compatible tools. ## Example Usage ### Gateway with JWT Authorization 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.iam.IamFunctions;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
 import com.pulumi.aws.iam.Role;
 import com.pulumi.aws.iam.RoleArgs;
 import com.pulumi.aws.bedrock.AgentcoreGateway;
 import com.pulumi.aws.bedrock.AgentcoreGatewayArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreGatewayAuthorizerConfigurationArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreGatewayAuthorizerConfigurationCustomJwtAuthorizerArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         final var assumeRole = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                     .type("Service")
                     .identifiers("bedrock-agentcore.amazonaws.com")
                     .build())
                 .effect("Allow")
                 .actions("sts:AssumeRole")
                 .build())
             .build());
 
         var example = new Role("example", RoleArgs.builder()
             .name("bedrock-agentcore-gateway-role")
             .assumeRolePolicy(assumeRole.json())
             .build());
 
         var exampleAgentcoreGateway = new AgentcoreGateway("exampleAgentcoreGateway", AgentcoreGatewayArgs.builder()
             .authorizerConfiguration(AgentcoreGatewayAuthorizerConfigurationArgs.builder()
                 .customJwtAuthorizer(AgentcoreGatewayAuthorizerConfigurationCustomJwtAuthorizerArgs.builder()
                     .discoveryUrl("https://accounts.google.com/.well-known/openid-configuration")
                     .allowedAudiences(                    
                         "test1",
                         "test2")
                     .build())
                 .build())
             .name("example-gateway")
             .roleArn(example.arn())
             .authorizerType("CUSTOM_JWT")
             .protocolType("MCP")
             .build());
 
     }
 }
    ### Gateway with advanced JWT Authorization and MCP Configuration 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.bedrock.AgentcoreGateway;
 import com.pulumi.aws.bedrock.AgentcoreGatewayArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreGatewayAuthorizerConfigurationArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreGatewayAuthorizerConfigurationCustomJwtAuthorizerArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreGatewayProtocolConfigurationArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreGatewayProtocolConfigurationMcpArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new AgentcoreGateway("example", AgentcoreGatewayArgs.builder()
             .authorizerConfiguration(AgentcoreGatewayAuthorizerConfigurationArgs.builder()
                 .customJwtAuthorizer(AgentcoreGatewayAuthorizerConfigurationCustomJwtAuthorizerArgs.builder()
                     .discoveryUrl("https://auth.example.com/.well-known/openid-configuration")
                     .allowedAudiences(                    
                         "app-client",
                         "web-client")
                     .allowedClients(                    
                         "client-123",
                         "client-456")
                     .allowedScopes(                    
                         "openid",
                         "email")
                     .build())
                 .build())
             .protocolConfiguration(AgentcoreGatewayProtocolConfigurationArgs.builder()
                 .mcp(AgentcoreGatewayProtocolConfigurationMcpArgs.builder()
                     .instructions("Gateway for handling MCP requests")
                     .searchType("SEMANTIC")
                     .supportedVersions(                    
                         "2025-03-26",
                         "2025-06-18")
                     .build())
                 .build())
             .name("mcp-gateway")
             .description("Gateway for MCP communication")
             .roleArn(exampleAwsIamRole.arn())
             .authorizerType("CUSTOM_JWT")
             .protocolType("MCP")
             .build());
 
     }
 }
    ### Gateway with Interceptor Configuration 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.bedrock.AgentcoreGateway;
 import com.pulumi.aws.bedrock.AgentcoreGatewayArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreGatewayInterceptorConfigurationArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreGatewayInterceptorConfigurationInterceptorArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreGatewayInterceptorConfigurationInterceptorLambdaArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreGatewayInterceptorConfigurationInputConfigurationArgs;
 import com.pulumi.asset.FileArchive;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var interceptor = new Function("interceptor", FunctionArgs.builder()
             .code(new FileArchive("interceptor.zip"))
             .name("gateway-interceptor")
             .role(lambda.arn())
             .handler("index.handler")
             .runtime("python3.12")
             .build());
 
         var example = new AgentcoreGateway("example", AgentcoreGatewayArgs.builder()
             .interceptorConfigurations(AgentcoreGatewayInterceptorConfigurationArgs.builder()
                 .interceptor(AgentcoreGatewayInterceptorConfigurationInterceptorArgs.builder()
                     .lambda(AgentcoreGatewayInterceptorConfigurationInterceptorLambdaArgs.builder()
                         .arn(interceptor.arn())
                         .build())
                     .build())
                 .inputConfiguration(AgentcoreGatewayInterceptorConfigurationInputConfigurationArgs.builder()
                     .passRequestHeaders(true)
                     .build())
                 .interceptionPoints(                
                     "REQUEST",
                     "RESPONSE")
                 .build())
             .name("gateway-with-interceptor")
             .roleArn(exampleAwsIamRole.arn())
             .authorizerType("AWS_IAM")
             .protocolType("MCP")
             .build());
 
     }
 }
    ## Import Using `pulumi import`, import Bedrock AgentCore Gateway using the gateway ID. For example: ```sh $ pulumi import aws:bedrock/agentcoreGateway:AgentcoreGateway example GATEWAY1234567890 ```

    • Constructor Detail

      • AgentcoreGateway

        public AgentcoreGateway​(java.lang.String name)
        Parameters:
        name - The _unique_ name of the resulting resource.

      • AgentcoreGateway

        public AgentcoreGateway​(java.lang.String name,
                        AgentcoreGatewayArgs args)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.

      • AgentcoreGateway

        public AgentcoreGateway​(java.lang.String name,
                        AgentcoreGatewayArgs args,
                        @Nullable
                        com.pulumi.resources.CustomResourceOptions options)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.
        options - A bag of options that control this resource's behavior.

    • Method Detail

      • authorizerConfiguration

        public com.pulumi.core.Output<java.util.Optional<AgentcoreGatewayAuthorizerConfiguration>> authorizerConfiguration()
        Returns:
        Configuration for request authorization. Required when `authorizerType` is set to `CUSTOM_JWT`. See `authorizerConfiguration` below.

      • authorizerType

        public com.pulumi.core.Output<java.lang.String> authorizerType()
        Returns:
        Type of authorizer to use. Valid values: `CUSTOM_JWT`, `AWS_IAM`, `NONE`, `AUTHENTICATE_ONLY`. When set to `CUSTOM_JWT`, `authorizerConfiguration` block is required.

      • description

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> description()
        Returns:
        Description of the gateway.

      • exceptionLevel

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> exceptionLevel()
        Returns:
        Exception level for the gateway. Valid values: `DEBUG`.

      • gatewayArn

        public com.pulumi.core.Output<java.lang.String> gatewayArn()
        Returns:
        ARN of the Gateway.

      • gatewayId

        public com.pulumi.core.Output<java.lang.String> gatewayId()
        Returns:
        Unique identifier of the Gateway.

      • gatewayUrl

        public com.pulumi.core.Output<java.lang.String> gatewayUrl()
        Returns:
        URL endpoint for the gateway.

      • interceptorConfigurations

        public com.pulumi.core.Output<java.util.Optional<java.util.List<AgentcoreGatewayInterceptorConfiguration>>> interceptorConfigurations()
        Returns:
        List of interceptor configurations for the gateway. Minimum of 1, maximum of 2. See `interceptorConfiguration` below.

      • kmsKeyArn

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> kmsKeyArn()
        Returns:
        ARN of the KMS key used to encrypt the gateway data.

      • name

        public com.pulumi.core.Output<java.lang.String> name()
        Returns:
        Name of the gateway.

      • policyEngineConfiguration

        public com.pulumi.core.Output<java.util.Optional<AgentcoreGatewayPolicyEngineConfiguration>> policyEngineConfiguration()
        Returns:
        Configuration for a policy engine associated with the gateway. A policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with a gateway, the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies. See `policyEngineConfiguration` below.

      • protocolConfiguration

        public com.pulumi.core.Output<java.util.Optional<AgentcoreGatewayProtocolConfiguration>> protocolConfiguration()
        Returns:
        Protocol-specific configuration for the gateway. See `protocolConfiguration` below.

      • protocolType

        public com.pulumi.core.Output<java.lang.String> protocolType()
        Returns:
        Protocol type for the gateway. Valid values: `MCP`. Omit this argument to create a gateway that routes traffic directly to HTTP targets such as AgentCore Runtime agents (see `aws.bedrock.AgentcoreGatewayTarget` `target_configuration.http`).

      • region

        public com.pulumi.core.Output<java.lang.String> region()
        Returns:
        Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.

      • roleArn

        public com.pulumi.core.Output<java.lang.String> roleArn()
        Returns:
        ARN of the IAM role that the gateway assumes to access AWS services. The following arguments are optional:

      • tags

        public com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,​java.lang.String>>> tags()
        Returns:
        Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.

      • tagsAll

        public com.pulumi.core.Output<java.util.Map<java.lang.String,​java.lang.String>> tagsAll()
        Returns:
        Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.

      • workloadIdentityDetails

        public com.pulumi.core.Output<java.util.List<AgentcoreGatewayWorkloadIdentityDetail>> workloadIdentityDetails()
        Returns:
        Workload identity details for the gateway. See `workloadIdentityDetails` below.

      • get

        public static AgentcoreGateway get​(java.lang.String name,
                                   com.pulumi.core.Output<java.lang.String> id,
                                   @Nullable
                                   AgentcoreGatewayState state,
                                   @Nullable
                                   com.pulumi.resources.CustomResourceOptions options)
        Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
        Parameters:
        name - The _unique_ name of the resulting resource.
        id - The _unique_ provider ID of the resource to lookup.
        state -
        options - Optional settings to control the behavior of the CustomResource.