java.lang.Object
- com.pulumi.resources.Resource
- - com.pulumi.resources.CustomResource
  - - com.pulumi.aws.bedrock.AgentcoreOauth2CredentialProvider

public class AgentcoreOauth2CredentialProvider
extends com.pulumi.resources.CustomResource

Manages an AWS Bedrock AgentCore OAuth2 Credential Provider. OAuth2 credential providers enable secure authentication with external OAuth2/OpenID Connect identity providers for agent runtimes. > **Note:** Write-Only arguments `clientIdWo` and `clientSecretWo` are available to use in place of `clientId` and `clientSecret`. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more. ## Example Usage ### GitHub OAuth Provider

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.bedrock.AgentcoreOauth2CredentialProvider;
 import com.pulumi.aws.bedrock.AgentcoreOauth2CredentialProviderArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreOauth2CredentialProviderOauth2ProviderConfigArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreOauth2CredentialProviderOauth2ProviderConfigGithubOauth2ProviderConfigArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var github = new AgentcoreOauth2CredentialProvider("github", AgentcoreOauth2CredentialProviderArgs.builder()
             .oauth2ProviderConfig(AgentcoreOauth2CredentialProviderOauth2ProviderConfigArgs.builder()
                 .githubOauth2ProviderConfig(AgentcoreOauth2CredentialProviderOauth2ProviderConfigGithubOauth2ProviderConfigArgs.builder()
                     .clientId("your-github-client-id")
                     .clientSecret("your-github-client-secret")
                     .build())
                 .build())
             .name("github-oauth-provider")
             .credentialProviderVendor("GithubOauth2")
             .build());
 
     }
 }

### Custom OAuth Provider with Discovery URL

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.bedrock.AgentcoreOauth2CredentialProvider;
 import com.pulumi.aws.bedrock.AgentcoreOauth2CredentialProviderArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreOauth2CredentialProviderOauth2ProviderConfigArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreOauth2CredentialProviderOauth2ProviderConfigCustomOauth2ProviderConfigArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreOauth2CredentialProviderOauth2ProviderConfigCustomOauth2ProviderConfigOauthDiscoveryArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var auth0 = new AgentcoreOauth2CredentialProvider("auth0", AgentcoreOauth2CredentialProviderArgs.builder()
             .oauth2ProviderConfig(AgentcoreOauth2CredentialProviderOauth2ProviderConfigArgs.builder()
                 .customOauth2ProviderConfig(AgentcoreOauth2CredentialProviderOauth2ProviderConfigCustomOauth2ProviderConfigArgs.builder()
                     .oauthDiscovery(AgentcoreOauth2CredentialProviderOauth2ProviderConfigCustomOauth2ProviderConfigOauthDiscoveryArgs.builder()
                         .discoveryUrl("https://dev-company.auth0.com/.well-known/openid-configuration")
                         .build())
                     .clientIdWo("auth0-client-id")
                     .clientSecretWo("auth0-client-secret")
                     .clientCredentialsWoVersion(1)
                     .build())
                 .build())
             .name("auth0-oauth-provider")
             .credentialProviderVendor("CustomOauth2")
             .build());
 
     }
 }

### Custom OAuth Provider with Authorization Server Metadata

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.bedrock.AgentcoreOauth2CredentialProvider;
 import com.pulumi.aws.bedrock.AgentcoreOauth2CredentialProviderArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreOauth2CredentialProviderOauth2ProviderConfigArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreOauth2CredentialProviderOauth2ProviderConfigCustomOauth2ProviderConfigArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreOauth2CredentialProviderOauth2ProviderConfigCustomOauth2ProviderConfigOauthDiscoveryArgs;
 import com.pulumi.aws.bedrock.inputs.AgentcoreOauth2CredentialProviderOauth2ProviderConfigCustomOauth2ProviderConfigOauthDiscoveryAuthorizationServerMetadataArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var keycloak = new AgentcoreOauth2CredentialProvider("keycloak", AgentcoreOauth2CredentialProviderArgs.builder()
             .oauth2ProviderConfig(AgentcoreOauth2CredentialProviderOauth2ProviderConfigArgs.builder()
                 .customOauth2ProviderConfig(AgentcoreOauth2CredentialProviderOauth2ProviderConfigCustomOauth2ProviderConfigArgs.builder()
                     .oauthDiscovery(AgentcoreOauth2CredentialProviderOauth2ProviderConfigCustomOauth2ProviderConfigOauthDiscoveryArgs.builder()
                         .authorizationServerMetadata(AgentcoreOauth2CredentialProviderOauth2ProviderConfigCustomOauth2ProviderConfigOauthDiscoveryAuthorizationServerMetadataArgs.builder()
                             .issuer("https://auth.company.com/realms/production")
                             .authorizationEndpoint("https://auth.company.com/realms/production/protocol/openid-connect/auth")
                             .tokenEndpoint("https://auth.company.com/realms/production/protocol/openid-connect/token")
                             .responseTypes(                            
                                 "code",
                                 "id_token")
                             .tokenEndpointAuthMethods("client_secret_basic")
                             .build())
                         .build())
                     .clientIdWo("keycloak-client-id")
                     .clientSecretWo("keycloak-client-secret")
                     .clientCredentialsWoVersion(1)
                     .build())
                 .build())
             .name("keycloak-oauth-provider")
             .credentialProviderVendor("CustomOauth2")
             .build());
 
     }
 }

## Import > **Note:** This resource does not read OAuth2 client credentials back from the AgentCore API. On import, `clientId`, `clientSecret`, `clientSecretSource`, `clientSecretConfig`, `clientCredentialsWoVersion`, and the Microsoft `tenantId` and `tenantIdWoVersion` arguments are not populated, so the first `pulumi preview` after import shows them as additions. Run `pulumi up` once to reconcile state from your configuration; subsequent plans are clean. ### Identity Schema #### Required * `name` (String) OAuth2 credential provider name. #### Optional * `accountId` (String) AWS Account where this resource is managed. * `region` (String) Region where this resource is managed. Using `pulumi import`, import Bedrock AgentCore OAuth2 Credential Provider using `name`. For example: ```sh $ pulumi import aws:bedrock/agentcoreOauth2CredentialProvider:AgentcoreOauth2CredentialProvider example example-oauth2-provider ```

Nested Class Summary
- Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource
  com.pulumi.resources.CustomResource.CustomResourceInternal
- Nested classes/interfaces inherited from class com.pulumi.resources.Resource
  com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

Field Summary
- Fields inherited from class com.pulumi.resources.Resource
  childResources, remote

Constructor Summary

Constructors
Constructor	Description
`AgentcoreOauth2CredentialProvider(java.lang.String name)`
`AgentcoreOauth2CredentialProvider(java.lang.String name, AgentcoreOauth2CredentialProviderArgs args)`
`AgentcoreOauth2CredentialProvider(java.lang.String name, AgentcoreOauth2CredentialProviderArgs args, com.pulumi.resources.CustomResourceOptions options)`

Method Summary

All Methods Static Methods Instance Methods Concrete Methods
Modifier and Type	Method	Description
`com.pulumi.core.Output<java.lang.String>`	`callbackUrl()`
`com.pulumi.core.Output<java.util.List<AgentcoreOauth2CredentialProviderClientSecretArn>>`	`clientSecretArns()`
`com.pulumi.core.Output<java.lang.String>`	`credentialProviderArn()`
`com.pulumi.core.Output<java.lang.String>`	`credentialProviderVendor()`
`static AgentcoreOauth2CredentialProvider`	`get(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, AgentcoreOauth2CredentialProviderState state, com.pulumi.resources.CustomResourceOptions options)`	Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
`com.pulumi.core.Output<java.lang.String>`	`name()`
`com.pulumi.core.Output<AgentcoreOauth2CredentialProviderOauth2ProviderConfig>`	`oauth2ProviderConfig()`
`com.pulumi.core.Output<java.lang.String>`	`region()`
`com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,java.lang.String>>>`	`tags()`
`com.pulumi.core.Output<java.util.Map<java.lang.String,java.lang.String>>`	`tagsAll()`
`com.pulumi.core.Output<java.util.Optional<AgentcoreOauth2CredentialProviderTimeouts>>`	`timeouts()`

Methods inherited from class com.pulumi.resources.CustomResource
getId, id, idFuture

Methods inherited from class com.pulumi.resources.Resource
getChildResources, getResourceName, getResourceType, getUrn, pulumiChildResources, pulumiResourceName, pulumiResourceType, urn

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - AgentcoreOauth2CredentialProvider
```
public AgentcoreOauth2CredentialProvider(java.lang.String name)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
  - AgentcoreOauth2CredentialProvider
```
public AgentcoreOauth2CredentialProvider(java.lang.String name,
                                         AgentcoreOauth2CredentialProviderArgs args)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    args - The arguments to use to populate this resource's properties.
  - AgentcoreOauth2CredentialProvider
```
public AgentcoreOauth2CredentialProvider(java.lang.String name,
                                         AgentcoreOauth2CredentialProviderArgs args,
                                         @Nullable
                                         com.pulumi.resources.CustomResourceOptions options)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    args - The arguments to use to populate this resource's properties.
    
    options - A bag of options that control this resource's behavior.
- Method Detail
  - callbackUrl
```
public com.pulumi.core.Output<java.lang.String> callbackUrl()
```
    Returns:
    
    Callback URL to register on the OAuth2 credential provider as an allowed callback URL. This URL is where the OAuth2 authorization server redirects users after they complete the authorization flow.
  - clientSecretArns
```
public com.pulumi.core.Output<java.util.List<AgentcoreOauth2CredentialProviderClientSecretArn>> clientSecretArns()
```
    Returns:
    
    ARN of the AWS Secrets Manager secret containing the client secret. See `clientSecretArn` Block below.
  - credentialProviderArn
```
public com.pulumi.core.Output<java.lang.String> credentialProviderArn()
```
    Returns:
    
    ARN of the OAuth2 credential provider.
  - credentialProviderVendor
```
public com.pulumi.core.Output<java.lang.String> credentialProviderVendor()
```
    Returns:
    
    Vendor of the OAuth2 credential provider. Valid values include `CustomOauth2`, `GithubOauth2`, `GoogleOauth2`, `MicrosoftOauth2`, `SalesforceOauth2`, `SlackOauth2`, `AtlassianOauth2`, `LinkedinOauth2`, and a number of additional supported vendors (e.g. `XOauth2`, `FacebookOauth2`, `SpotifyOauth2`) configured via `includedOauth2ProviderConfig`. Refer to the AWS API for the full, current list.
  - name
```
public com.pulumi.core.Output<java.lang.String> name()
```
    Returns:
    
    Name of the OAuth2 credential provider.
  - oauth2ProviderConfig
```
public com.pulumi.core.Output<AgentcoreOauth2CredentialProviderOauth2ProviderConfig> oauth2ProviderConfig()
```
    Returns:
    
    OAuth2 provider configuration. Must contain exactly one provider type. See `oauth2ProviderConfig` Block below. The following arguments are optional:
  - region
```
public com.pulumi.core.Output<java.lang.String> region()
```
    Returns:
    
    Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
  - tags
```
public com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,java.lang.String>>> tags()
```
    Returns:
    
    Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
  - tagsAll
```
public com.pulumi.core.Output<java.util.Map<java.lang.String,java.lang.String>> tagsAll()
```
    Returns:
    
    Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
  - timeouts
```
public com.pulumi.core.Output<java.util.Optional<AgentcoreOauth2CredentialProviderTimeouts>> timeouts()
```
  - get
```
public static AgentcoreOauth2CredentialProvider get(java.lang.String name,
                                                    com.pulumi.core.Output<java.lang.String> id,
                                                    @Nullable
                                                    AgentcoreOauth2CredentialProviderState state,
                                                    @Nullable
                                                    com.pulumi.resources.CustomResourceOptions options)
```
    Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
    
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    id - The _unique_ provider ID of the resource to lookup.
    
    state -
    
    options - Optional settings to control the behavior of the CustomResource.

Class AgentcoreOauth2CredentialProvider

Nested Class Summary

Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

Nested classes/interfaces inherited from class com.pulumi.resources.Resource

Field Summary

Fields inherited from class com.pulumi.resources.Resource

Constructor Summary

Method Summary

Methods inherited from class com.pulumi.resources.CustomResource

Methods inherited from class com.pulumi.resources.Resource

Methods inherited from class java.lang.Object

Constructor Detail

AgentcoreOauth2CredentialProvider

AgentcoreOauth2CredentialProvider

AgentcoreOauth2CredentialProvider

Method Detail

callbackUrl

clientSecretArns

credentialProviderArn

credentialProviderVendor

name

oauth2ProviderConfig

region

tags

tagsAll

timeouts

get