2026/11/11 - Amazon Bedrock AgentCore Control - 19 updated api methods
Changes Support SigV4 request signing (cryptographically signed) in the Bedrock AgentCore Harness MCP connector tool.
{'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Creates an Amazon Bedrock AgentCore Runtime.
See also: AWS API Documentation
Request Syntax
client.create_agent_runtime(
agentRuntimeName='string',
agentRuntimeArtifact={
'containerConfiguration': {
'containerUri': 'string'
},
'codeConfiguration': {
'code': {
's3': {
'bucket': 'string',
'prefix': 'string',
'versionId': 'string'
}
},
'runtime': 'PYTHON_3_10'|'PYTHON_3_11'|'PYTHON_3_12'|'PYTHON_3_13'|'PYTHON_3_14'|'NODE_22',
'entryPoint': [
'string',
]
}
},
roleArn='string',
networkConfiguration={
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
clientToken='string',
description='string',
authorizerConfiguration={
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
requestHeaderConfiguration={
'requestHeaderAllowlist': [
'string',
]
},
protocolConfiguration={
'serverProtocol': 'MCP'|'HTTP'|'A2A'|'AGUI',
'port': 123,
'path': 'string'
},
lifecycleConfiguration={
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
hooksConfiguration={
'build': {
'warmup': {
'action': {
'httpPost': {
'path': 'string',
'port': 123
}
}
}
}
},
environmentVariables={
'string': 'string'
},
filesystemConfigurations=[
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
],
capacityProviderConfiguration={
'capacityProviderArn': 'string'
},
tags={
'string': 'string'
},
platformVersion='string',
allowedPorts=[
{
'port': 123,
'portRange': {
'from': 123,
'to': 123
}
},
],
resourceConfigurations=[
{
'minimumMemoryInMiB': 123
},
]
)
string
[REQUIRED]
The name of the AgentCore Runtime.
dict
[REQUIRED]
The artifact of the AgentCore Runtime.
containerConfiguration (dict) --
The container configuration for the agent artifact.
containerUri (string) -- [REQUIRED]
The ECR URI of the container.
codeConfiguration (dict) --
The code configuration for the agent runtime artifact, including the source code location and execution settings.
code (dict) -- [REQUIRED]
The source code location and configuration details.
s3 (dict) --
The Amazon Amazon S3 object that contains the source code for the agent runtime.
bucket (string) -- [REQUIRED]
The name of the Amazon S3 bucket. This bucket contains the stored data.
prefix (string) -- [REQUIRED]
The prefix for objects in the Amazon S3 bucket. This prefix is added to the object keys to organize the data.
versionId (string) --
The version ID of the Amazon Amazon S3 object. If not specified, the latest version of the object is used.
runtime (string) -- [REQUIRED]
The runtime environment for executing the agent code. Specify the programming language and version to use for the agent runtime. For valid values, see the list of supported runtimes.
entryPoint (list) -- [REQUIRED]
The entry point for the code execution, specifying the function or method that should be invoked when the code runs.
(string) --
string
[REQUIRED]
The IAM role ARN that provides permissions for the AgentCore Runtime.
dict
The network configuration for the AgentCore Runtime.
networkMode (string) -- [REQUIRED]
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) -- [REQUIRED]
The security groups associated with the VPC configuration.
(string) --
subnets (list) -- [REQUIRED]
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
string
A unique, case-sensitive identifier to ensure idempotency of the request.
This field is autopopulated if not provided.
string
The description of the AgentCore Runtime.
dict
The authorizer configuration for the AgentCore Runtime.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) -- [REQUIRED]
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
dict
Configuration for HTTP request headers that will be passed through to the runtime.
requestHeaderAllowlist (list) --
A list of HTTP request headers that are allowed to be passed through to the runtime.
(string) --
dict
The protocol configuration for the AgentCore Runtime, including the protocol, port, and path on which the agent server is available.
serverProtocol (string) -- [REQUIRED]
The server protocol for the agent runtime. This field specifies which protocol the agent runtime uses to communicate with clients.
port (integer) --
The port on which the agent server listens. The port must be between 8000 and 12000, excluding the reserved port 8443. When this field is omitted, the default is 8080 for HTTP and AGUI, 8000 for MCP, and 9000 for A2A.
path (string) --
The path on which the agent server accepts requests. The path must begin with /. When this field is omitted, the default is /invocations for HTTP and AGUI, /mcp for MCP, and / for A2A.
dict
The life cycle configuration for the AgentCore Runtime.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
dict
The lifecycle hooks configuration for the AgentCore Runtime. Use lifecycle hooks to run actions in the agent's container at fixed points in the runtime's lifecycle, such as warming up the agent before sessions are created.
build (dict) --
The hooks that run when you create or update the AgentCore Runtime, before any sessions are created.
warmup (dict) --
The hook that warms up your agent before any sessions are created. Use this hook to load the resources that your sessions need, such as models, libraries, or caches. Your hook must complete within 120 seconds.
action (dict) -- [REQUIRED]
The action that AgentCore Runtime runs for the hook. Specify exactly one action.
httpPost (dict) --
Sends an HTTP POST request to your agent's container on the specified port and path to run the hook. The hook succeeds if your container returns a 2xx response. The hook fails if your container returns any other response or doesn't respond before the hook times out.
path (string) -- [REQUIRED]
The path in the agent's container that AgentCore Runtime sends the POST request to.
port (integer) --
The port in the agent's container that AgentCore Runtime sends the POST request to. If you don't specify a port, the default is the runtime's server port: the port in the protocol configuration if one is set, otherwise the protocol's default port.
dict
Environment variables to set in the AgentCore Runtime environment.
(string) --
(string) --
list
The filesystem configurations to mount into the AgentCore Runtime. Use filesystem configurations to provide persistent storage to your AgentCore Runtime sessions.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) -- [REQUIRED]
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) -- [REQUIRED]
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) -- [REQUIRED]
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
dict
The capacity provider configuration for the AgentCore Runtime. Use a capacity provider to run the AgentCore Runtime on the Instances compute type, which provisions Amazon Web Services managed compute in your account.
capacityProviderArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the capacity provider to use for the AgentCore Runtime.
dict
A map of tag keys and values to assign to the agent runtime. Tags enable you to categorize your resources in different ways, for example, by purpose, owner, or environment.
(string) --
(string) --
string
The version of the runtime platform to use for the AgentCore Runtime.
list
The additional ports on the AgentCore Runtime that are reachable through the runtime's session URL. Specify one to five non-overlapping entries, each containing either a single port or an inclusive port range. Ports must be between 8000 and 12000, excluding the reserved port 8443.
(dict) --
A port or port range that is reachable through the runtime's session URL. Specify exactly one of port or portRange.
port (integer) --
A single port that is reachable through the runtime's session URL.
portRange (dict) --
An inclusive range of ports that are reachable through the runtime's session URL.
from (integer) -- [REQUIRED]
The first port in the inclusive range.
to (integer) -- [REQUIRED]
The last port in the inclusive range.
list
The resource configurations for the AgentCore Runtime, such as the minimum amount of memory to allocate to the runtime. You can specify at most one resource configuration.
(dict) --
The resource configuration for an AgentCore Runtime.
minimumMemoryInMiB (integer) -- [REQUIRED]
The minimum amount of memory, in mebibytes, to allocate to the AgentCore Runtime.
dict
Response Syntax
{
'agentRuntimeArn': 'string',
'workloadIdentityDetails': {
'workloadIdentityArn': 'string'
},
'agentRuntimeId': 'string',
'agentRuntimeVersion': 'string',
'createdAt': datetime(2015, 1, 1),
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED'
}
Response Structure
(dict) --
agentRuntimeArn (string) --
The Amazon Resource Name (ARN) of the AgentCore Runtime.
workloadIdentityDetails (dict) --
The workload identity details for the AgentCore Runtime.
workloadIdentityArn (string) --
The ARN associated with the workload identity.
agentRuntimeId (string) --
The unique identifier of the AgentCore Runtime.
agentRuntimeVersion (string) --
The version of the AgentCore Runtime.
createdAt (datetime) --
The timestamp when the AgentCore Runtime was created.
status (string) --
The current status of the AgentCore Runtime.
{'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Creates a gateway for Amazon Bedrock Agent. A gateway serves as an integration point between your agent and external services.
If you specify CUSTOM_JWT as the authorizerType, you must provide an authorizerConfiguration.
See also: AWS API Documentation
Request Syntax
client.create_gateway(
name='string',
description='string',
clientToken='string',
roleArn='string',
protocolType='MCP',
protocolConfiguration={
'mcp': {
'supportedVersions': [
'string',
],
'instructions': 'string',
'searchType': 'SEMANTIC',
'sessionConfiguration': {
'sessionTimeoutInSeconds': 123
},
'streamingConfiguration': {
'enableResponseStreaming': True|False
},
'disableMcpListToolsPagination': True|False
}
},
authorizerType='CUSTOM_JWT'|'AWS_IAM'|'NONE'|'AUTHENTICATE_ONLY',
authorizerConfiguration={
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
kmsKeyArn='string',
interceptorConfigurations=[
{
'interceptor': {
'lambda': {
'arn': 'string'
}
},
'interceptionPoints': [
'REQUEST'|'RESPONSE',
],
'inputConfiguration': {
'passRequestHeaders': True|False,
'payloadFilter': {
'exclude': [
{
'field': 'RESPONSE_BODY'
},
]
}
}
},
],
policyEngineConfiguration={
'arn': 'string',
'mode': 'LOG_ONLY'|'ENFORCE'
},
exceptionLevel='DEBUG',
tags={
'string': 'string'
},
domainOverride={
'defaultDomain': 'string',
'alternateDomains': [
'string',
]
}
)
string
[REQUIRED]
The name of the gateway. The name must be unique within your account.
string
The description of the gateway.
string
A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If you don't specify this field, a value is randomly generated for you. If this token matches a previous request, the service ignores the request, but doesn't return an error. For more information, see Ensuring idempotency.
This field is autopopulated if not provided.
string
[REQUIRED]
The Amazon Resource Name (ARN) of the IAM role that provides permissions for the gateway to access Amazon Web Services services.
string
The protocol type for the gateway.
dict
The configuration settings for the protocol specified in the protocolType parameter.
mcp (dict) --
The configuration for the Model Context Protocol (MCP). This protocol enables communication between Amazon Bedrock Agent and external tools.
supportedVersions (list) --
The supported versions of the Model Context Protocol. This field specifies which versions of the protocol the gateway can use.
(string) --
instructions (string) --
The instructions for using the Model Context Protocol gateway. These instructions provide guidance on how to interact with the gateway.
searchType (string) --
The search type for the Model Context Protocol gateway. This field specifies how the gateway handles search operations.
sessionConfiguration (dict) --
The session configuration for the MCP gateway. This configuration controls session behavior, including session timeout settings.
sessionTimeoutInSeconds (integer) --
The session timeout in seconds. After this timeout, the session expires and subsequent requests to this session will receive an error. The minimum value is 900 seconds (15 minutes), the maximum value is 28800 seconds (8 hours), and the default value is 3600 seconds (1 hour).
streamingConfiguration (dict) --
The streaming configuration for the MCP gateway. This configuration controls whether response streaming is enabled for the gateway.
enableResponseStreaming (boolean) --
Indicates whether response streaming is enabled for the gateway. When set to true, the gateway streams responses from targets back to the client.
disableMcpListToolsPagination (boolean) --
Specifies whether the gateway disables pagination for the Model Context Protocol (MCP) tools/list operation. When set to true, the gateway returns the complete list of tools in a single response without a pagination cursor. When set to false or omitted, the gateway returns tools in paginated responses. For information about changing this value on an existing gateway, see UpdateGateway.
string
[REQUIRED]
The type of authorizer to use for the gateway.
CUSTOM_JWT - Authorize with a bearer token.
AWS_IAM - Authorize with your Amazon Web Services IAM credentials.
NONE - No authorization
dict
The authorizer configuration for the gateway. Required if authorizerType is CUSTOM_JWT.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) -- [REQUIRED]
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
string
The Amazon Resource Name (ARN) of the KMS key used to encrypt data associated with the gateway.
list
A list of configuration settings for a gateway interceptor. Gateway interceptors allow custom code to be invoked during gateway invocations.
(dict) --
The configuration for an interceptor on a gateway. This structure defines settings for an interceptor that will be invoked during the invocation of the gateway.
interceptor (dict) -- [REQUIRED]
The infrastructure settings of an interceptor configuration. This structure defines how the interceptor can be invoked.
lambda (dict) --
The details of the lambda function used for the interceptor.
arn (string) -- [REQUIRED]
The arn of the lambda function to be invoked for the interceptor.
interceptionPoints (list) -- [REQUIRED]
The supported points of interception. This field specifies which points during the gateway invocation to invoke the interceptor
(string) --
inputConfiguration (dict) --
The configuration for the input of the interceptor. This field specifies how the input to the interceptor is constructed
passRequestHeaders (boolean) -- [REQUIRED]
Indicates whether to pass request headers as input into the interceptor. When set to true, request headers will be passed.
payloadFilter (dict) --
The filter that determines which parts of the request or response payload are passed as input to the interceptor.
exclude (list) -- [REQUIRED]
The list of selectors that identify payload fields to exclude from the interceptor input.
(dict) --
A selector that identifies a payload field to exclude from the interceptor input.
field (string) --
The field to exclude from the interceptor input.
dict
The policy engine configuration for the gateway. A policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with a gateway, the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies.
arn (string) -- [REQUIRED]
The ARN of the policy engine. The policy engine contains Cedar or Dogwood policies that define fine-grained authorization rules specifying who can perform what actions on which resources as agents interact through the gateway.
mode (string) -- [REQUIRED]
The enforcement mode for the policy engine. Valid values include:
LOG_ONLY - The policy engine evaluates each action against your policies and adds traces on whether tool calls would be allowed or denied, but does not enforce the decision. Use this mode to test and validate policies before enabling enforcement.
ENFORCE - The policy engine evaluates actions against your policies and enforces decisions by allowing or denying agent operations. Test and validate policies in LOG_ONLY mode before enabling enforcement to avoid unintended denials or adversely affecting production traffic.
string
The level of detail in error messages returned when invoking the gateway.
If the value is DEBUG, granular exception messages are returned to help a user debug the gateway.
If the value is omitted, a generic error message is returned to the end user.
dict
A map of key-value pairs to associate with the gateway as metadata tags.
(string) --
(string) --
dict
The public domain names that the gateway advertises in its OAuth discovery URLs instead of the inbound Host header. Specify this when clients reach the gateway through your own proxy or custom domain.
defaultDomain (string) -- [REQUIRED]
The default public domain name for the gateway. The gateway advertises this domain when a request doesn't select a specific domain.
alternateDomains (list) --
Additional public domain names for the gateway, up to 10. Don't repeat the default domain or list a domain more than once. A request can select one of these domains, or the default domain, with the x-amzn-bedrock-agentcore-gateway-domain header. The gateway rejects a request that selects a domain that isn't configured.
(string) --
dict
Response Syntax
{
'gatewayArn': 'string',
'gatewayId': 'string',
'gatewayUrl': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'status': 'CREATING'|'UPDATING'|'UPDATE_UNSUCCESSFUL'|'DELETING'|'READY'|'FAILED',
'statusReasons': [
'string',
],
'name': 'string',
'description': 'string',
'roleArn': 'string',
'protocolType': 'MCP',
'protocolConfiguration': {
'mcp': {
'supportedVersions': [
'string',
],
'instructions': 'string',
'searchType': 'SEMANTIC',
'sessionConfiguration': {
'sessionTimeoutInSeconds': 123
},
'streamingConfiguration': {
'enableResponseStreaming': True|False
},
'disableMcpListToolsPagination': True|False
}
},
'authorizerType': 'CUSTOM_JWT'|'AWS_IAM'|'NONE'|'AUTHENTICATE_ONLY',
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'kmsKeyArn': 'string',
'customTransformConfiguration': {
'lambda': {
'arn': 'string'
}
},
'interceptorConfigurations': [
{
'interceptor': {
'lambda': {
'arn': 'string'
}
},
'interceptionPoints': [
'REQUEST'|'RESPONSE',
],
'inputConfiguration': {
'passRequestHeaders': True|False,
'payloadFilter': {
'exclude': [
{
'field': 'RESPONSE_BODY'
},
]
}
}
},
],
'policyEngineConfiguration': {
'arn': 'string',
'mode': 'LOG_ONLY'|'ENFORCE'
},
'workloadIdentityDetails': {
'workloadIdentityArn': 'string'
},
'exceptionLevel': 'DEBUG',
'webAclArn': 'string',
'wafConfiguration': {
'failureMode': 'FAIL_CLOSE'|'FAIL_OPEN'
},
'domainOverride': {
'defaultDomain': 'string',
'alternateDomains': [
'string',
]
}
}
Response Structure
(dict) --
gatewayArn (string) --
The Amazon Resource Name (ARN) of the created gateway.
gatewayId (string) --
The unique identifier of the created gateway.
gatewayUrl (string) --
The URL endpoint for the created gateway.
createdAt (datetime) --
The timestamp when the gateway was created.
updatedAt (datetime) --
The timestamp when the gateway was last updated.
status (string) --
The current status of the gateway.
statusReasons (list) --
The reasons for the current status of the gateway.
(string) --
name (string) --
The name of the gateway.
description (string) --
The description of the gateway.
roleArn (string) --
The Amazon Resource Name (ARN) of the IAM role associated with the gateway.
protocolType (string) --
The protocol type of the gateway.
protocolConfiguration (dict) --
The configuration settings for the protocol used by the gateway.
mcp (dict) --
The configuration for the Model Context Protocol (MCP). This protocol enables communication between Amazon Bedrock Agent and external tools.
supportedVersions (list) --
The supported versions of the Model Context Protocol. This field specifies which versions of the protocol the gateway can use.
(string) --
instructions (string) --
The instructions for using the Model Context Protocol gateway. These instructions provide guidance on how to interact with the gateway.
searchType (string) --
The search type for the Model Context Protocol gateway. This field specifies how the gateway handles search operations.
sessionConfiguration (dict) --
The session configuration for the MCP gateway. This configuration controls session behavior, including session timeout settings.
sessionTimeoutInSeconds (integer) --
The session timeout in seconds. After this timeout, the session expires and subsequent requests to this session will receive an error. The minimum value is 900 seconds (15 minutes), the maximum value is 28800 seconds (8 hours), and the default value is 3600 seconds (1 hour).
streamingConfiguration (dict) --
The streaming configuration for the MCP gateway. This configuration controls whether response streaming is enabled for the gateway.
enableResponseStreaming (boolean) --
Indicates whether response streaming is enabled for the gateway. When set to true, the gateway streams responses from targets back to the client.
disableMcpListToolsPagination (boolean) --
Specifies whether the gateway disables pagination for the Model Context Protocol (MCP) tools/list operation. When set to true, the gateway returns the complete list of tools in a single response without a pagination cursor. When set to false or omitted, the gateway returns tools in paginated responses. For information about changing this value on an existing gateway, see UpdateGateway.
authorizerType (string) --
The type of authorizer used by the gateway.
authorizerConfiguration (dict) --
The authorizer configuration for the created gateway.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
kmsKeyArn (string) --
The Amazon Resource Name (ARN) of the KMS key used to encrypt data associated with the gateway.
customTransformConfiguration (dict) --
The custom transformation configuration for the gateway. This configuration defines how the gateway transforms requests and responses.
lambda (dict) --
The Lambda configuration for custom transformations. This configuration defines how the gateway uses a Lambda function to transform data.
arn (string) --
The Amazon Resource Name (ARN) of the Lambda function. This function is invoked by the gateway to transform data.
interceptorConfigurations (list) --
The list of interceptor configurations for the created gateway.
(dict) --
The configuration for an interceptor on a gateway. This structure defines settings for an interceptor that will be invoked during the invocation of the gateway.
interceptor (dict) --
The infrastructure settings of an interceptor configuration. This structure defines how the interceptor can be invoked.
lambda (dict) --
The details of the lambda function used for the interceptor.
arn (string) --
The arn of the lambda function to be invoked for the interceptor.
interceptionPoints (list) --
The supported points of interception. This field specifies which points during the gateway invocation to invoke the interceptor
(string) --
inputConfiguration (dict) --
The configuration for the input of the interceptor. This field specifies how the input to the interceptor is constructed
passRequestHeaders (boolean) --
Indicates whether to pass request headers as input into the interceptor. When set to true, request headers will be passed.
payloadFilter (dict) --
The filter that determines which parts of the request or response payload are passed as input to the interceptor.
exclude (list) --
The list of selectors that identify payload fields to exclude from the interceptor input.
(dict) --
A selector that identifies a payload field to exclude from the interceptor input.
field (string) --
The field to exclude from the interceptor input.
policyEngineConfiguration (dict) --
The policy engine configuration for the created gateway.
arn (string) --
The ARN of the policy engine. The policy engine contains Cedar or Dogwood policies that define fine-grained authorization rules specifying who can perform what actions on which resources as agents interact through the gateway.
mode (string) --
The enforcement mode for the policy engine. Valid values include:
LOG_ONLY - The policy engine evaluates each action against your policies and adds traces on whether tool calls would be allowed or denied, but does not enforce the decision. Use this mode to test and validate policies before enabling enforcement.
ENFORCE - The policy engine evaluates actions against your policies and enforces decisions by allowing or denying agent operations. Test and validate policies in LOG_ONLY mode before enabling enforcement to avoid unintended denials or adversely affecting production traffic.
workloadIdentityDetails (dict) --
The workload identity details for the created gateway.
workloadIdentityArn (string) --
The ARN associated with the workload identity.
exceptionLevel (string) --
The level of detail in error messages returned when invoking the gateway.
If the value is DEBUG, granular exception messages are returned to help a user debug the gateway.
If the value is omitted, a generic error message is returned to the end user.
webAclArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services WAF web ACL associated with the gateway.
wafConfiguration (dict) --
The Amazon Web Services WAF configuration for the gateway.
failureMode (string) --
The failure mode that determines how the gateway handles requests when Amazon Web Services WAF is unreachable or times out. Valid values include:
FAIL_CLOSE - The gateway blocks requests when Amazon Web Services WAF cannot be evaluated.
FAIL_OPEN - The gateway allows requests when Amazon Web Services WAF cannot be evaluated.
domainOverride (dict) --
The public domain names that the gateway advertises in its OAuth discovery URLs instead of the inbound Host header.
defaultDomain (string) --
The default public domain name for the gateway. The gateway advertises this domain when a request doesn't select a specific domain.
alternateDomains (list) --
Additional public domain names for the gateway, up to 10. Don't repeat the default domain or list a domain more than once. A request can select one of these domains, or the default domain, with the x-amzn-bedrock-agentcore-gateway-domain header. The gateway rejects a request that selects a domain that isn't configured.
(string) --
{'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}},
'tools': {'config': {'remoteMcp': {'outboundAuth': {'awsIam': {'region': 'string',
'service': 'string'},
'none': {}}}}}}
Response {'harness': {'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}},
'tools': {'config': {'remoteMcp': {'outboundAuth': {'awsIam': {'region': 'string',
'service': 'string'},
'none': {}}}}}}}
Operation to create a harness.
See also: AWS API Documentation
Request Syntax
client.create_harness(
harnessName='string',
clientToken='string',
executionRoleArn='string',
environment={
'agentCoreRuntimeEnvironment': {
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
]
}
},
environmentArtifact={
'containerConfiguration': {
'containerUri': 'string'
}
},
environmentVariables={
'string': 'string'
},
authorizerConfiguration={
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
model={
'bedrockModelConfig': {
'modelId': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'converse_stream'|'responses'|'chat_completions',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'openAiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'chat_completions'|'responses',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'geminiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'topK': 123,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'liteLlmModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
}
},
systemPrompt=[
{
'text': 'string'
},
],
tools=[
{
'type': 'remote_mcp'|'agentcore_browser'|'agentcore_gateway'|'inline_function'|'agentcore_code_interpreter',
'name': 'string',
'config': {
'remoteMcp': {
'url': 'string',
'headers': {
'string': 'string'
},
'outboundAuth': {
'awsIam': {
'service': 'string',
'region': 'string'
},
'none': {}
}
},
'agentCoreBrowser': {
'browserArn': 'string'
},
'agentCoreGateway': {
'gatewayArn': 'string',
'outboundAuth': {
'awsIam': {}
,
'none': {}
,
'oauth': {
'providerArn': 'string',
'scopes': [
'string',
],
'customParameters': {
'string': 'string'
},
'grantType': 'CLIENT_CREDENTIALS'|'AUTHORIZATION_CODE'|'TOKEN_EXCHANGE',
'defaultReturnUrl': 'string'
}
}
},
'inlineFunction': {
'description': 'string',
'inputSchema': {...}|[...]|123|123.4|'string'|True|None
},
'agentCoreCodeInterpreter': {
'codeInterpreterArn': 'string'
}
}
},
],
skills=[
{
'path': 'string',
's3': {
'uri': 'string'
},
'git': {
'url': 'string',
'path': 'string',
'auth': {
'credentialArn': 'string',
'username': 'string'
}
},
'awsSkills': {
'paths': [
'string',
]
}
},
],
allowedTools=[
'string',
],
memory={
'agentCoreMemoryConfiguration': {
'arn': 'string',
'actorId': 'string',
'messagesCount': 123,
'retrievalConfig': {
'string': {
'topK': 123,
'relevanceScore': ...,
'strategyId': 'string'
}
}
},
'managedMemoryConfiguration': {
'arn': 'string',
'strategies': [
'SEMANTIC'|'SUMMARIZATION'|'USER_PREFERENCE'|'EPISODIC',
],
'eventExpiryDuration': 123,
'encryptionKeyArn': 'string'
},
'disabled': {}
},
truncation={
'strategy': 'sliding_window'|'summarization'|'none',
'config': {
'slidingWindow': {
'messagesCount': 123
},
'summarization': {
'summaryRatio': ...,
'preserveRecentMessages': 123,
'summarizationSystemPrompt': 'string'
}
}
},
hooks=[
{
'beforeInvocation': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'afterInvocation': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'beforeToolCall': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'afterToolCall': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
}
},
],
maxIterations=123,
maxTokens=123,
timeoutSeconds=123,
tags={
'string': 'string'
}
)
string
[REQUIRED]
The name of the harness. Must start with a letter and contain only alphanumeric characters and underscores.
string
A unique, case-sensitive identifier to ensure idempotency of the request.
This field is autopopulated if not provided.
string
[REQUIRED]
The ARN of the IAM role that the harness assumes when running. This role must have permissions for the services the agent needs to access, such as Amazon Bedrock for model invocation.
dict
The compute environment configuration for the harness, including network and lifecycle settings.
agentCoreRuntimeEnvironment (dict) --
The AgentCore Runtime environment configuration.
lifecycleConfiguration (dict) --
The lifecycle configuration for the harness's runtime environment. For a harness, idleRuntimeSessionTimeout and maxLifetime each accept a value between 60 and 28800 seconds (8 hours), and idleRuntimeSessionTimeout must be less than or equal to maxLifetime. Values above 28800 seconds are rejected with a ValidationException.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
networkConfiguration (dict) --
SecurityConfig for the Agent.
networkMode (string) -- [REQUIRED]
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) -- [REQUIRED]
The security groups associated with the VPC configuration.
(string) --
subnets (list) -- [REQUIRED]
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
filesystemConfigurations (list) --
The filesystem configurations for the runtime environment.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) -- [REQUIRED]
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) -- [REQUIRED]
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) -- [REQUIRED]
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
dict
The environment artifact for the harness, such as a custom container image containing additional dependencies.
containerConfiguration (dict) --
Representation of a container configuration.
containerUri (string) -- [REQUIRED]
The ECR URI of the container.
dict
Environment variables to set in the harness runtime environment.
(string) --
(string) --
dict
Represents inbound authorization configuration options used to authenticate incoming requests.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) -- [REQUIRED]
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
dict
The model configuration for the harness. Supports Amazon Bedrock, OpenAI, and Google Gemini model providers.
bedrockModelConfig (dict) --
Configuration for an Amazon Bedrock model.
modelId (string) -- [REQUIRED]
The Bedrock model ID.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the Bedrock provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
openAiModelConfig (dict) --
Configuration for an OpenAI model.
modelId (string) -- [REQUIRED]
The OpenAI model ID.
apiKeyArn (string) -- [REQUIRED]
The ARN of your OpenAI API key on AgentCore Identity.
apiBase (string) --
Optional custom endpoint URL for an OpenAI-compatible endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the OpenAI provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
geminiModelConfig (dict) --
Configuration for a Google Gemini model.
modelId (string) -- [REQUIRED]
The Gemini model ID.
apiKeyArn (string) -- [REQUIRED]
The ARN of your Gemini API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
topK (integer) --
The topK set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the Gemini model provider unchanged.
liteLlmModelConfig (dict) --
The LiteLLM model configuration for connecting to third-party model providers.
modelId (string) -- [REQUIRED]
The LiteLLM model identifier (e.g., "anthropic/claude-3-sonnet").
apiKeyArn (string) --
The ARN of the API key in AgentCore Identity for authenticating with the model provider.
apiBase (string) --
The base URL for the model provider's API endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per iteration.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
list
The system prompt that defines the agent's behavior and instructions.
(dict) --
A content block in the system prompt.
text (string) --
The text content of the system prompt block.
list
The tools available to the agent, such as remote MCP servers, AgentCore Gateway, AgentCore Browser, Code Interpreter, or inline functions.
(dict) --
A tool available to the agent loop.
type (string) -- [REQUIRED]
The type of tool.
name (string) --
Unique name for the tool. If not provided, a name will be inferred or generated.
config (dict) --
Tool-specific configuration.
remoteMcp (dict) --
Configuration for remote MCP server.
url (string) -- [REQUIRED]
URL of the MCP endpoint.
headers (dict) --
Custom headers to include when connecting to the remote MCP server.
(string) --
The key of an HTTP header.
(string) --
The value of an HTTP header.
outboundAuth (dict) --
How the harness authenticates to this MCP server. Defaults to no authentication.
awsIam (dict) --
Sign requests to the remote MCP server with Signature Version 4 (SigV4) using the harness execution role. If you don't specify a Region, the harness Region is used.
service (string) -- [REQUIRED]
The target Amazon Web Services service name used for SigV4 signing. This value identifies the service that the gateway authenticates with when making requests to the target endpoint.
region (string) --
The Amazon Web Services Region used for SigV4 signing. If not specified, defaults to the gateway's Region.
none (dict) --
No authentication.
agentCoreBrowser (dict) --
Configuration for AgentCore Browser.
browserArn (string) --
If not populated, the built-in Browser ARN is used.
agentCoreGateway (dict) --
Configuration for AgentCore Gateway.
gatewayArn (string) -- [REQUIRED]
The ARN of the desired AgentCore Gateway.
outboundAuth (dict) --
How harness authenticates to this Gateway. Defaults to AWS_IAM (SigV4) if omitted.
awsIam (dict) --
SigV4-sign requests using the agent's execution role.
none (dict) --
No authentication.
oauth (dict) --
Use OAuth credentials for outbound authentication to the gateway.
The AUTHORIZATION_CODE grant type is not supported for outbound authentication from a harness to an AgentCore Gateway, even when defaultReturnUrl is specified.
providerArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the OAuth credential provider. This ARN identifies the provider in Amazon Web Services.
scopes (list) -- [REQUIRED]
The OAuth scopes for the credential provider. These scopes define the level of access requested from the OAuth provider.
(string) --
customParameters (dict) --
The custom parameters for the OAuth credential provider. These parameters provide additional configuration for the OAuth authentication process.
(string) --
(string) --
grantType (string) --
Specifies the kind of credentials to use for authorization:
CLIENT_CREDENTIALS - Authorization with a client ID and secret.
AUTHORIZATION_CODE - Authorization with a token that is specific to an individual end user.
TOKEN_EXCHANGE - Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience.
defaultReturnUrl (string) --
The URL where the end user's browser is redirected after obtaining the authorization code. Generally points to the customer's application.
inlineFunction (dict) --
Configuration for an inline function tool.
description (string) -- [REQUIRED]
Description of what the tool does, provided to the model.
inputSchema (:ref:`document<document>`) -- [REQUIRED]
JSON Schema describing the tool's input parameters.
agentCoreCodeInterpreter (dict) --
Configuration for AgentCore Code Interpreter.
codeInterpreterArn (string) --
If not populated, the built-in Code Interpreter ARN is used.
list
The skills available to the agent. Skills are bundles of files that the agent can pull into its context on demand.
(dict) --
A skill available to the agent.
path (string) --
The filesystem path to the skill definition.
s3 (dict) --
An S3 source containing the skill.
uri (string) -- [REQUIRED]
The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
git (dict) --
A git repository containing the skill.
url (string) -- [REQUIRED]
The HTTPS URL of the git repository.
path (string) --
Subdirectory within the repository containing the skill.
auth (dict) --
Authentication configuration for private repositories.
credentialArn (string) -- [REQUIRED]
The ARN of the credential in AgentCore Identity containing the password or personal access token.
username (string) --
Username for authentication. Defaults to 'oauth2' if not specified.
awsSkills (dict) --
Amazon Web Services Skills baked into the harness's underlying Runtime.
paths (list) --
Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
(string) --
list
The tools that the agent is allowed to use. Supports glob patterns such as * for all tools, @builtin for all built-in tools, or @serverName/toolName for specific MCP server tools.
(string) --
dict
The AgentCore Memory configuration for persisting conversation context across sessions.
agentCoreMemoryConfiguration (dict) --
The AgentCore Memory configuration.
arn (string) -- [REQUIRED]
The ARN of the AgentCore Memory resource.
actorId (string) --
The actor ID for memory operations.
messagesCount (integer) --
The number of messages to retrieve from memory.
retrievalConfig (dict) --
The retrieval configuration for long-term memory, mapping namespace path templates to retrieval settings.
(string) --
(dict) --
Configuration for memory retrieval within a namespace.
topK (integer) --
The maximum number of memory entries to retrieve.
relevanceScore (float) --
The minimum relevance score for retrieved memories.
strategyId (string) --
The ID of the retrieval strategy to use.
managedMemoryConfiguration (dict) --
Harness creates and manages a memory resource in the customer's account.
arn (string) --
The ARN of the managed AgentCore Memory resource. Read-only on Get, ignored on Create/Update input.
strategies (list) --
Strategy types to enable. Defaults to [SEMANTIC, SUMMARIZATION].
(string) --
eventExpiryDuration (integer) --
Event retention in days. Defaults to 30.
encryptionKeyArn (string) --
Customer-managed KMS key. Defaults to Amazon Web Services-owned key. Not updatable after creation.
disabled (dict) --
Explicitly opt out of memory.
dict
The truncation configuration for managing conversation context when it exceeds model limits.
strategy (string) -- [REQUIRED]
The truncation strategy to use.
config (dict) --
The strategy-specific configuration.
slidingWindow (dict) --
Configuration for sliding window truncation.
messagesCount (integer) --
The number of recent messages to retain in the context window.
summarization (dict) --
Configuration for summarization-based truncation.
summaryRatio (float) --
The ratio of content to summarize.
preserveRecentMessages (integer) --
The number of recent messages to preserve without summarization.
summarizationSystemPrompt (string) --
The system prompt used for generating summaries.
list
The lifecycle hooks to run at defined points in the agent loop.
(dict) --
A lifecycle hook configuration. Specify one hook type.
beforeInvocation (dict) --
A hook that runs before an invocation begins.
name (string) -- [REQUIRED]
The name of the hook.
target (dict) -- [REQUIRED]
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) -- [REQUIRED]
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon EventBridge event bus to send hook events to.
afterInvocation (dict) --
A hook that runs after an invocation completes.
name (string) -- [REQUIRED]
The name of the hook.
target (dict) -- [REQUIRED]
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) -- [REQUIRED]
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon EventBridge event bus to send hook events to.
beforeToolCall (dict) --
A hook that runs before the agent calls a tool.
name (string) -- [REQUIRED]
The name of the hook.
target (dict) -- [REQUIRED]
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) -- [REQUIRED]
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon EventBridge event bus to send hook events to.
afterToolCall (dict) --
A hook that runs after a tool call completes.
name (string) -- [REQUIRED]
The name of the hook.
target (dict) -- [REQUIRED]
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) -- [REQUIRED]
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon EventBridge event bus to send hook events to.
integer
The maximum number of iterations the agent loop can execute per invocation.
integer
The maximum total number of output tokens the agent can generate across all model calls within a single invocation.
integer
The maximum duration in seconds for the agent loop execution per invocation.
dict
Tags to apply to the harness resource.
(string) --
(string) --
dict
Response Syntax
{
'harness': {
'harnessId': 'string',
'harnessName': 'string',
'arn': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED',
'harnessVersion': 'string',
'executionRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'model': {
'bedrockModelConfig': {
'modelId': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'converse_stream'|'responses'|'chat_completions',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'openAiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'chat_completions'|'responses',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'geminiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'topK': 123,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'liteLlmModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
}
},
'systemPrompt': [
{
'text': 'string'
},
],
'tools': [
{
'type': 'remote_mcp'|'agentcore_browser'|'agentcore_gateway'|'inline_function'|'agentcore_code_interpreter',
'name': 'string',
'config': {
'remoteMcp': {
'url': 'string',
'headers': {
'string': 'string'
},
'outboundAuth': {
'awsIam': {
'service': 'string',
'region': 'string'
},
'none': {}
}
},
'agentCoreBrowser': {
'browserArn': 'string'
},
'agentCoreGateway': {
'gatewayArn': 'string',
'outboundAuth': {
'awsIam': {},
'none': {},
'oauth': {
'providerArn': 'string',
'scopes': [
'string',
],
'customParameters': {
'string': 'string'
},
'grantType': 'CLIENT_CREDENTIALS'|'AUTHORIZATION_CODE'|'TOKEN_EXCHANGE',
'defaultReturnUrl': 'string'
}
}
},
'inlineFunction': {
'description': 'string',
'inputSchema': {...}|[...]|123|123.4|'string'|True|None
},
'agentCoreCodeInterpreter': {
'codeInterpreterArn': 'string'
}
}
},
],
'skills': [
{
'path': 'string',
's3': {
'uri': 'string'
},
'git': {
'url': 'string',
'path': 'string',
'auth': {
'credentialArn': 'string',
'username': 'string'
}
},
'awsSkills': {
'paths': [
'string',
]
}
},
],
'allowedTools': [
'string',
],
'truncation': {
'strategy': 'sliding_window'|'summarization'|'none',
'config': {
'slidingWindow': {
'messagesCount': 123
},
'summarization': {
'summaryRatio': ...,
'preserveRecentMessages': 123,
'summarizationSystemPrompt': 'string'
}
}
},
'environment': {
'agentCoreRuntimeEnvironment': {
'agentRuntimeArn': 'string',
'agentRuntimeName': 'string',
'agentRuntimeId': 'string',
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
]
}
},
'environmentArtifact': {
'containerConfiguration': {
'containerUri': 'string'
}
},
'environmentVariables': {
'string': 'string'
},
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'memory': {
'agentCoreMemoryConfiguration': {
'arn': 'string',
'actorId': 'string',
'messagesCount': 123,
'retrievalConfig': {
'string': {
'topK': 123,
'relevanceScore': ...,
'strategyId': 'string'
}
}
},
'managedMemoryConfiguration': {
'arn': 'string',
'strategies': [
'SEMANTIC'|'SUMMARIZATION'|'USER_PREFERENCE'|'EPISODIC',
],
'eventExpiryDuration': 123,
'encryptionKeyArn': 'string'
},
'disabled': {}
},
'hooks': [
{
'beforeInvocation': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'afterInvocation': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'beforeToolCall': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'afterToolCall': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
}
},
],
'maxIterations': 123,
'maxTokens': 123,
'timeoutSeconds': 123,
'failureReason': 'string'
}
}
Response Structure
(dict) --
harness (dict) --
The harness that was created.
harnessId (string) --
The ID of the harness.
harnessName (string) --
The name of the harness.
arn (string) --
The ARN of the harness.
status (string) --
The status of the harness.
harnessVersion (string) --
The version of the harness. Incremented on every successful UpdateHarness.
executionRoleArn (string) --
IAM role the harness assumes when running.
createdAt (datetime) --
The createdAt time of the harness.
updatedAt (datetime) --
The updatedAt time of the harness.
model (dict) --
The configuration of the default model used by the Harness.
bedrockModelConfig (dict) --
Configuration for an Amazon Bedrock model.
modelId (string) --
The Bedrock model ID.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the Bedrock provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
openAiModelConfig (dict) --
Configuration for an OpenAI model.
modelId (string) --
The OpenAI model ID.
apiKeyArn (string) --
The ARN of your OpenAI API key on AgentCore Identity.
apiBase (string) --
Optional custom endpoint URL for an OpenAI-compatible endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the OpenAI provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
geminiModelConfig (dict) --
Configuration for a Google Gemini model.
modelId (string) --
The Gemini model ID.
apiKeyArn (string) --
The ARN of your Gemini API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
topK (integer) --
The topK set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the Gemini model provider unchanged.
liteLlmModelConfig (dict) --
The LiteLLM model configuration for connecting to third-party model providers.
modelId (string) --
The LiteLLM model identifier (e.g., "anthropic/claude-3-sonnet").
apiKeyArn (string) --
The ARN of the API key in AgentCore Identity for authenticating with the model provider.
apiBase (string) --
The base URL for the model provider's API endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per iteration.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
systemPrompt (list) --
The system prompt of the harness.
(dict) --
A content block in the system prompt.
text (string) --
The text content of the system prompt block.
tools (list) --
The tools of the harness.
(dict) --
A tool available to the agent loop.
type (string) --
The type of tool.
name (string) --
Unique name for the tool. If not provided, a name will be inferred or generated.
config (dict) --
Tool-specific configuration.
remoteMcp (dict) --
Configuration for remote MCP server.
url (string) --
URL of the MCP endpoint.
headers (dict) --
Custom headers to include when connecting to the remote MCP server.
(string) --
The key of an HTTP header.
(string) --
The value of an HTTP header.
outboundAuth (dict) --
How the harness authenticates to this MCP server. Defaults to no authentication.
awsIam (dict) --
Sign requests to the remote MCP server with Signature Version 4 (SigV4) using the harness execution role. If you don't specify a Region, the harness Region is used.
service (string) --
The target Amazon Web Services service name used for SigV4 signing. This value identifies the service that the gateway authenticates with when making requests to the target endpoint.
region (string) --
The Amazon Web Services Region used for SigV4 signing. If not specified, defaults to the gateway's Region.
none (dict) --
No authentication.
agentCoreBrowser (dict) --
Configuration for AgentCore Browser.
browserArn (string) --
If not populated, the built-in Browser ARN is used.
agentCoreGateway (dict) --
Configuration for AgentCore Gateway.
gatewayArn (string) --
The ARN of the desired AgentCore Gateway.
outboundAuth (dict) --
How harness authenticates to this Gateway. Defaults to AWS_IAM (SigV4) if omitted.
awsIam (dict) --
SigV4-sign requests using the agent's execution role.
none (dict) --
No authentication.
oauth (dict) --
Use OAuth credentials for outbound authentication to the gateway.
The AUTHORIZATION_CODE grant type is not supported for outbound authentication from a harness to an AgentCore Gateway, even when defaultReturnUrl is specified.
providerArn (string) --
The Amazon Resource Name (ARN) of the OAuth credential provider. This ARN identifies the provider in Amazon Web Services.
scopes (list) --
The OAuth scopes for the credential provider. These scopes define the level of access requested from the OAuth provider.
(string) --
customParameters (dict) --
The custom parameters for the OAuth credential provider. These parameters provide additional configuration for the OAuth authentication process.
(string) --
(string) --
grantType (string) --
Specifies the kind of credentials to use for authorization:
CLIENT_CREDENTIALS - Authorization with a client ID and secret.
AUTHORIZATION_CODE - Authorization with a token that is specific to an individual end user.
TOKEN_EXCHANGE - Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience.
defaultReturnUrl (string) --
The URL where the end user's browser is redirected after obtaining the authorization code. Generally points to the customer's application.
inlineFunction (dict) --
Configuration for an inline function tool.
description (string) --
Description of what the tool does, provided to the model.
inputSchema (:ref:`document<document>`) --
JSON Schema describing the tool's input parameters.
agentCoreCodeInterpreter (dict) --
Configuration for AgentCore Code Interpreter.
codeInterpreterArn (string) --
If not populated, the built-in Code Interpreter ARN is used.
skills (list) --
The skills of the harness.
(dict) --
A skill available to the agent.
path (string) --
The filesystem path to the skill definition.
s3 (dict) --
An S3 source containing the skill.
uri (string) --
The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
git (dict) --
A git repository containing the skill.
url (string) --
The HTTPS URL of the git repository.
path (string) --
Subdirectory within the repository containing the skill.
auth (dict) --
Authentication configuration for private repositories.
credentialArn (string) --
The ARN of the credential in AgentCore Identity containing the password or personal access token.
username (string) --
Username for authentication. Defaults to 'oauth2' if not specified.
awsSkills (dict) --
Amazon Web Services Skills baked into the harness's underlying Runtime.
paths (list) --
Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
(string) --
allowedTools (list) --
The allowed tools of the harness. All tools are allowed by default.
(string) --
truncation (dict) --
Configuration for truncating model context.
strategy (string) --
The truncation strategy to use.
config (dict) --
The strategy-specific configuration.
slidingWindow (dict) --
Configuration for sliding window truncation.
messagesCount (integer) --
The number of recent messages to retain in the context window.
summarization (dict) --
Configuration for summarization-based truncation.
summaryRatio (float) --
The ratio of content to summarize.
preserveRecentMessages (integer) --
The number of recent messages to preserve without summarization.
summarizationSystemPrompt (string) --
The system prompt used for generating summaries.
environment (dict) --
The compute environment on which the Harness runs.
agentCoreRuntimeEnvironment (dict) --
The AgentCore Runtime environment configuration.
agentRuntimeArn (string) --
The ARN of the underlying AgentCore Runtime.
agentRuntimeName (string) --
The name of the underlying AgentCore Runtime.
agentRuntimeId (string) --
The ID of the underlying AgentCore Runtime.
lifecycleConfiguration (dict) --
The lifecycle configuration for the harness's runtime environment. For a harness, idleRuntimeSessionTimeout and maxLifetime each accept a value between 60 and 28800 seconds (8 hours), and idleRuntimeSessionTimeout must be less than or equal to maxLifetime.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
networkConfiguration (dict) --
SecurityConfig for the Agent.
networkMode (string) --
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) --
The security groups associated with the VPC configuration.
(string) --
subnets (list) --
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
filesystemConfigurations (list) --
The filesystem configurations for the runtime environment.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) --
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) --
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) --
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
environmentArtifact (dict) --
The environment artifact (e.g., container) in which the Harness operates.
containerConfiguration (dict) --
Representation of a container configuration.
containerUri (string) --
The ECR URI of the container.
environmentVariables (dict) --
Environment variables exposed in the environment in which the harness operates.
(string) --
(string) --
authorizerConfiguration (dict) --
Represents inbound authorization configuration options used to authenticate incoming requests.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
memory (dict) --
AgentCore Memory instance configuration for short and long term memory.
agentCoreMemoryConfiguration (dict) --
The AgentCore Memory configuration.
arn (string) --
The ARN of the AgentCore Memory resource.
actorId (string) --
The actor ID for memory operations.
messagesCount (integer) --
The number of messages to retrieve from memory.
retrievalConfig (dict) --
The retrieval configuration for long-term memory, mapping namespace path templates to retrieval settings.
(string) --
(dict) --
Configuration for memory retrieval within a namespace.
topK (integer) --
The maximum number of memory entries to retrieve.
relevanceScore (float) --
The minimum relevance score for retrieved memories.
strategyId (string) --
The ID of the retrieval strategy to use.
managedMemoryConfiguration (dict) --
Harness creates and manages a memory resource in the customer's account.
arn (string) --
The ARN of the managed AgentCore Memory resource. Read-only on Get, ignored on Create/Update input.
strategies (list) --
Strategy types to enable. Defaults to [SEMANTIC, SUMMARIZATION].
(string) --
eventExpiryDuration (integer) --
Event retention in days. Defaults to 30.
encryptionKeyArn (string) --
Customer-managed KMS key. Defaults to Amazon Web Services-owned key. Not updatable after creation.
disabled (dict) --
Explicitly opt out of memory.
hooks (list) --
The lifecycle hooks configured for the harness.
(dict) --
A lifecycle hook configuration. Specify one hook type.
beforeInvocation (dict) --
A hook that runs before an invocation begins.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
afterInvocation (dict) --
A hook that runs after an invocation completes.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
beforeToolCall (dict) --
A hook that runs before the agent calls a tool.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
afterToolCall (dict) --
A hook that runs after a tool call completes.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
maxIterations (integer) --
The maximum number of iterations in the agent loop allowed before exiting per invocation.
maxTokens (integer) --
The maximum total number of output tokens the agent can generate across all model calls within a single invocation.
timeoutSeconds (integer) --
The maximum duration per invocation.
failureReason (string) --
Reason why create or update operations fail.
{'oauth2ProviderConfigInput': {'customOauth2ProviderConfig': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Response {'oauth2ProviderConfigOutput': {'customOauth2ProviderConfig': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Creates a new OAuth2 credential provider.
See also: AWS API Documentation
Request Syntax
client.create_oauth2_credential_provider(
name='string',
credentialProviderVendor='GoogleOauth2'|'GithubOauth2'|'SlackOauth2'|'SalesforceOauth2'|'MicrosoftOauth2'|'CustomOauth2'|'AtlassianOauth2'|'LinkedinOauth2'|'XOauth2'|'OktaOauth2'|'OneLoginOauth2'|'PingOneOauth2'|'FacebookOauth2'|'YandexOauth2'|'RedditOauth2'|'ZoomOauth2'|'TwitchOauth2'|'SpotifyOauth2'|'DropboxOauth2'|'NotionOauth2'|'HubspotOauth2'|'CyberArkOauth2'|'FusionAuthOauth2'|'Auth0Oauth2'|'CognitoOauth2',
oauth2ProviderConfigInput={
'customOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL',
'onBehalfOfTokenExchangeConfig': {
'grantType': 'TOKEN_EXCHANGE'|'JWT_AUTHORIZATION_GRANT',
'tokenExchangeGrantTypeConfig': {
'actorTokenContent': 'NONE'|'M2M'|'AWS_IAM_ID_TOKEN_JWT',
'actorTokenScopes': [
'string',
]
},
'onBehalfOfAuthenticationConfig': {
'clientAuthenticationMethod': 'NO_CLIENT'
}
},
'clientAuthenticationMethod': 'CLIENT_SECRET_BASIC'|'CLIENT_SECRET_POST'|'AWS_IAM_ID_TOKEN_JWT'|'PRIVATE_KEY_JWT',
'privateKeyJwtConfig': {
'privateKeySource': {
'kmsKeySource': {
'kmsKeyArn': 'string'
}
},
'signingAlgorithm': 'RS256'|'PS256'|'ES256',
'additionalHeaderClaims': {
'string': 'string'
},
'additionalPayloadClaims': {
'string': 'string'
}
},
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
]
},
'googleOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL'
},
'githubOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL'
},
'slackOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL'
},
'salesforceOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL'
},
'microsoftOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL',
'tenantId': 'string'
},
'atlassianOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL'
},
'linkedinOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL'
},
'includedOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL',
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string'
}
},
tags={
'string': 'string'
}
)
string
[REQUIRED]
The name of the OAuth2 credential provider. The name must be unique within your account.
string
[REQUIRED]
The vendor of the OAuth2 credential provider. This specifies which OAuth2 implementation to use.
dict
[REQUIRED]
The configuration settings for the OAuth2 provider, including client ID, client secret, and other vendor-specific settings.
customOauth2ProviderConfig (dict) --
The configuration for a custom OAuth2 provider.
oauthDiscovery (dict) -- [REQUIRED]
The OAuth2 discovery information for the custom provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) -- [REQUIRED]
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) -- [REQUIRED]
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) -- [REQUIRED]
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the custom OAuth2 provider.
clientSecret (string) --
The client secret for the custom OAuth2 provider.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
onBehalfOfTokenExchangeConfig (dict) --
The configuration for on-behalf-of token exchange. This enables authentication flows that use RFC 8693 token exchange or RFC 7523 JWT authorization grants.
grantType (string) -- [REQUIRED]
The grant type for the on-behalf-of token exchange.
tokenExchangeGrantTypeConfig (dict) --
Configuration specific to the TOKEN_EXCHANGE grant type (RFC 8693).
actorTokenContent (string) -- [REQUIRED]
The content type for the actor token in the token exchange.
actorTokenScopes (list) --
The scopes for the actor token. Only valid when actorTokenContent is M2M.
(string) --
onBehalfOfAuthenticationConfig (dict) --
Specify the client authentication configuration to use for the on-behalf-of token exchange. With this configuration, you override the provider level client authentication method for the on-behalf-of exchange with the identity provider. If you don't specify this configuration, we use the provider level client authentication method.
clientAuthenticationMethod (string) -- [REQUIRED]
The client authentication method to use during the on-behalf-of token exchange. The NO_CLIENT option omits the clientId and clientSecret during the on-behalf-of token exchange with the identity provider.
clientAuthenticationMethod (string) --
The client authentication method to use when authenticating with the token endpoint.
privateKeyJwtConfig (dict) --
The private_key_jwt client authentication configuration for this credential provider. When specified, the credential provider uses JWT client assertions to authenticate with the token endpoint.
privateKeySource (dict) --
The private key source for the JWT client assertion.
kmsKeySource (dict) --
The KMS key source for the JWT client assertion.
kmsKeyArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the KMS key used to sign the JWT client assertion. The key must be an asymmetric key with key usage SIGN_VERIFY and a key spec compatible with the configured signing algorithm.
signingAlgorithm (string) --
The algorithm used to sign the JWT client assertion. Valid values are RS256, PS256, and ES256.
additionalHeaderClaims (dict) --
A map of additional claims to include in the JWT client assertion header. Standard header claims such as alg and typ cannot be added.
(string) --
(string) --
additionalPayloadClaims (dict) --
A map of additional claims to include in the JWT client assertion payload. Payload claims generated by the service, such as iss, sub, jti, and exp, cannot be added.
(string) --
(string) --
privateEndpoint (dict) --
The default private endpoint for the custom OAuth2 provider, enabling secure connectivity through a VPC Lattice resource configuration.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom OAuth2 provider configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) -- [REQUIRED]
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
googleOauth2ProviderConfig (dict) --
The configuration for a Google OAuth2 provider.
clientId (string) -- [REQUIRED]
The client ID for the Google OAuth2 provider.
clientSecret (string) --
The client secret for the Google OAuth2 provider.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
githubOauth2ProviderConfig (dict) --
The configuration for a GitHub OAuth2 provider.
clientId (string) -- [REQUIRED]
The client ID for the GitHub OAuth2 provider.
clientSecret (string) --
The client secret for the GitHub OAuth2 provider.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
slackOauth2ProviderConfig (dict) --
The configuration for a Slack OAuth2 provider.
clientId (string) -- [REQUIRED]
The client ID for the Slack OAuth2 provider.
clientSecret (string) --
The client secret for the Slack OAuth2 provider.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
salesforceOauth2ProviderConfig (dict) --
The configuration for a Salesforce OAuth2 provider.
clientId (string) -- [REQUIRED]
The client ID for the Salesforce OAuth2 provider.
clientSecret (string) --
The client secret for the Salesforce OAuth2 provider.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
microsoftOauth2ProviderConfig (dict) --
The configuration for a Microsoft OAuth2 provider.
clientId (string) -- [REQUIRED]
The client ID for the Microsoft OAuth2 provider.
clientSecret (string) --
The client secret for the Microsoft OAuth2 provider.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
tenantId (string) --
The Microsoft Entra ID (formerly Azure AD) tenant ID for your organization. This identifies the specific tenant within Microsoft's identity platform where your application is registered.
atlassianOauth2ProviderConfig (dict) --
Configuration settings for Atlassian OAuth2 provider integration.
clientId (string) -- [REQUIRED]
The client ID for the Atlassian OAuth2 provider. This identifier is assigned by Atlassian when you register your application.
clientSecret (string) --
The client secret for the Atlassian OAuth2 provider. This secret is assigned by Atlassian and used along with the client ID to authenticate your application.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret for the Atlassian OAuth2 provider. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
linkedinOauth2ProviderConfig (dict) --
Configuration settings for LinkedIn OAuth2 provider integration.
clientId (string) -- [REQUIRED]
The client ID for the LinkedIn OAuth2 provider. This identifier is assigned by LinkedIn when you register your application.
clientSecret (string) --
The client secret for the LinkedIn OAuth2 provider. This secret is assigned by LinkedIn and used along with the client ID to authenticate your application.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
includedOauth2ProviderConfig (dict) --
The configuration for a non-custom OAuth2 provider. This includes settings for supported OAuth2 providers that have built-in integration support.
clientId (string) -- [REQUIRED]
The client ID for the supported OAuth2 provider. This identifier is assigned by the OAuth2 provider when you register your application.
clientSecret (string) --
The client secret for the supported OAuth2 provider. This secret is assigned by the OAuth2 provider and used along with the client ID to authenticate your application.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
issuer (string) --
Token issuer of your isolated OAuth2 application tenant. This URL identifies the authorization server that issues tokens for this provider.
authorizationEndpoint (string) --
OAuth2 authorization endpoint for your isolated OAuth2 application tenant. This is where users are redirected to authenticate and authorize access to their resources.
tokenEndpoint (string) --
OAuth2 token endpoint for your isolated OAuth2 application tenant. This is where authorization codes are exchanged for access tokens.
dict
A map of tag keys and values to assign to the OAuth2 credential provider. Tags enable you to categorize your resources in different ways, for example, by purpose, owner, or environment.
(string) --
(string) --
dict
Response Syntax
{
'clientSecretArn': {
'secretArn': 'string'
},
'clientSecretJsonKey': 'string',
'clientSecretSource': 'MANAGED'|'EXTERNAL',
'name': 'string',
'credentialProviderArn': 'string',
'callbackUrl': 'string',
'oauth2ProviderConfigOutput': {
'customOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string',
'onBehalfOfTokenExchangeConfig': {
'grantType': 'TOKEN_EXCHANGE'|'JWT_AUTHORIZATION_GRANT',
'tokenExchangeGrantTypeConfig': {
'actorTokenContent': 'NONE'|'M2M'|'AWS_IAM_ID_TOKEN_JWT',
'actorTokenScopes': [
'string',
]
},
'onBehalfOfAuthenticationConfig': {
'clientAuthenticationMethod': 'NO_CLIENT'
}
},
'clientAuthenticationMethod': 'CLIENT_SECRET_BASIC'|'CLIENT_SECRET_POST'|'AWS_IAM_ID_TOKEN_JWT'|'PRIVATE_KEY_JWT',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'privateKeyJwtConfig': {
'privateKeySource': {
'kmsKeySource': {
'kmsKeyArn': 'string'
}
},
'signingAlgorithm': 'RS256'|'PS256'|'ES256',
'additionalHeaderClaims': {
'string': 'string'
},
'additionalPayloadClaims': {
'string': 'string'
}
}
},
'googleOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'githubOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'slackOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'salesforceOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'microsoftOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'atlassianOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'linkedinOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'includedOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
}
},
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED'
}
Response Structure
(dict) --
clientSecretArn (dict) --
The Amazon Resource Name (ARN) of the client secret in Amazon Web Services Secrets Manager.
secretArn (string) --
The Amazon Resource Name (ARN) of the secret in Amazon Web Services Secrets Manager.
clientSecretJsonKey (string) --
The JSON key used to extract the client secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Either MANAGED if the secret is managed by the service, or EXTERNAL if managed by the user in Amazon Web Services Secrets Manager.
name (string) --
The name of the OAuth2 credential provider.
credentialProviderArn (string) --
The Amazon Resource Name (ARN) of the OAuth2 credential provider.
callbackUrl (string) --
Callback URL to register on the OAuth2 credential provider as an allowed callback URL. This URL is where the OAuth2 authorization server redirects users after they complete the authorization flow.
oauth2ProviderConfigOutput (dict) --
Contains the output configuration for an OAuth2 provider.
customOauth2ProviderConfig (dict) --
The output configuration for a custom OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the custom provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the custom OAuth2 provider.
onBehalfOfTokenExchangeConfig (dict) --
The configuration for on-behalf-of token exchange.
grantType (string) --
The grant type for the on-behalf-of token exchange.
tokenExchangeGrantTypeConfig (dict) --
Configuration specific to the TOKEN_EXCHANGE grant type (RFC 8693).
actorTokenContent (string) --
The content type for the actor token in the token exchange.
actorTokenScopes (list) --
The scopes for the actor token. Only valid when actorTokenContent is M2M.
(string) --
onBehalfOfAuthenticationConfig (dict) --
Specify the client authentication configuration to use for the on-behalf-of token exchange. With this configuration, you override the provider level client authentication method for the on-behalf-of exchange with the identity provider. If you don't specify this configuration, we use the provider level client authentication method.
clientAuthenticationMethod (string) --
The client authentication method to use during the on-behalf-of token exchange. The NO_CLIENT option omits the clientId and clientSecret during the on-behalf-of token exchange with the identity provider.
clientAuthenticationMethod (string) --
The client authentication method used when authenticating with the token endpoint.
privateEndpoint (dict) --
The default private endpoint for the custom OAuth2 provider, enabling secure connectivity through a VPC Lattice resource configuration.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom OAuth2 provider configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
privateKeyJwtConfig (dict) --
The configuration for private_key_jwt client authentication used by this OAuth2 credential provider.
privateKeySource (dict) --
The private key source for the JWT client assertion.
kmsKeySource (dict) --
The KMS key source for the JWT client assertion.
kmsKeyArn (string) --
The Amazon Resource Name (ARN) of the KMS key used to sign the JWT client assertion. The key must be an asymmetric key with key usage SIGN_VERIFY and a key spec compatible with the configured signing algorithm.
signingAlgorithm (string) --
The algorithm used to sign the JWT client assertion. Valid values are RS256, PS256, and ES256.
additionalHeaderClaims (dict) --
A map of additional claims to include in the JWT client assertion header. Standard header claims such as alg and typ cannot be added.
(string) --
(string) --
additionalPayloadClaims (dict) --
A map of additional claims to include in the JWT client assertion payload. Payload claims generated by the service, such as iss, sub, jti, and exp, cannot be added.
(string) --
(string) --
googleOauth2ProviderConfig (dict) --
The output configuration for a Google OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the Google provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Google OAuth2 provider.
githubOauth2ProviderConfig (dict) --
The output configuration for a GitHub OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the GitHub provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the GitHub OAuth2 provider.
slackOauth2ProviderConfig (dict) --
The output configuration for a Slack OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the Slack provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Slack OAuth2 provider.
salesforceOauth2ProviderConfig (dict) --
The output configuration for a Salesforce OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the Salesforce provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Salesforce OAuth2 provider.
microsoftOauth2ProviderConfig (dict) --
The output configuration for a Microsoft OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the Microsoft provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Microsoft OAuth2 provider.
atlassianOauth2ProviderConfig (dict) --
The configuration details for the Atlassian OAuth2 provider.
oauthDiscovery (dict) --
Contains the discovery information for an OAuth2 provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Atlassian OAuth2 provider.
linkedinOauth2ProviderConfig (dict) --
The configuration details for the LinkedIn OAuth2 provider.
oauthDiscovery (dict) --
Contains the discovery information for an OAuth2 provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the LinkedIn OAuth2 provider.
includedOauth2ProviderConfig (dict) --
The configuration for a non-custom OAuth2 provider. This includes the configuration details for supported OAuth2 providers that have built-in integration support.
oauthDiscovery (dict) --
Contains the discovery information for an OAuth2 provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the supported OAuth2 provider.
status (string) --
The current status of the OAuth2 credential provider.
{'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Creates a new payment manager in your Amazon Web Services account. A payment manager serves as the top-level resource for managing payment processing capabilities, including payment connectors that integrate with supported payment providers.
If you specify CUSTOM_JWT as the authorizerType, you must provide an authorizerConfiguration.
See also: AWS API Documentation
Request Syntax
client.create_payment_manager(
name='string',
description='string',
authorizerType='CUSTOM_JWT'|'AWS_IAM',
authorizerConfiguration={
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
roleArn='string',
clientToken='string',
tags={
'string': 'string'
},
kmsKeyArn='string'
)
string
[REQUIRED]
The name of the payment manager.
string
A description of the payment manager.
string
[REQUIRED]
The type of authorizer to use for the payment manager.
CUSTOM_JWT - Authorize with a bearer token.
AWS_IAM - Authorize with your Amazon Web Services IAM credentials.
dict
The authorizer configuration for the payment manager.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) -- [REQUIRED]
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
string
[REQUIRED]
The Amazon Resource Name (ARN) of the IAM role that the payment manager assumes to access resources on your behalf.
string
A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If you don't specify this field, a value is randomly generated for you. If this token matches a previous request, the service ignores the request, but doesn't return an error. For more information, see Ensuring idempotency.
This field is autopopulated if not provided.
dict
A map of tag keys and values to assign to the payment manager.
(string) --
(string) --
string
The Amazon Resource Name (ARN) of the customer managed KMS key to use for encrypting sensitive payment manager data at rest. If you don't specify a key, the data is encrypted with an Amazon Web Services owned key.
dict
Response Syntax
{
'paymentManagerArn': 'string',
'paymentManagerId': 'string',
'name': 'string',
'authorizerType': 'CUSTOM_JWT'|'AWS_IAM',
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'roleArn': 'string',
'workloadIdentityDetails': {
'workloadIdentityArn': 'string'
},
'createdAt': datetime(2015, 1, 1),
'status': 'CREATING'|'UPDATING'|'DELETING'|'READY'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETE_FAILED',
'tags': {
'string': 'string'
},
'kmsKeyArn': 'string'
}
Response Structure
(dict) --
paymentManagerArn (string) --
The Amazon Resource Name (ARN) of the created payment manager.
paymentManagerId (string) --
The unique identifier of the created payment manager.
name (string) --
The name of the created payment manager.
authorizerType (string) --
The type of authorizer for the created payment manager.
authorizerConfiguration (dict) --
Represents inbound authorization configuration options used to authenticate incoming requests.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
roleArn (string) --
The Amazon Resource Name (ARN) of the IAM role associated with the created payment manager.
workloadIdentityDetails (dict) --
The information about the workload identity.
workloadIdentityArn (string) --
The ARN associated with the workload identity.
createdAt (datetime) --
The timestamp when the payment manager was created.
status (string) --
The current status of the payment manager. Possible values include CREATING, READY, UPDATING, DELETING, CREATE_FAILED, UPDATE_FAILED, and DELETE_FAILED.
tags (dict) --
The tags associated with the created payment manager.
(string) --
(string) --
kmsKeyArn (string) --
The Amazon Resource Name (ARN) of the KMS key used to encrypt sensitive payment manager data at rest, if configured.
{'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Creates a new registry in your Amazon Web Services account. A registry serves as a centralized catalog for organizing and managing registry records, including MCP servers, A2A agents, agent skills, and custom resource types.
If you specify CUSTOM_JWT as the authorizerType, you must provide an authorizerConfiguration.
See also: AWS API Documentation
Request Syntax
client.create_registry(
name='string',
description='string',
authorizerType='CUSTOM_JWT'|'AWS_IAM',
authorizerConfiguration={
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
clientToken='string',
approvalConfiguration={
'autoApproval': True|False
}
)
string
[REQUIRED]
The name of the registry. The name must be unique within your account and can contain alphanumeric characters and underscores.
string
A description of the registry.
string
The type of authorizer to use for the registry. This controls the authorization method for the Search and Invoke APIs used by consumers, and does not affect the standard CRUDL APIs for registry and registry record management used by administrators.
CUSTOM_JWT - Authorize with a bearer token.
AWS_IAM - Authorize with your Amazon Web Services IAM credentials.
dict
The authorizer configuration for the registry. Required if authorizerType is CUSTOM_JWT. For details, see the AuthorizerConfiguration data type.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) -- [REQUIRED]
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
string
A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If you don't specify this field, a value is randomly generated for you. If this token matches a previous request, the service ignores the request, but doesn't return an error. For more information, see Ensuring idempotency.
This field is autopopulated if not provided.
dict
The approval configuration for registry records. Controls whether records require explicit approval before becoming active. See the ApprovalConfiguration data type for supported configuration options.
autoApproval (boolean) --
Whether registry records are auto-approved. When set to true, records are automatically approved upon creation. When set to false (the default), records require explicit approval for security purposes.
dict
Response Syntax
{
'registryArn': 'string'
}
Response Structure
(dict) --
registryArn (string) --
The Amazon Resource Name (ARN) of the created registry.
{'harness': {'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}},
'tools': {'config': {'remoteMcp': {'outboundAuth': {'awsIam': {'region': 'string',
'service': 'string'},
'none': {}}}}}}}
Operation to delete a Harness.
See also: AWS API Documentation
Request Syntax
client.delete_harness(
harnessId='string',
clientToken='string',
deleteManagedMemory=True|False
)
string
[REQUIRED]
The ID of the harness to delete.
string
A unique, case-sensitive identifier to ensure idempotency of the request.
This field is autopopulated if not provided.
boolean
Whether to delete the managed memory on harness deletion. Default: true. If false, the memory is disassociated and becomes a regular customer-owned resource.
dict
Response Syntax
{
'harness': {
'harnessId': 'string',
'harnessName': 'string',
'arn': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED',
'harnessVersion': 'string',
'executionRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'model': {
'bedrockModelConfig': {
'modelId': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'converse_stream'|'responses'|'chat_completions',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'openAiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'chat_completions'|'responses',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'geminiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'topK': 123,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'liteLlmModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
}
},
'systemPrompt': [
{
'text': 'string'
},
],
'tools': [
{
'type': 'remote_mcp'|'agentcore_browser'|'agentcore_gateway'|'inline_function'|'agentcore_code_interpreter',
'name': 'string',
'config': {
'remoteMcp': {
'url': 'string',
'headers': {
'string': 'string'
},
'outboundAuth': {
'awsIam': {
'service': 'string',
'region': 'string'
},
'none': {}
}
},
'agentCoreBrowser': {
'browserArn': 'string'
},
'agentCoreGateway': {
'gatewayArn': 'string',
'outboundAuth': {
'awsIam': {},
'none': {},
'oauth': {
'providerArn': 'string',
'scopes': [
'string',
],
'customParameters': {
'string': 'string'
},
'grantType': 'CLIENT_CREDENTIALS'|'AUTHORIZATION_CODE'|'TOKEN_EXCHANGE',
'defaultReturnUrl': 'string'
}
}
},
'inlineFunction': {
'description': 'string',
'inputSchema': {...}|[...]|123|123.4|'string'|True|None
},
'agentCoreCodeInterpreter': {
'codeInterpreterArn': 'string'
}
}
},
],
'skills': [
{
'path': 'string',
's3': {
'uri': 'string'
},
'git': {
'url': 'string',
'path': 'string',
'auth': {
'credentialArn': 'string',
'username': 'string'
}
},
'awsSkills': {
'paths': [
'string',
]
}
},
],
'allowedTools': [
'string',
],
'truncation': {
'strategy': 'sliding_window'|'summarization'|'none',
'config': {
'slidingWindow': {
'messagesCount': 123
},
'summarization': {
'summaryRatio': ...,
'preserveRecentMessages': 123,
'summarizationSystemPrompt': 'string'
}
}
},
'environment': {
'agentCoreRuntimeEnvironment': {
'agentRuntimeArn': 'string',
'agentRuntimeName': 'string',
'agentRuntimeId': 'string',
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
]
}
},
'environmentArtifact': {
'containerConfiguration': {
'containerUri': 'string'
}
},
'environmentVariables': {
'string': 'string'
},
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'memory': {
'agentCoreMemoryConfiguration': {
'arn': 'string',
'actorId': 'string',
'messagesCount': 123,
'retrievalConfig': {
'string': {
'topK': 123,
'relevanceScore': ...,
'strategyId': 'string'
}
}
},
'managedMemoryConfiguration': {
'arn': 'string',
'strategies': [
'SEMANTIC'|'SUMMARIZATION'|'USER_PREFERENCE'|'EPISODIC',
],
'eventExpiryDuration': 123,
'encryptionKeyArn': 'string'
},
'disabled': {}
},
'hooks': [
{
'beforeInvocation': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'afterInvocation': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'beforeToolCall': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'afterToolCall': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
}
},
],
'maxIterations': 123,
'maxTokens': 123,
'timeoutSeconds': 123,
'failureReason': 'string'
}
}
Response Structure
(dict) --
harness (dict) --
The harness that was deleted.
harnessId (string) --
The ID of the harness.
harnessName (string) --
The name of the harness.
arn (string) --
The ARN of the harness.
status (string) --
The status of the harness.
harnessVersion (string) --
The version of the harness. Incremented on every successful UpdateHarness.
executionRoleArn (string) --
IAM role the harness assumes when running.
createdAt (datetime) --
The createdAt time of the harness.
updatedAt (datetime) --
The updatedAt time of the harness.
model (dict) --
The configuration of the default model used by the Harness.
bedrockModelConfig (dict) --
Configuration for an Amazon Bedrock model.
modelId (string) --
The Bedrock model ID.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the Bedrock provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
openAiModelConfig (dict) --
Configuration for an OpenAI model.
modelId (string) --
The OpenAI model ID.
apiKeyArn (string) --
The ARN of your OpenAI API key on AgentCore Identity.
apiBase (string) --
Optional custom endpoint URL for an OpenAI-compatible endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the OpenAI provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
geminiModelConfig (dict) --
Configuration for a Google Gemini model.
modelId (string) --
The Gemini model ID.
apiKeyArn (string) --
The ARN of your Gemini API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
topK (integer) --
The topK set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the Gemini model provider unchanged.
liteLlmModelConfig (dict) --
The LiteLLM model configuration for connecting to third-party model providers.
modelId (string) --
The LiteLLM model identifier (e.g., "anthropic/claude-3-sonnet").
apiKeyArn (string) --
The ARN of the API key in AgentCore Identity for authenticating with the model provider.
apiBase (string) --
The base URL for the model provider's API endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per iteration.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
systemPrompt (list) --
The system prompt of the harness.
(dict) --
A content block in the system prompt.
text (string) --
The text content of the system prompt block.
tools (list) --
The tools of the harness.
(dict) --
A tool available to the agent loop.
type (string) --
The type of tool.
name (string) --
Unique name for the tool. If not provided, a name will be inferred or generated.
config (dict) --
Tool-specific configuration.
remoteMcp (dict) --
Configuration for remote MCP server.
url (string) --
URL of the MCP endpoint.
headers (dict) --
Custom headers to include when connecting to the remote MCP server.
(string) --
The key of an HTTP header.
(string) --
The value of an HTTP header.
outboundAuth (dict) --
How the harness authenticates to this MCP server. Defaults to no authentication.
awsIam (dict) --
Sign requests to the remote MCP server with Signature Version 4 (SigV4) using the harness execution role. If you don't specify a Region, the harness Region is used.
service (string) --
The target Amazon Web Services service name used for SigV4 signing. This value identifies the service that the gateway authenticates with when making requests to the target endpoint.
region (string) --
The Amazon Web Services Region used for SigV4 signing. If not specified, defaults to the gateway's Region.
none (dict) --
No authentication.
agentCoreBrowser (dict) --
Configuration for AgentCore Browser.
browserArn (string) --
If not populated, the built-in Browser ARN is used.
agentCoreGateway (dict) --
Configuration for AgentCore Gateway.
gatewayArn (string) --
The ARN of the desired AgentCore Gateway.
outboundAuth (dict) --
How harness authenticates to this Gateway. Defaults to AWS_IAM (SigV4) if omitted.
awsIam (dict) --
SigV4-sign requests using the agent's execution role.
none (dict) --
No authentication.
oauth (dict) --
Use OAuth credentials for outbound authentication to the gateway.
The AUTHORIZATION_CODE grant type is not supported for outbound authentication from a harness to an AgentCore Gateway, even when defaultReturnUrl is specified.
providerArn (string) --
The Amazon Resource Name (ARN) of the OAuth credential provider. This ARN identifies the provider in Amazon Web Services.
scopes (list) --
The OAuth scopes for the credential provider. These scopes define the level of access requested from the OAuth provider.
(string) --
customParameters (dict) --
The custom parameters for the OAuth credential provider. These parameters provide additional configuration for the OAuth authentication process.
(string) --
(string) --
grantType (string) --
Specifies the kind of credentials to use for authorization:
CLIENT_CREDENTIALS - Authorization with a client ID and secret.
AUTHORIZATION_CODE - Authorization with a token that is specific to an individual end user.
TOKEN_EXCHANGE - Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience.
defaultReturnUrl (string) --
The URL where the end user's browser is redirected after obtaining the authorization code. Generally points to the customer's application.
inlineFunction (dict) --
Configuration for an inline function tool.
description (string) --
Description of what the tool does, provided to the model.
inputSchema (:ref:`document<document>`) --
JSON Schema describing the tool's input parameters.
agentCoreCodeInterpreter (dict) --
Configuration for AgentCore Code Interpreter.
codeInterpreterArn (string) --
If not populated, the built-in Code Interpreter ARN is used.
skills (list) --
The skills of the harness.
(dict) --
A skill available to the agent.
path (string) --
The filesystem path to the skill definition.
s3 (dict) --
An S3 source containing the skill.
uri (string) --
The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
git (dict) --
A git repository containing the skill.
url (string) --
The HTTPS URL of the git repository.
path (string) --
Subdirectory within the repository containing the skill.
auth (dict) --
Authentication configuration for private repositories.
credentialArn (string) --
The ARN of the credential in AgentCore Identity containing the password or personal access token.
username (string) --
Username for authentication. Defaults to 'oauth2' if not specified.
awsSkills (dict) --
Amazon Web Services Skills baked into the harness's underlying Runtime.
paths (list) --
Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
(string) --
allowedTools (list) --
The allowed tools of the harness. All tools are allowed by default.
(string) --
truncation (dict) --
Configuration for truncating model context.
strategy (string) --
The truncation strategy to use.
config (dict) --
The strategy-specific configuration.
slidingWindow (dict) --
Configuration for sliding window truncation.
messagesCount (integer) --
The number of recent messages to retain in the context window.
summarization (dict) --
Configuration for summarization-based truncation.
summaryRatio (float) --
The ratio of content to summarize.
preserveRecentMessages (integer) --
The number of recent messages to preserve without summarization.
summarizationSystemPrompt (string) --
The system prompt used for generating summaries.
environment (dict) --
The compute environment on which the Harness runs.
agentCoreRuntimeEnvironment (dict) --
The AgentCore Runtime environment configuration.
agentRuntimeArn (string) --
The ARN of the underlying AgentCore Runtime.
agentRuntimeName (string) --
The name of the underlying AgentCore Runtime.
agentRuntimeId (string) --
The ID of the underlying AgentCore Runtime.
lifecycleConfiguration (dict) --
The lifecycle configuration for the harness's runtime environment. For a harness, idleRuntimeSessionTimeout and maxLifetime each accept a value between 60 and 28800 seconds (8 hours), and idleRuntimeSessionTimeout must be less than or equal to maxLifetime.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
networkConfiguration (dict) --
SecurityConfig for the Agent.
networkMode (string) --
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) --
The security groups associated with the VPC configuration.
(string) --
subnets (list) --
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
filesystemConfigurations (list) --
The filesystem configurations for the runtime environment.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) --
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) --
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) --
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
environmentArtifact (dict) --
The environment artifact (e.g., container) in which the Harness operates.
containerConfiguration (dict) --
Representation of a container configuration.
containerUri (string) --
The ECR URI of the container.
environmentVariables (dict) --
Environment variables exposed in the environment in which the harness operates.
(string) --
(string) --
authorizerConfiguration (dict) --
Represents inbound authorization configuration options used to authenticate incoming requests.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
memory (dict) --
AgentCore Memory instance configuration for short and long term memory.
agentCoreMemoryConfiguration (dict) --
The AgentCore Memory configuration.
arn (string) --
The ARN of the AgentCore Memory resource.
actorId (string) --
The actor ID for memory operations.
messagesCount (integer) --
The number of messages to retrieve from memory.
retrievalConfig (dict) --
The retrieval configuration for long-term memory, mapping namespace path templates to retrieval settings.
(string) --
(dict) --
Configuration for memory retrieval within a namespace.
topK (integer) --
The maximum number of memory entries to retrieve.
relevanceScore (float) --
The minimum relevance score for retrieved memories.
strategyId (string) --
The ID of the retrieval strategy to use.
managedMemoryConfiguration (dict) --
Harness creates and manages a memory resource in the customer's account.
arn (string) --
The ARN of the managed AgentCore Memory resource. Read-only on Get, ignored on Create/Update input.
strategies (list) --
Strategy types to enable. Defaults to [SEMANTIC, SUMMARIZATION].
(string) --
eventExpiryDuration (integer) --
Event retention in days. Defaults to 30.
encryptionKeyArn (string) --
Customer-managed KMS key. Defaults to Amazon Web Services-owned key. Not updatable after creation.
disabled (dict) --
Explicitly opt out of memory.
hooks (list) --
The lifecycle hooks configured for the harness.
(dict) --
A lifecycle hook configuration. Specify one hook type.
beforeInvocation (dict) --
A hook that runs before an invocation begins.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
afterInvocation (dict) --
A hook that runs after an invocation completes.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
beforeToolCall (dict) --
A hook that runs before the agent calls a tool.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
afterToolCall (dict) --
A hook that runs after a tool call completes.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
maxIterations (integer) --
The maximum number of iterations in the agent loop allowed before exiting per invocation.
maxTokens (integer) --
The maximum total number of output tokens the agent can generate across all model calls within a single invocation.
timeoutSeconds (integer) --
The maximum duration per invocation.
failureReason (string) --
Reason why create or update operations fail.
{'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Gets an Amazon Bedrock AgentCore Runtime.
See also: AWS API Documentation
Request Syntax
client.get_agent_runtime(
agentRuntimeId='string',
agentRuntimeVersion='string'
)
string
[REQUIRED]
The unique identifier of the AgentCore Runtime to retrieve.
string
The version of the AgentCore Runtime to retrieve.
dict
Response Syntax
{
'agentRuntimeArn': 'string',
'agentRuntimeName': 'string',
'agentRuntimeId': 'string',
'agentRuntimeVersion': 'string',
'createdAt': datetime(2015, 1, 1),
'lastUpdatedAt': datetime(2015, 1, 1),
'roleArn': 'string',
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED',
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'hooksConfiguration': {
'build': {
'warmup': {
'action': {
'httpPost': {
'path': 'string',
'port': 123
}
}
}
}
},
'failureReason': 'string',
'description': 'string',
'workloadIdentityDetails': {
'workloadIdentityArn': 'string'
},
'agentRuntimeArtifact': {
'containerConfiguration': {
'containerUri': 'string'
},
'codeConfiguration': {
'code': {
's3': {
'bucket': 'string',
'prefix': 'string',
'versionId': 'string'
}
},
'runtime': 'PYTHON_3_10'|'PYTHON_3_11'|'PYTHON_3_12'|'PYTHON_3_13'|'PYTHON_3_14'|'NODE_22',
'entryPoint': [
'string',
]
}
},
'protocolConfiguration': {
'serverProtocol': 'MCP'|'HTTP'|'A2A'|'AGUI',
'port': 123,
'path': 'string'
},
'environmentVariables': {
'string': 'string'
},
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'requestHeaderConfiguration': {
'requestHeaderAllowlist': [
'string',
]
},
'metadataConfiguration': {
'requireMMDSV2': True|False
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
],
'capacityProviderConfiguration': {
'capacityProviderArn': 'string'
},
'platformVersion': 'string',
'allowedPorts': [
{
'port': 123,
'portRange': {
'from': 123,
'to': 123
}
},
],
'resourceConfigurations': [
{
'minimumMemoryInMiB': 123
},
]
}
Response Structure
(dict) --
agentRuntimeArn (string) --
The Amazon Resource Name (ARN) of the AgentCore Runtime.
agentRuntimeName (string) --
The name of the AgentCore Runtime.
agentRuntimeId (string) --
The unique identifier of the AgentCore Runtime.
agentRuntimeVersion (string) --
The version of the AgentCore Runtime.
createdAt (datetime) --
The timestamp when the AgentCore Runtime was created.
lastUpdatedAt (datetime) --
The timestamp when the AgentCore Runtime was last updated.
roleArn (string) --
The IAM role ARN that provides permissions for the AgentCore Runtime.
networkConfiguration (dict) --
The network configuration for the AgentCore Runtime.
networkMode (string) --
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) --
The security groups associated with the VPC configuration.
(string) --
subnets (list) --
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
status (string) --
The current status of the AgentCore Runtime.
lifecycleConfiguration (dict) --
The life cycle configuration for the AgentCore Runtime.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
hooksConfiguration (dict) --
The lifecycle hooks configuration for the AgentCore Runtime.
build (dict) --
The hooks that run when you create or update the AgentCore Runtime, before any sessions are created.
warmup (dict) --
The hook that warms up your agent before any sessions are created. Use this hook to load the resources that your sessions need, such as models, libraries, or caches. Your hook must complete within 120 seconds.
action (dict) --
The action that AgentCore Runtime runs for the hook. Specify exactly one action.
httpPost (dict) --
Sends an HTTP POST request to your agent's container on the specified port and path to run the hook. The hook succeeds if your container returns a 2xx response. The hook fails if your container returns any other response or doesn't respond before the hook times out.
path (string) --
The path in the agent's container that AgentCore Runtime sends the POST request to.
port (integer) --
The port in the agent's container that AgentCore Runtime sends the POST request to. If you don't specify a port, the default is the runtime's server port: the port in the protocol configuration if one is set, otherwise the protocol's default port.
failureReason (string) --
The reason for failure if the AgentCore Runtime is in a failed state.
description (string) --
The description of the AgentCore Runtime.
workloadIdentityDetails (dict) --
The workload identity details for the AgentCore Runtime.
workloadIdentityArn (string) --
The ARN associated with the workload identity.
agentRuntimeArtifact (dict) --
The artifact of the AgentCore Runtime.
containerConfiguration (dict) --
The container configuration for the agent artifact.
containerUri (string) --
The ECR URI of the container.
codeConfiguration (dict) --
The code configuration for the agent runtime artifact, including the source code location and execution settings.
code (dict) --
The source code location and configuration details.
s3 (dict) --
The Amazon Amazon S3 object that contains the source code for the agent runtime.
bucket (string) --
The name of the Amazon S3 bucket. This bucket contains the stored data.
prefix (string) --
The prefix for objects in the Amazon S3 bucket. This prefix is added to the object keys to organize the data.
versionId (string) --
The version ID of the Amazon Amazon S3 object. If not specified, the latest version of the object is used.
runtime (string) --
The runtime environment for executing the agent code. Specify the programming language and version to use for the agent runtime. For valid values, see the list of supported runtimes.
entryPoint (list) --
The entry point for the code execution, specifying the function or method that should be invoked when the code runs.
(string) --
protocolConfiguration (dict) --
The protocol configuration for the AgentCore Runtime, including the protocol, port, and path on which the agent server is available.
serverProtocol (string) --
The server protocol for the agent runtime. This field specifies which protocol the agent runtime uses to communicate with clients.
port (integer) --
The port on which the agent server listens. The port must be between 8000 and 12000, excluding the reserved port 8443. When this field is omitted, the default is 8080 for HTTP and AGUI, 8000 for MCP, and 9000 for A2A.
path (string) --
The path on which the agent server accepts requests. The path must begin with /. When this field is omitted, the default is /invocations for HTTP and AGUI, /mcp for MCP, and / for A2A.
environmentVariables (dict) --
Environment variables set in the AgentCore Runtime environment.
(string) --
(string) --
authorizerConfiguration (dict) --
The authorizer configuration for the AgentCore Runtime.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
requestHeaderConfiguration (dict) --
Configuration for HTTP request headers that will be passed through to the runtime.
requestHeaderAllowlist (list) --
A list of HTTP request headers that are allowed to be passed through to the runtime.
(string) --
metadataConfiguration (dict) --
Configuration for microVM Metadata Service (MMDS) settings for the AgentCore Runtime.
requireMMDSV2 (boolean) --
Enables MMDSv2 (microVM Metadata Service Version 2) requirement for the agent runtime. When set to true, the runtime microVM will only accept MMDSv2 requests.
filesystemConfigurations (list) --
The filesystem configurations mounted into the AgentCore Runtime.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) --
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) --
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) --
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderConfiguration (dict) --
The capacity provider configuration for the AgentCore Runtime.
capacityProviderArn (string) --
The Amazon Resource Name (ARN) of the capacity provider to use for the AgentCore Runtime.
platformVersion (string) --
The version of the runtime platform used by the AgentCore Runtime.
allowedPorts (list) --
The additional ports on the AgentCore Runtime that are reachable through the runtime's session URL.
(dict) --
A port or port range that is reachable through the runtime's session URL. Specify exactly one of port or portRange.
port (integer) --
A single port that is reachable through the runtime's session URL.
portRange (dict) --
An inclusive range of ports that are reachable through the runtime's session URL.
from (integer) --
The first port in the inclusive range.
to (integer) --
The last port in the inclusive range.
resourceConfigurations (list) --
The resource configurations for the AgentCore Runtime.
(dict) --
The resource configuration for an AgentCore Runtime.
minimumMemoryInMiB (integer) --
The minimum amount of memory, in mebibytes, to allocate to the AgentCore Runtime.
{'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Retrieves information about a specific Gateway.
See also: AWS API Documentation
Request Syntax
client.get_gateway(
gatewayIdentifier='string'
)
string
[REQUIRED]
The identifier of the gateway to retrieve.
dict
Response Syntax
{
'gatewayArn': 'string',
'gatewayId': 'string',
'gatewayUrl': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'status': 'CREATING'|'UPDATING'|'UPDATE_UNSUCCESSFUL'|'DELETING'|'READY'|'FAILED',
'statusReasons': [
'string',
],
'name': 'string',
'description': 'string',
'roleArn': 'string',
'protocolType': 'MCP',
'protocolConfiguration': {
'mcp': {
'supportedVersions': [
'string',
],
'instructions': 'string',
'searchType': 'SEMANTIC',
'sessionConfiguration': {
'sessionTimeoutInSeconds': 123
},
'streamingConfiguration': {
'enableResponseStreaming': True|False
},
'disableMcpListToolsPagination': True|False
}
},
'authorizerType': 'CUSTOM_JWT'|'AWS_IAM'|'NONE'|'AUTHENTICATE_ONLY',
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'kmsKeyArn': 'string',
'customTransformConfiguration': {
'lambda': {
'arn': 'string'
}
},
'interceptorConfigurations': [
{
'interceptor': {
'lambda': {
'arn': 'string'
}
},
'interceptionPoints': [
'REQUEST'|'RESPONSE',
],
'inputConfiguration': {
'passRequestHeaders': True|False,
'payloadFilter': {
'exclude': [
{
'field': 'RESPONSE_BODY'
},
]
}
}
},
],
'policyEngineConfiguration': {
'arn': 'string',
'mode': 'LOG_ONLY'|'ENFORCE'
},
'workloadIdentityDetails': {
'workloadIdentityArn': 'string'
},
'exceptionLevel': 'DEBUG',
'webAclArn': 'string',
'wafConfiguration': {
'failureMode': 'FAIL_CLOSE'|'FAIL_OPEN'
},
'domainOverride': {
'defaultDomain': 'string',
'alternateDomains': [
'string',
]
}
}
Response Structure
(dict) --
gatewayArn (string) --
The Amazon Resource Name (ARN) of the gateway.
gatewayId (string) --
The unique identifier of the gateway.
gatewayUrl (string) --
An endpoint for invoking gateway.
createdAt (datetime) --
The timestamp when the gateway was created.
updatedAt (datetime) --
The timestamp when the gateway was last updated.
status (string) --
The current status of the gateway.
statusReasons (list) --
The reasons for the current status of the gateway.
(string) --
name (string) --
The name of the gateway.
description (string) --
The description of the gateway.
roleArn (string) --
The IAM role ARN that provides permissions for the gateway.
protocolType (string) --
Protocol applied to a gateway.
protocolConfiguration (dict) --
The configuration for a gateway protocol. This structure defines how the gateway communicates with external services.
mcp (dict) --
The configuration for the Model Context Protocol (MCP). This protocol enables communication between Amazon Bedrock Agent and external tools.
supportedVersions (list) --
The supported versions of the Model Context Protocol. This field specifies which versions of the protocol the gateway can use.
(string) --
instructions (string) --
The instructions for using the Model Context Protocol gateway. These instructions provide guidance on how to interact with the gateway.
searchType (string) --
The search type for the Model Context Protocol gateway. This field specifies how the gateway handles search operations.
sessionConfiguration (dict) --
The session configuration for the MCP gateway. This configuration controls session behavior, including session timeout settings.
sessionTimeoutInSeconds (integer) --
The session timeout in seconds. After this timeout, the session expires and subsequent requests to this session will receive an error. The minimum value is 900 seconds (15 minutes), the maximum value is 28800 seconds (8 hours), and the default value is 3600 seconds (1 hour).
streamingConfiguration (dict) --
The streaming configuration for the MCP gateway. This configuration controls whether response streaming is enabled for the gateway.
enableResponseStreaming (boolean) --
Indicates whether response streaming is enabled for the gateway. When set to true, the gateway streams responses from targets back to the client.
disableMcpListToolsPagination (boolean) --
Specifies whether the gateway disables pagination for the Model Context Protocol (MCP) tools/list operation. When set to true, the gateway returns the complete list of tools in a single response without a pagination cursor. When set to false or omitted, the gateway returns tools in paginated responses. For information about changing this value on an existing gateway, see UpdateGateway.
authorizerType (string) --
Authorizer type for the gateway.
authorizerConfiguration (dict) --
The authorizer configuration for the gateway.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
kmsKeyArn (string) --
The Amazon Resource Name (ARN) of the KMS key used to encrypt the gateway.
customTransformConfiguration (dict) --
The custom transformation configuration for the gateway. This configuration defines how the gateway transforms requests and responses.
lambda (dict) --
The Lambda configuration for custom transformations. This configuration defines how the gateway uses a Lambda function to transform data.
arn (string) --
The Amazon Resource Name (ARN) of the Lambda function. This function is invoked by the gateway to transform data.
interceptorConfigurations (list) --
The interceptors configured on the gateway.
(dict) --
The configuration for an interceptor on a gateway. This structure defines settings for an interceptor that will be invoked during the invocation of the gateway.
interceptor (dict) --
The infrastructure settings of an interceptor configuration. This structure defines how the interceptor can be invoked.
lambda (dict) --
The details of the lambda function used for the interceptor.
arn (string) --
The arn of the lambda function to be invoked for the interceptor.
interceptionPoints (list) --
The supported points of interception. This field specifies which points during the gateway invocation to invoke the interceptor
(string) --
inputConfiguration (dict) --
The configuration for the input of the interceptor. This field specifies how the input to the interceptor is constructed
passRequestHeaders (boolean) --
Indicates whether to pass request headers as input into the interceptor. When set to true, request headers will be passed.
payloadFilter (dict) --
The filter that determines which parts of the request or response payload are passed as input to the interceptor.
exclude (list) --
The list of selectors that identify payload fields to exclude from the interceptor input.
(dict) --
A selector that identifies a payload field to exclude from the interceptor input.
field (string) --
The field to exclude from the interceptor input.
policyEngineConfiguration (dict) --
The policy engine configuration for the gateway.
arn (string) --
The ARN of the policy engine. The policy engine contains Cedar or Dogwood policies that define fine-grained authorization rules specifying who can perform what actions on which resources as agents interact through the gateway.
mode (string) --
The enforcement mode for the policy engine. Valid values include:
LOG_ONLY - The policy engine evaluates each action against your policies and adds traces on whether tool calls would be allowed or denied, but does not enforce the decision. Use this mode to test and validate policies before enabling enforcement.
ENFORCE - The policy engine evaluates actions against your policies and enforces decisions by allowing or denying agent operations. Test and validate policies in LOG_ONLY mode before enabling enforcement to avoid unintended denials or adversely affecting production traffic.
workloadIdentityDetails (dict) --
The workload identity details for the gateway.
workloadIdentityArn (string) --
The ARN associated with the workload identity.
exceptionLevel (string) --
The level of detail in error messages returned when invoking the gateway.
If the value is DEBUG, granular exception messages are returned to help a user debug the gateway.
If the value is omitted, a generic error message is returned to the end user.
webAclArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services WAF web ACL associated with the gateway.
wafConfiguration (dict) --
The Amazon Web Services WAF configuration for the gateway.
failureMode (string) --
The failure mode that determines how the gateway handles requests when Amazon Web Services WAF is unreachable or times out. Valid values include:
FAIL_CLOSE - The gateway blocks requests when Amazon Web Services WAF cannot be evaluated.
FAIL_OPEN - The gateway allows requests when Amazon Web Services WAF cannot be evaluated.
domainOverride (dict) --
The public domain names that the gateway advertises in its OAuth discovery URLs instead of the inbound Host header.
defaultDomain (string) --
The default public domain name for the gateway. The gateway advertises this domain when a request doesn't select a specific domain.
alternateDomains (list) --
Additional public domain names for the gateway, up to 10. Don't repeat the default domain or list a domain more than once. A request can select one of these domains, or the default domain, with the x-amzn-bedrock-agentcore-gateway-domain header. The gateway rejects a request that selects a domain that isn't configured.
(string) --
{'harness': {'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}},
'tools': {'config': {'remoteMcp': {'outboundAuth': {'awsIam': {'region': 'string',
'service': 'string'},
'none': {}}}}}}}
Operation to get a single harness.
See also: AWS API Documentation
Request Syntax
client.get_harness(
harnessId='string',
harnessVersion='string'
)
string
[REQUIRED]
The ID of the harness to retrieve.
string
Specific version of the harness to retrieve. If omitted, returns the current Harness configuration, including its status.
dict
Response Syntax
{
'harness': {
'harnessId': 'string',
'harnessName': 'string',
'arn': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED',
'harnessVersion': 'string',
'executionRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'model': {
'bedrockModelConfig': {
'modelId': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'converse_stream'|'responses'|'chat_completions',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'openAiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'chat_completions'|'responses',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'geminiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'topK': 123,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'liteLlmModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
}
},
'systemPrompt': [
{
'text': 'string'
},
],
'tools': [
{
'type': 'remote_mcp'|'agentcore_browser'|'agentcore_gateway'|'inline_function'|'agentcore_code_interpreter',
'name': 'string',
'config': {
'remoteMcp': {
'url': 'string',
'headers': {
'string': 'string'
},
'outboundAuth': {
'awsIam': {
'service': 'string',
'region': 'string'
},
'none': {}
}
},
'agentCoreBrowser': {
'browserArn': 'string'
},
'agentCoreGateway': {
'gatewayArn': 'string',
'outboundAuth': {
'awsIam': {},
'none': {},
'oauth': {
'providerArn': 'string',
'scopes': [
'string',
],
'customParameters': {
'string': 'string'
},
'grantType': 'CLIENT_CREDENTIALS'|'AUTHORIZATION_CODE'|'TOKEN_EXCHANGE',
'defaultReturnUrl': 'string'
}
}
},
'inlineFunction': {
'description': 'string',
'inputSchema': {...}|[...]|123|123.4|'string'|True|None
},
'agentCoreCodeInterpreter': {
'codeInterpreterArn': 'string'
}
}
},
],
'skills': [
{
'path': 'string',
's3': {
'uri': 'string'
},
'git': {
'url': 'string',
'path': 'string',
'auth': {
'credentialArn': 'string',
'username': 'string'
}
},
'awsSkills': {
'paths': [
'string',
]
}
},
],
'allowedTools': [
'string',
],
'truncation': {
'strategy': 'sliding_window'|'summarization'|'none',
'config': {
'slidingWindow': {
'messagesCount': 123
},
'summarization': {
'summaryRatio': ...,
'preserveRecentMessages': 123,
'summarizationSystemPrompt': 'string'
}
}
},
'environment': {
'agentCoreRuntimeEnvironment': {
'agentRuntimeArn': 'string',
'agentRuntimeName': 'string',
'agentRuntimeId': 'string',
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
]
}
},
'environmentArtifact': {
'containerConfiguration': {
'containerUri': 'string'
}
},
'environmentVariables': {
'string': 'string'
},
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'memory': {
'agentCoreMemoryConfiguration': {
'arn': 'string',
'actorId': 'string',
'messagesCount': 123,
'retrievalConfig': {
'string': {
'topK': 123,
'relevanceScore': ...,
'strategyId': 'string'
}
}
},
'managedMemoryConfiguration': {
'arn': 'string',
'strategies': [
'SEMANTIC'|'SUMMARIZATION'|'USER_PREFERENCE'|'EPISODIC',
],
'eventExpiryDuration': 123,
'encryptionKeyArn': 'string'
},
'disabled': {}
},
'hooks': [
{
'beforeInvocation': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'afterInvocation': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'beforeToolCall': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'afterToolCall': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
}
},
],
'maxIterations': 123,
'maxTokens': 123,
'timeoutSeconds': 123,
'failureReason': 'string'
}
}
Response Structure
(dict) --
harness (dict) --
The harness resource.
harnessId (string) --
The ID of the harness.
harnessName (string) --
The name of the harness.
arn (string) --
The ARN of the harness.
status (string) --
The status of the harness.
harnessVersion (string) --
The version of the harness. Incremented on every successful UpdateHarness.
executionRoleArn (string) --
IAM role the harness assumes when running.
createdAt (datetime) --
The createdAt time of the harness.
updatedAt (datetime) --
The updatedAt time of the harness.
model (dict) --
The configuration of the default model used by the Harness.
bedrockModelConfig (dict) --
Configuration for an Amazon Bedrock model.
modelId (string) --
The Bedrock model ID.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the Bedrock provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
openAiModelConfig (dict) --
Configuration for an OpenAI model.
modelId (string) --
The OpenAI model ID.
apiKeyArn (string) --
The ARN of your OpenAI API key on AgentCore Identity.
apiBase (string) --
Optional custom endpoint URL for an OpenAI-compatible endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the OpenAI provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
geminiModelConfig (dict) --
Configuration for a Google Gemini model.
modelId (string) --
The Gemini model ID.
apiKeyArn (string) --
The ARN of your Gemini API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
topK (integer) --
The topK set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the Gemini model provider unchanged.
liteLlmModelConfig (dict) --
The LiteLLM model configuration for connecting to third-party model providers.
modelId (string) --
The LiteLLM model identifier (e.g., "anthropic/claude-3-sonnet").
apiKeyArn (string) --
The ARN of the API key in AgentCore Identity for authenticating with the model provider.
apiBase (string) --
The base URL for the model provider's API endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per iteration.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
systemPrompt (list) --
The system prompt of the harness.
(dict) --
A content block in the system prompt.
text (string) --
The text content of the system prompt block.
tools (list) --
The tools of the harness.
(dict) --
A tool available to the agent loop.
type (string) --
The type of tool.
name (string) --
Unique name for the tool. If not provided, a name will be inferred or generated.
config (dict) --
Tool-specific configuration.
remoteMcp (dict) --
Configuration for remote MCP server.
url (string) --
URL of the MCP endpoint.
headers (dict) --
Custom headers to include when connecting to the remote MCP server.
(string) --
The key of an HTTP header.
(string) --
The value of an HTTP header.
outboundAuth (dict) --
How the harness authenticates to this MCP server. Defaults to no authentication.
awsIam (dict) --
Sign requests to the remote MCP server with Signature Version 4 (SigV4) using the harness execution role. If you don't specify a Region, the harness Region is used.
service (string) --
The target Amazon Web Services service name used for SigV4 signing. This value identifies the service that the gateway authenticates with when making requests to the target endpoint.
region (string) --
The Amazon Web Services Region used for SigV4 signing. If not specified, defaults to the gateway's Region.
none (dict) --
No authentication.
agentCoreBrowser (dict) --
Configuration for AgentCore Browser.
browserArn (string) --
If not populated, the built-in Browser ARN is used.
agentCoreGateway (dict) --
Configuration for AgentCore Gateway.
gatewayArn (string) --
The ARN of the desired AgentCore Gateway.
outboundAuth (dict) --
How harness authenticates to this Gateway. Defaults to AWS_IAM (SigV4) if omitted.
awsIam (dict) --
SigV4-sign requests using the agent's execution role.
none (dict) --
No authentication.
oauth (dict) --
Use OAuth credentials for outbound authentication to the gateway.
The AUTHORIZATION_CODE grant type is not supported for outbound authentication from a harness to an AgentCore Gateway, even when defaultReturnUrl is specified.
providerArn (string) --
The Amazon Resource Name (ARN) of the OAuth credential provider. This ARN identifies the provider in Amazon Web Services.
scopes (list) --
The OAuth scopes for the credential provider. These scopes define the level of access requested from the OAuth provider.
(string) --
customParameters (dict) --
The custom parameters for the OAuth credential provider. These parameters provide additional configuration for the OAuth authentication process.
(string) --
(string) --
grantType (string) --
Specifies the kind of credentials to use for authorization:
CLIENT_CREDENTIALS - Authorization with a client ID and secret.
AUTHORIZATION_CODE - Authorization with a token that is specific to an individual end user.
TOKEN_EXCHANGE - Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience.
defaultReturnUrl (string) --
The URL where the end user's browser is redirected after obtaining the authorization code. Generally points to the customer's application.
inlineFunction (dict) --
Configuration for an inline function tool.
description (string) --
Description of what the tool does, provided to the model.
inputSchema (:ref:`document<document>`) --
JSON Schema describing the tool's input parameters.
agentCoreCodeInterpreter (dict) --
Configuration for AgentCore Code Interpreter.
codeInterpreterArn (string) --
If not populated, the built-in Code Interpreter ARN is used.
skills (list) --
The skills of the harness.
(dict) --
A skill available to the agent.
path (string) --
The filesystem path to the skill definition.
s3 (dict) --
An S3 source containing the skill.
uri (string) --
The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
git (dict) --
A git repository containing the skill.
url (string) --
The HTTPS URL of the git repository.
path (string) --
Subdirectory within the repository containing the skill.
auth (dict) --
Authentication configuration for private repositories.
credentialArn (string) --
The ARN of the credential in AgentCore Identity containing the password or personal access token.
username (string) --
Username for authentication. Defaults to 'oauth2' if not specified.
awsSkills (dict) --
Amazon Web Services Skills baked into the harness's underlying Runtime.
paths (list) --
Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
(string) --
allowedTools (list) --
The allowed tools of the harness. All tools are allowed by default.
(string) --
truncation (dict) --
Configuration for truncating model context.
strategy (string) --
The truncation strategy to use.
config (dict) --
The strategy-specific configuration.
slidingWindow (dict) --
Configuration for sliding window truncation.
messagesCount (integer) --
The number of recent messages to retain in the context window.
summarization (dict) --
Configuration for summarization-based truncation.
summaryRatio (float) --
The ratio of content to summarize.
preserveRecentMessages (integer) --
The number of recent messages to preserve without summarization.
summarizationSystemPrompt (string) --
The system prompt used for generating summaries.
environment (dict) --
The compute environment on which the Harness runs.
agentCoreRuntimeEnvironment (dict) --
The AgentCore Runtime environment configuration.
agentRuntimeArn (string) --
The ARN of the underlying AgentCore Runtime.
agentRuntimeName (string) --
The name of the underlying AgentCore Runtime.
agentRuntimeId (string) --
The ID of the underlying AgentCore Runtime.
lifecycleConfiguration (dict) --
The lifecycle configuration for the harness's runtime environment. For a harness, idleRuntimeSessionTimeout and maxLifetime each accept a value between 60 and 28800 seconds (8 hours), and idleRuntimeSessionTimeout must be less than or equal to maxLifetime.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
networkConfiguration (dict) --
SecurityConfig for the Agent.
networkMode (string) --
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) --
The security groups associated with the VPC configuration.
(string) --
subnets (list) --
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
filesystemConfigurations (list) --
The filesystem configurations for the runtime environment.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) --
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) --
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) --
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
environmentArtifact (dict) --
The environment artifact (e.g., container) in which the Harness operates.
containerConfiguration (dict) --
Representation of a container configuration.
containerUri (string) --
The ECR URI of the container.
environmentVariables (dict) --
Environment variables exposed in the environment in which the harness operates.
(string) --
(string) --
authorizerConfiguration (dict) --
Represents inbound authorization configuration options used to authenticate incoming requests.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
memory (dict) --
AgentCore Memory instance configuration for short and long term memory.
agentCoreMemoryConfiguration (dict) --
The AgentCore Memory configuration.
arn (string) --
The ARN of the AgentCore Memory resource.
actorId (string) --
The actor ID for memory operations.
messagesCount (integer) --
The number of messages to retrieve from memory.
retrievalConfig (dict) --
The retrieval configuration for long-term memory, mapping namespace path templates to retrieval settings.
(string) --
(dict) --
Configuration for memory retrieval within a namespace.
topK (integer) --
The maximum number of memory entries to retrieve.
relevanceScore (float) --
The minimum relevance score for retrieved memories.
strategyId (string) --
The ID of the retrieval strategy to use.
managedMemoryConfiguration (dict) --
Harness creates and manages a memory resource in the customer's account.
arn (string) --
The ARN of the managed AgentCore Memory resource. Read-only on Get, ignored on Create/Update input.
strategies (list) --
Strategy types to enable. Defaults to [SEMANTIC, SUMMARIZATION].
(string) --
eventExpiryDuration (integer) --
Event retention in days. Defaults to 30.
encryptionKeyArn (string) --
Customer-managed KMS key. Defaults to Amazon Web Services-owned key. Not updatable after creation.
disabled (dict) --
Explicitly opt out of memory.
hooks (list) --
The lifecycle hooks configured for the harness.
(dict) --
A lifecycle hook configuration. Specify one hook type.
beforeInvocation (dict) --
A hook that runs before an invocation begins.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
afterInvocation (dict) --
A hook that runs after an invocation completes.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
beforeToolCall (dict) --
A hook that runs before the agent calls a tool.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
afterToolCall (dict) --
A hook that runs after a tool call completes.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
maxIterations (integer) --
The maximum number of iterations in the agent loop allowed before exiting per invocation.
maxTokens (integer) --
The maximum total number of output tokens the agent can generate across all model calls within a single invocation.
timeoutSeconds (integer) --
The maximum duration per invocation.
failureReason (string) --
Reason why create or update operations fail.
{'oauth2ProviderConfigOutput': {'customOauth2ProviderConfig': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Retrieves information about an OAuth2 credential provider.
See also: AWS API Documentation
Request Syntax
client.get_oauth2_credential_provider(
name='string'
)
string
[REQUIRED]
The name of the OAuth2 credential provider to retrieve.
dict
Response Syntax
{
'clientSecretArn': {
'secretArn': 'string'
},
'clientSecretJsonKey': 'string',
'clientSecretSource': 'MANAGED'|'EXTERNAL',
'name': 'string',
'credentialProviderArn': 'string',
'credentialProviderVendor': 'GoogleOauth2'|'GithubOauth2'|'SlackOauth2'|'SalesforceOauth2'|'MicrosoftOauth2'|'CustomOauth2'|'AtlassianOauth2'|'LinkedinOauth2'|'XOauth2'|'OktaOauth2'|'OneLoginOauth2'|'PingOneOauth2'|'FacebookOauth2'|'YandexOauth2'|'RedditOauth2'|'ZoomOauth2'|'TwitchOauth2'|'SpotifyOauth2'|'DropboxOauth2'|'NotionOauth2'|'HubspotOauth2'|'CyberArkOauth2'|'FusionAuthOauth2'|'Auth0Oauth2'|'CognitoOauth2',
'callbackUrl': 'string',
'oauth2ProviderConfigOutput': {
'customOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string',
'onBehalfOfTokenExchangeConfig': {
'grantType': 'TOKEN_EXCHANGE'|'JWT_AUTHORIZATION_GRANT',
'tokenExchangeGrantTypeConfig': {
'actorTokenContent': 'NONE'|'M2M'|'AWS_IAM_ID_TOKEN_JWT',
'actorTokenScopes': [
'string',
]
},
'onBehalfOfAuthenticationConfig': {
'clientAuthenticationMethod': 'NO_CLIENT'
}
},
'clientAuthenticationMethod': 'CLIENT_SECRET_BASIC'|'CLIENT_SECRET_POST'|'AWS_IAM_ID_TOKEN_JWT'|'PRIVATE_KEY_JWT',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'privateKeyJwtConfig': {
'privateKeySource': {
'kmsKeySource': {
'kmsKeyArn': 'string'
}
},
'signingAlgorithm': 'RS256'|'PS256'|'ES256',
'additionalHeaderClaims': {
'string': 'string'
},
'additionalPayloadClaims': {
'string': 'string'
}
}
},
'googleOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'githubOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'slackOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'salesforceOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'microsoftOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'atlassianOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'linkedinOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'includedOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
}
},
'createdTime': datetime(2015, 1, 1),
'lastUpdatedTime': datetime(2015, 1, 1),
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED',
'failureReason': 'string'
}
Response Structure
(dict) --
clientSecretArn (dict) --
The Amazon Resource Name (ARN) of the client secret in Amazon Web Services Secrets Manager.
secretArn (string) --
The Amazon Resource Name (ARN) of the secret in Amazon Web Services Secrets Manager.
clientSecretJsonKey (string) --
The JSON key used to extract the client secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Either MANAGED if the secret is managed by the service, or EXTERNAL if managed by the user in Amazon Web Services Secrets Manager.
name (string) --
The name of the OAuth2 credential provider.
credentialProviderArn (string) --
ARN of the credential provider requested.
credentialProviderVendor (string) --
The vendor of the OAuth2 credential provider.
callbackUrl (string) --
Callback URL to register on the OAuth2 credential provider as an allowed callback URL. This URL is where the OAuth2 authorization server redirects users after they complete the authorization flow.
oauth2ProviderConfigOutput (dict) --
The configuration output for the OAuth2 provider.
customOauth2ProviderConfig (dict) --
The output configuration for a custom OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the custom provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the custom OAuth2 provider.
onBehalfOfTokenExchangeConfig (dict) --
The configuration for on-behalf-of token exchange.
grantType (string) --
The grant type for the on-behalf-of token exchange.
tokenExchangeGrantTypeConfig (dict) --
Configuration specific to the TOKEN_EXCHANGE grant type (RFC 8693).
actorTokenContent (string) --
The content type for the actor token in the token exchange.
actorTokenScopes (list) --
The scopes for the actor token. Only valid when actorTokenContent is M2M.
(string) --
onBehalfOfAuthenticationConfig (dict) --
Specify the client authentication configuration to use for the on-behalf-of token exchange. With this configuration, you override the provider level client authentication method for the on-behalf-of exchange with the identity provider. If you don't specify this configuration, we use the provider level client authentication method.
clientAuthenticationMethod (string) --
The client authentication method to use during the on-behalf-of token exchange. The NO_CLIENT option omits the clientId and clientSecret during the on-behalf-of token exchange with the identity provider.
clientAuthenticationMethod (string) --
The client authentication method used when authenticating with the token endpoint.
privateEndpoint (dict) --
The default private endpoint for the custom OAuth2 provider, enabling secure connectivity through a VPC Lattice resource configuration.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom OAuth2 provider configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
privateKeyJwtConfig (dict) --
The configuration for private_key_jwt client authentication used by this OAuth2 credential provider.
privateKeySource (dict) --
The private key source for the JWT client assertion.
kmsKeySource (dict) --
The KMS key source for the JWT client assertion.
kmsKeyArn (string) --
The Amazon Resource Name (ARN) of the KMS key used to sign the JWT client assertion. The key must be an asymmetric key with key usage SIGN_VERIFY and a key spec compatible with the configured signing algorithm.
signingAlgorithm (string) --
The algorithm used to sign the JWT client assertion. Valid values are RS256, PS256, and ES256.
additionalHeaderClaims (dict) --
A map of additional claims to include in the JWT client assertion header. Standard header claims such as alg and typ cannot be added.
(string) --
(string) --
additionalPayloadClaims (dict) --
A map of additional claims to include in the JWT client assertion payload. Payload claims generated by the service, such as iss, sub, jti, and exp, cannot be added.
(string) --
(string) --
googleOauth2ProviderConfig (dict) --
The output configuration for a Google OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the Google provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Google OAuth2 provider.
githubOauth2ProviderConfig (dict) --
The output configuration for a GitHub OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the GitHub provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the GitHub OAuth2 provider.
slackOauth2ProviderConfig (dict) --
The output configuration for a Slack OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the Slack provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Slack OAuth2 provider.
salesforceOauth2ProviderConfig (dict) --
The output configuration for a Salesforce OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the Salesforce provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Salesforce OAuth2 provider.
microsoftOauth2ProviderConfig (dict) --
The output configuration for a Microsoft OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the Microsoft provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Microsoft OAuth2 provider.
atlassianOauth2ProviderConfig (dict) --
The configuration details for the Atlassian OAuth2 provider.
oauthDiscovery (dict) --
Contains the discovery information for an OAuth2 provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Atlassian OAuth2 provider.
linkedinOauth2ProviderConfig (dict) --
The configuration details for the LinkedIn OAuth2 provider.
oauthDiscovery (dict) --
Contains the discovery information for an OAuth2 provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the LinkedIn OAuth2 provider.
includedOauth2ProviderConfig (dict) --
The configuration for a non-custom OAuth2 provider. This includes the configuration details for supported OAuth2 providers that have built-in integration support.
oauthDiscovery (dict) --
Contains the discovery information for an OAuth2 provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the supported OAuth2 provider.
createdTime (datetime) --
The timestamp when the OAuth2 credential provider was created.
lastUpdatedTime (datetime) --
The timestamp when the OAuth2 credential provider was last updated.
status (string) --
The current status of the OAuth2 credential provider.
failureReason (string) --
The reason for failure if the OAuth2 credential provider is in a failed state.
{'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Retrieves information about a specific payment manager.
See also: AWS API Documentation
Request Syntax
client.get_payment_manager(
paymentManagerId='string'
)
string
[REQUIRED]
The unique identifier of the payment manager to retrieve.
dict
Response Syntax
{
'paymentManagerArn': 'string',
'paymentManagerId': 'string',
'name': 'string',
'description': 'string',
'authorizerType': 'CUSTOM_JWT'|'AWS_IAM',
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'roleArn': 'string',
'workloadIdentityDetails': {
'workloadIdentityArn': 'string'
},
'createdAt': datetime(2015, 1, 1),
'lastUpdatedAt': datetime(2015, 1, 1),
'status': 'CREATING'|'UPDATING'|'DELETING'|'READY'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETE_FAILED',
'tags': {
'string': 'string'
},
'kmsKeyArn': 'string'
}
Response Structure
(dict) --
paymentManagerArn (string) --
The Amazon Resource Name (ARN) of the payment manager.
paymentManagerId (string) --
The unique identifier of the payment manager.
name (string) --
The name of the payment manager.
description (string) --
The description of the payment manager.
authorizerType (string) --
The type of authorizer used by the payment manager.
CUSTOM_JWT - Authorize with a bearer token.
AWS_IAM - Authorize with your Amazon Web Services IAM credentials.
authorizerConfiguration (dict) --
Represents inbound authorization configuration options used to authenticate incoming requests.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
roleArn (string) --
The Amazon Resource Name (ARN) of the IAM role associated with the payment manager.
workloadIdentityDetails (dict) --
The information about the workload identity.
workloadIdentityArn (string) --
The ARN associated with the workload identity.
createdAt (datetime) --
The timestamp when the payment manager was created.
lastUpdatedAt (datetime) --
The timestamp when the payment manager was last updated.
status (string) --
The current status of the payment manager. Possible values include CREATING, READY, UPDATING, DELETING, CREATE_FAILED, UPDATE_FAILED, and DELETE_FAILED.
tags (dict) --
The tags associated with the payment manager.
(string) --
(string) --
kmsKeyArn (string) --
The Amazon Resource Name (ARN) of the KMS key used to encrypt sensitive payment manager data at rest, if configured.
{'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Retrieves information about a specific registry.
See also: AWS API Documentation
Request Syntax
client.get_registry(
registryId='string'
)
string
[REQUIRED]
The identifier of the registry to retrieve. You can specify either the Amazon Resource Name (ARN) or the ID of the registry.
dict
Response Syntax
{
'name': 'string',
'description': 'string',
'registryId': 'string',
'registryArn': 'string',
'authorizerType': 'CUSTOM_JWT'|'AWS_IAM',
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'approvalConfiguration': {
'autoApproval': True|False
},
'status': 'CREATING'|'READY'|'UPDATING'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETING'|'DELETE_FAILED',
'statusReason': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
name (string) --
The name of the registry.
description (string) --
The description of the registry.
registryId (string) --
The unique identifier of the registry.
registryArn (string) --
The Amazon Resource Name (ARN) of the registry.
authorizerType (string) --
The type of authorizer used by the registry. This controls the authorization method for the Search and Invoke APIs used by consumers.
CUSTOM_JWT - Authorize with a bearer token.
AWS_IAM - Authorize with your Amazon Web Services IAM credentials.
authorizerConfiguration (dict) --
The authorizer configuration for the registry. For details, see the AuthorizerConfiguration data type.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
approvalConfiguration (dict) --
The approval configuration for registry records. For details, see the ApprovalConfiguration data type.
autoApproval (boolean) --
Whether registry records are auto-approved. When set to true, records are automatically approved upon creation. When set to false (the default), records require explicit approval for security purposes.
status (string) --
The current status of the registry. Possible values include CREATING, READY, UPDATING, CREATE_FAILED, UPDATE_FAILED, DELETING, and DELETE_FAILED.
statusReason (string) --
The reason for the current status, typically set when the status is a failure state.
createdAt (datetime) --
The timestamp when the registry was created.
updatedAt (datetime) --
The timestamp when the registry was last updated.
{'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Updates an existing Amazon Secure Agent.
See also: AWS API Documentation
Request Syntax
client.update_agent_runtime(
agentRuntimeId='string',
agentRuntimeArtifact={
'containerConfiguration': {
'containerUri': 'string'
},
'codeConfiguration': {
'code': {
's3': {
'bucket': 'string',
'prefix': 'string',
'versionId': 'string'
}
},
'runtime': 'PYTHON_3_10'|'PYTHON_3_11'|'PYTHON_3_12'|'PYTHON_3_13'|'PYTHON_3_14'|'NODE_22',
'entryPoint': [
'string',
]
}
},
roleArn='string',
networkConfiguration={
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
description='string',
authorizerConfiguration={
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
requestHeaderConfiguration={
'requestHeaderAllowlist': [
'string',
]
},
protocolConfiguration={
'serverProtocol': 'MCP'|'HTTP'|'A2A'|'AGUI',
'port': 123,
'path': 'string'
},
lifecycleConfiguration={
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
hooksConfiguration={
'build': {
'warmup': {
'action': {
'httpPost': {
'path': 'string',
'port': 123
}
}
}
}
},
metadataConfiguration={
'requireMMDSV2': True|False
},
environmentVariables={
'string': 'string'
},
filesystemConfigurations=[
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
],
capacityProviderConfiguration={
'capacityProviderArn': 'string'
},
platformVersion='string',
allowedPorts=[
{
'port': 123,
'portRange': {
'from': 123,
'to': 123
}
},
],
resourceConfigurations=[
{
'minimumMemoryInMiB': 123
},
],
clientToken='string'
)
string
[REQUIRED]
The unique identifier of the AgentCore Runtime to update.
dict
[REQUIRED]
The updated artifact of the AgentCore Runtime.
containerConfiguration (dict) --
The container configuration for the agent artifact.
containerUri (string) -- [REQUIRED]
The ECR URI of the container.
codeConfiguration (dict) --
The code configuration for the agent runtime artifact, including the source code location and execution settings.
code (dict) -- [REQUIRED]
The source code location and configuration details.
s3 (dict) --
The Amazon Amazon S3 object that contains the source code for the agent runtime.
bucket (string) -- [REQUIRED]
The name of the Amazon S3 bucket. This bucket contains the stored data.
prefix (string) -- [REQUIRED]
The prefix for objects in the Amazon S3 bucket. This prefix is added to the object keys to organize the data.
versionId (string) --
The version ID of the Amazon Amazon S3 object. If not specified, the latest version of the object is used.
runtime (string) -- [REQUIRED]
The runtime environment for executing the agent code. Specify the programming language and version to use for the agent runtime. For valid values, see the list of supported runtimes.
entryPoint (list) -- [REQUIRED]
The entry point for the code execution, specifying the function or method that should be invoked when the code runs.
(string) --
string
[REQUIRED]
The updated IAM role ARN that provides permissions for the AgentCore Runtime.
dict
The updated network configuration for the AgentCore Runtime.
networkMode (string) -- [REQUIRED]
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) -- [REQUIRED]
The security groups associated with the VPC configuration.
(string) --
subnets (list) -- [REQUIRED]
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
string
The updated description of the AgentCore Runtime.
dict
The updated authorizer configuration for the AgentCore Runtime.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) -- [REQUIRED]
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
dict
The updated configuration for HTTP request headers that will be passed through to the runtime.
requestHeaderAllowlist (list) --
A list of HTTP request headers that are allowed to be passed through to the runtime.
(string) --
dict
The updated protocol configuration for the AgentCore Runtime, including the protocol, port, and path on which the agent server is available.
serverProtocol (string) -- [REQUIRED]
The server protocol for the agent runtime. This field specifies which protocol the agent runtime uses to communicate with clients.
port (integer) --
The port on which the agent server listens. The port must be between 8000 and 12000, excluding the reserved port 8443. When this field is omitted, the default is 8080 for HTTP and AGUI, 8000 for MCP, and 9000 for A2A.
path (string) --
The path on which the agent server accepts requests. The path must begin with /. When this field is omitted, the default is /invocations for HTTP and AGUI, /mcp for MCP, and / for A2A.
dict
The updated life cycle configuration for the AgentCore Runtime.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
dict
The updated lifecycle hooks configuration for the AgentCore Runtime.
build (dict) --
The hooks that run when you create or update the AgentCore Runtime, before any sessions are created.
warmup (dict) --
The hook that warms up your agent before any sessions are created. Use this hook to load the resources that your sessions need, such as models, libraries, or caches. Your hook must complete within 120 seconds.
action (dict) -- [REQUIRED]
The action that AgentCore Runtime runs for the hook. Specify exactly one action.
httpPost (dict) --
Sends an HTTP POST request to your agent's container on the specified port and path to run the hook. The hook succeeds if your container returns a 2xx response. The hook fails if your container returns any other response or doesn't respond before the hook times out.
path (string) -- [REQUIRED]
The path in the agent's container that AgentCore Runtime sends the POST request to.
port (integer) --
The port in the agent's container that AgentCore Runtime sends the POST request to. If you don't specify a port, the default is the runtime's server port: the port in the protocol configuration if one is set, otherwise the protocol's default port.
dict
The updated configuration for microVM Metadata Service (MMDS) settings for the AgentCore Runtime.
requireMMDSV2 (boolean) -- [REQUIRED]
Enables MMDSv2 (microVM Metadata Service Version 2) requirement for the agent runtime. When set to true, the runtime microVM will only accept MMDSv2 requests.
dict
Updated environment variables to set in the AgentCore Runtime environment.
(string) --
(string) --
list
The updated filesystem configurations to mount into the AgentCore Runtime.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) -- [REQUIRED]
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) -- [REQUIRED]
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) -- [REQUIRED]
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
dict
The updated capacity provider configuration for the AgentCore Runtime.
capacityProviderArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the capacity provider to use for the AgentCore Runtime.
string
The updated version of the runtime platform to use for the AgentCore Runtime.
list
The updated additional ports on the AgentCore Runtime that are reachable through the runtime's session URL. Specify one to five non-overlapping entries, each containing either a single port or an inclusive port range. Ports must be between 8000 and 12000, excluding the reserved port 8443.
(dict) --
A port or port range that is reachable through the runtime's session URL. Specify exactly one of port or portRange.
port (integer) --
A single port that is reachable through the runtime's session URL.
portRange (dict) --
An inclusive range of ports that are reachable through the runtime's session URL.
from (integer) -- [REQUIRED]
The first port in the inclusive range.
to (integer) -- [REQUIRED]
The last port in the inclusive range.
list
The updated resource configurations for the AgentCore Runtime. You can specify at most one resource configuration.
(dict) --
The resource configuration for an AgentCore Runtime.
minimumMemoryInMiB (integer) -- [REQUIRED]
The minimum amount of memory, in mebibytes, to allocate to the AgentCore Runtime.
string
A unique, case-sensitive identifier to ensure idempotency of the request.
This field is autopopulated if not provided.
dict
Response Syntax
{
'agentRuntimeArn': 'string',
'agentRuntimeId': 'string',
'workloadIdentityDetails': {
'workloadIdentityArn': 'string'
},
'agentRuntimeVersion': 'string',
'createdAt': datetime(2015, 1, 1),
'lastUpdatedAt': datetime(2015, 1, 1),
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED'
}
Response Structure
(dict) --
agentRuntimeArn (string) --
The Amazon Resource Name (ARN) of the updated AgentCore Runtime.
agentRuntimeId (string) --
The unique identifier of the updated AgentCore Runtime.
workloadIdentityDetails (dict) --
The workload identity details for the updated AgentCore Runtime.
workloadIdentityArn (string) --
The ARN associated with the workload identity.
agentRuntimeVersion (string) --
The version of the updated AgentCore Runtime.
createdAt (datetime) --
The timestamp when the AgentCore Runtime was created.
lastUpdatedAt (datetime) --
The timestamp when the AgentCore Runtime was last updated.
status (string) --
The current status of the updated AgentCore Runtime.
{'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Updates an existing gateway.
Replaces the entire gateway configuration. Any optional field that you omit, including fields in protocolConfiguration, is reset. For information about retrieving the current configuration, see GetGateway.
See also: AWS API Documentation
Request Syntax
client.update_gateway(
gatewayIdentifier='string',
name='string',
description='string',
roleArn='string',
protocolType='MCP',
protocolConfiguration={
'mcp': {
'supportedVersions': [
'string',
],
'instructions': 'string',
'searchType': 'SEMANTIC',
'sessionConfiguration': {
'sessionTimeoutInSeconds': 123
},
'streamingConfiguration': {
'enableResponseStreaming': True|False
},
'disableMcpListToolsPagination': True|False
}
},
authorizerType='CUSTOM_JWT'|'AWS_IAM'|'NONE'|'AUTHENTICATE_ONLY',
authorizerConfiguration={
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
kmsKeyArn='string',
customTransformConfiguration={
'lambda': {
'arn': 'string'
}
},
interceptorConfigurations=[
{
'interceptor': {
'lambda': {
'arn': 'string'
}
},
'interceptionPoints': [
'REQUEST'|'RESPONSE',
],
'inputConfiguration': {
'passRequestHeaders': True|False,
'payloadFilter': {
'exclude': [
{
'field': 'RESPONSE_BODY'
},
]
}
}
},
],
policyEngineConfiguration={
'arn': 'string',
'mode': 'LOG_ONLY'|'ENFORCE'
},
exceptionLevel='DEBUG',
wafConfiguration={
'failureMode': 'FAIL_CLOSE'|'FAIL_OPEN'
},
domainOverride={
'defaultDomain': 'string',
'alternateDomains': [
'string',
]
}
)
string
[REQUIRED]
The identifier of the gateway to update.
string
[REQUIRED]
The name of the gateway. This name must be the same as the one when the gateway was created.
string
The updated description for the gateway.
string
[REQUIRED]
The updated IAM role ARN that provides permissions for the gateway.
string
The updated protocol type for the gateway.
dict
The configuration for a gateway protocol. This structure defines how the gateway communicates with external services.
mcp (dict) --
The configuration for the Model Context Protocol (MCP). This protocol enables communication between Amazon Bedrock Agent and external tools.
supportedVersions (list) --
The supported versions of the Model Context Protocol. This field specifies which versions of the protocol the gateway can use.
(string) --
instructions (string) --
The instructions for using the Model Context Protocol gateway. These instructions provide guidance on how to interact with the gateway.
searchType (string) --
The search type for the Model Context Protocol gateway. This field specifies how the gateway handles search operations.
sessionConfiguration (dict) --
The session configuration for the MCP gateway. This configuration controls session behavior, including session timeout settings.
sessionTimeoutInSeconds (integer) --
The session timeout in seconds. After this timeout, the session expires and subsequent requests to this session will receive an error. The minimum value is 900 seconds (15 minutes), the maximum value is 28800 seconds (8 hours), and the default value is 3600 seconds (1 hour).
streamingConfiguration (dict) --
The streaming configuration for the MCP gateway. This configuration controls whether response streaming is enabled for the gateway.
enableResponseStreaming (boolean) --
Indicates whether response streaming is enabled for the gateway. When set to true, the gateway streams responses from targets back to the client.
disableMcpListToolsPagination (boolean) --
Specifies whether the gateway disables pagination for the Model Context Protocol (MCP) tools/list operation. When set to true, the gateway returns the complete list of tools in a single response without a pagination cursor. When set to false or omitted, the gateway returns tools in paginated responses. For information about changing this value on an existing gateway, see UpdateGateway.
string
[REQUIRED]
The updated authorizer type for the gateway.
dict
The updated authorizer configuration for the gateway.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) -- [REQUIRED]
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
string
The updated ARN of the KMS key used to encrypt the gateway.
dict
The updated custom transformation configuration for the gateway. This configuration defines how the gateway transforms requests and responses.
lambda (dict) --
The Lambda configuration for custom transformations. This configuration defines how the gateway uses a Lambda function to transform data.
arn (string) --
The Amazon Resource Name (ARN) of the Lambda function. This function is invoked by the gateway to transform data.
list
The updated interceptor configurations for the gateway.
(dict) --
The configuration for an interceptor on a gateway. This structure defines settings for an interceptor that will be invoked during the invocation of the gateway.
interceptor (dict) -- [REQUIRED]
The infrastructure settings of an interceptor configuration. This structure defines how the interceptor can be invoked.
lambda (dict) --
The details of the lambda function used for the interceptor.
arn (string) -- [REQUIRED]
The arn of the lambda function to be invoked for the interceptor.
interceptionPoints (list) -- [REQUIRED]
The supported points of interception. This field specifies which points during the gateway invocation to invoke the interceptor
(string) --
inputConfiguration (dict) --
The configuration for the input of the interceptor. This field specifies how the input to the interceptor is constructed
passRequestHeaders (boolean) -- [REQUIRED]
Indicates whether to pass request headers as input into the interceptor. When set to true, request headers will be passed.
payloadFilter (dict) --
The filter that determines which parts of the request or response payload are passed as input to the interceptor.
exclude (list) -- [REQUIRED]
The list of selectors that identify payload fields to exclude from the interceptor input.
(dict) --
A selector that identifies a payload field to exclude from the interceptor input.
field (string) --
The field to exclude from the interceptor input.
dict
The updated policy engine configuration for the gateway. A policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with a gateway, the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies.
arn (string) -- [REQUIRED]
The ARN of the policy engine. The policy engine contains Cedar or Dogwood policies that define fine-grained authorization rules specifying who can perform what actions on which resources as agents interact through the gateway.
mode (string) -- [REQUIRED]
The enforcement mode for the policy engine. Valid values include:
LOG_ONLY - The policy engine evaluates each action against your policies and adds traces on whether tool calls would be allowed or denied, but does not enforce the decision. Use this mode to test and validate policies before enabling enforcement.
ENFORCE - The policy engine evaluates actions against your policies and enforces decisions by allowing or denying agent operations. Test and validate policies in LOG_ONLY mode before enabling enforcement to avoid unintended denials or adversely affecting production traffic.
string
The level of detail in error messages returned when invoking the gateway.
If the value is DEBUG, granular exception messages are returned to help a user debug the gateway.
If the value is omitted, a generic error message is returned to the end user.
dict
The updated Amazon Web Services WAF configuration for the gateway.
failureMode (string) --
The failure mode that determines how the gateway handles requests when Amazon Web Services WAF is unreachable or times out. Valid values include:
FAIL_CLOSE - The gateway blocks requests when Amazon Web Services WAF cannot be evaluated.
FAIL_OPEN - The gateway allows requests when Amazon Web Services WAF cannot be evaluated.
dict
The updated public domain names that the gateway advertises in its OAuth discovery URLs instead of the inbound Host header. Specify this when clients reach the gateway through your own proxy or custom domain.
defaultDomain (string) -- [REQUIRED]
The default public domain name for the gateway. The gateway advertises this domain when a request doesn't select a specific domain.
alternateDomains (list) --
Additional public domain names for the gateway, up to 10. Don't repeat the default domain or list a domain more than once. A request can select one of these domains, or the default domain, with the x-amzn-bedrock-agentcore-gateway-domain header. The gateway rejects a request that selects a domain that isn't configured.
(string) --
dict
Response Syntax
{
'gatewayArn': 'string',
'gatewayId': 'string',
'gatewayUrl': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'status': 'CREATING'|'UPDATING'|'UPDATE_UNSUCCESSFUL'|'DELETING'|'READY'|'FAILED',
'statusReasons': [
'string',
],
'name': 'string',
'description': 'string',
'roleArn': 'string',
'protocolType': 'MCP',
'protocolConfiguration': {
'mcp': {
'supportedVersions': [
'string',
],
'instructions': 'string',
'searchType': 'SEMANTIC',
'sessionConfiguration': {
'sessionTimeoutInSeconds': 123
},
'streamingConfiguration': {
'enableResponseStreaming': True|False
},
'disableMcpListToolsPagination': True|False
}
},
'authorizerType': 'CUSTOM_JWT'|'AWS_IAM'|'NONE'|'AUTHENTICATE_ONLY',
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'kmsKeyArn': 'string',
'customTransformConfiguration': {
'lambda': {
'arn': 'string'
}
},
'interceptorConfigurations': [
{
'interceptor': {
'lambda': {
'arn': 'string'
}
},
'interceptionPoints': [
'REQUEST'|'RESPONSE',
],
'inputConfiguration': {
'passRequestHeaders': True|False,
'payloadFilter': {
'exclude': [
{
'field': 'RESPONSE_BODY'
},
]
}
}
},
],
'policyEngineConfiguration': {
'arn': 'string',
'mode': 'LOG_ONLY'|'ENFORCE'
},
'workloadIdentityDetails': {
'workloadIdentityArn': 'string'
},
'exceptionLevel': 'DEBUG',
'webAclArn': 'string',
'wafConfiguration': {
'failureMode': 'FAIL_CLOSE'|'FAIL_OPEN'
},
'domainOverride': {
'defaultDomain': 'string',
'alternateDomains': [
'string',
]
}
}
Response Structure
(dict) --
gatewayArn (string) --
The Amazon Resource Name (ARN) of the updated gateway.
gatewayId (string) --
The unique identifier of the updated gateway.
gatewayUrl (string) --
An endpoint for invoking the updated gateway.
createdAt (datetime) --
The timestamp when the gateway was created.
updatedAt (datetime) --
The timestamp when the gateway was last updated.
status (string) --
The current status of the updated gateway.
statusReasons (list) --
The reasons for the current status of the updated gateway.
(string) --
name (string) --
The name of the gateway.
description (string) --
The updated description of the gateway.
roleArn (string) --
The updated IAM role ARN that provides permissions for the gateway.
protocolType (string) --
The updated protocol type for the gateway.
protocolConfiguration (dict) --
The configuration for a gateway protocol. This structure defines how the gateway communicates with external services.
mcp (dict) --
The configuration for the Model Context Protocol (MCP). This protocol enables communication between Amazon Bedrock Agent and external tools.
supportedVersions (list) --
The supported versions of the Model Context Protocol. This field specifies which versions of the protocol the gateway can use.
(string) --
instructions (string) --
The instructions for using the Model Context Protocol gateway. These instructions provide guidance on how to interact with the gateway.
searchType (string) --
The search type for the Model Context Protocol gateway. This field specifies how the gateway handles search operations.
sessionConfiguration (dict) --
The session configuration for the MCP gateway. This configuration controls session behavior, including session timeout settings.
sessionTimeoutInSeconds (integer) --
The session timeout in seconds. After this timeout, the session expires and subsequent requests to this session will receive an error. The minimum value is 900 seconds (15 minutes), the maximum value is 28800 seconds (8 hours), and the default value is 3600 seconds (1 hour).
streamingConfiguration (dict) --
The streaming configuration for the MCP gateway. This configuration controls whether response streaming is enabled for the gateway.
enableResponseStreaming (boolean) --
Indicates whether response streaming is enabled for the gateway. When set to true, the gateway streams responses from targets back to the client.
disableMcpListToolsPagination (boolean) --
Specifies whether the gateway disables pagination for the Model Context Protocol (MCP) tools/list operation. When set to true, the gateway returns the complete list of tools in a single response without a pagination cursor. When set to false or omitted, the gateway returns tools in paginated responses. For information about changing this value on an existing gateway, see UpdateGateway.
authorizerType (string) --
The updated authorizer type for the gateway.
authorizerConfiguration (dict) --
The updated authorizer configuration for the gateway.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
kmsKeyArn (string) --
The updated ARN of the KMS key used to encrypt the gateway.
customTransformConfiguration (dict) --
The custom transformation configuration for the gateway. This configuration defines how the gateway transforms requests and responses.
lambda (dict) --
The Lambda configuration for custom transformations. This configuration defines how the gateway uses a Lambda function to transform data.
arn (string) --
The Amazon Resource Name (ARN) of the Lambda function. This function is invoked by the gateway to transform data.
interceptorConfigurations (list) --
The updated interceptor configurations for the gateway.
(dict) --
The configuration for an interceptor on a gateway. This structure defines settings for an interceptor that will be invoked during the invocation of the gateway.
interceptor (dict) --
The infrastructure settings of an interceptor configuration. This structure defines how the interceptor can be invoked.
lambda (dict) --
The details of the lambda function used for the interceptor.
arn (string) --
The arn of the lambda function to be invoked for the interceptor.
interceptionPoints (list) --
The supported points of interception. This field specifies which points during the gateway invocation to invoke the interceptor
(string) --
inputConfiguration (dict) --
The configuration for the input of the interceptor. This field specifies how the input to the interceptor is constructed
passRequestHeaders (boolean) --
Indicates whether to pass request headers as input into the interceptor. When set to true, request headers will be passed.
payloadFilter (dict) --
The filter that determines which parts of the request or response payload are passed as input to the interceptor.
exclude (list) --
The list of selectors that identify payload fields to exclude from the interceptor input.
(dict) --
A selector that identifies a payload field to exclude from the interceptor input.
field (string) --
The field to exclude from the interceptor input.
policyEngineConfiguration (dict) --
The updated policy engine configuration for the gateway.
arn (string) --
The ARN of the policy engine. The policy engine contains Cedar or Dogwood policies that define fine-grained authorization rules specifying who can perform what actions on which resources as agents interact through the gateway.
mode (string) --
The enforcement mode for the policy engine. Valid values include:
LOG_ONLY - The policy engine evaluates each action against your policies and adds traces on whether tool calls would be allowed or denied, but does not enforce the decision. Use this mode to test and validate policies before enabling enforcement.
ENFORCE - The policy engine evaluates actions against your policies and enforces decisions by allowing or denying agent operations. Test and validate policies in LOG_ONLY mode before enabling enforcement to avoid unintended denials or adversely affecting production traffic.
workloadIdentityDetails (dict) --
The workload identity details for the updated gateway.
workloadIdentityArn (string) --
The ARN associated with the workload identity.
exceptionLevel (string) --
The level of detail in error messages returned when invoking the gateway.
If the value is DEBUG, granular exception messages are returned to help a user debug the gateway.
If the value is omitted, a generic error message is returned to the end user.
webAclArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services WAF web ACL associated with the gateway.
wafConfiguration (dict) --
The Amazon Web Services WAF configuration for the gateway.
failureMode (string) --
The failure mode that determines how the gateway handles requests when Amazon Web Services WAF is unreachable or times out. Valid values include:
FAIL_CLOSE - The gateway blocks requests when Amazon Web Services WAF cannot be evaluated.
FAIL_OPEN - The gateway allows requests when Amazon Web Services WAF cannot be evaluated.
domainOverride (dict) --
The public domain names that the gateway advertises in its OAuth discovery URLs instead of the inbound Host header.
defaultDomain (string) --
The default public domain name for the gateway. The gateway advertises this domain when a request doesn't select a specific domain.
alternateDomains (list) --
Additional public domain names for the gateway, up to 10. Don't repeat the default domain or list a domain more than once. A request can select one of these domains, or the default domain, with the x-amzn-bedrock-agentcore-gateway-domain header. The gateway rejects a request that selects a domain that isn't configured.
(string) --
{'authorizerConfiguration': {'optionalValue': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}},
'tools': {'config': {'remoteMcp': {'outboundAuth': {'awsIam': {'region': 'string',
'service': 'string'},
'none': {}}}}}}
Response {'harness': {'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}},
'tools': {'config': {'remoteMcp': {'outboundAuth': {'awsIam': {'region': 'string',
'service': 'string'},
'none': {}}}}}}}
Operation to update a harness.
See also: AWS API Documentation
Request Syntax
client.update_harness(
harnessId='string',
clientToken='string',
executionRoleArn='string',
environment={
'agentCoreRuntimeEnvironment': {
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
]
}
},
environmentArtifact={
'optionalValue': {
'containerConfiguration': {
'containerUri': 'string'
}
}
},
environmentVariables={
'string': 'string'
},
authorizerConfiguration={
'optionalValue': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
}
},
model={
'bedrockModelConfig': {
'modelId': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'converse_stream'|'responses'|'chat_completions',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'openAiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'chat_completions'|'responses',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'geminiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'topK': 123,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'liteLlmModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
}
},
systemPrompt=[
{
'text': 'string'
},
],
tools=[
{
'type': 'remote_mcp'|'agentcore_browser'|'agentcore_gateway'|'inline_function'|'agentcore_code_interpreter',
'name': 'string',
'config': {
'remoteMcp': {
'url': 'string',
'headers': {
'string': 'string'
},
'outboundAuth': {
'awsIam': {
'service': 'string',
'region': 'string'
},
'none': {}
}
},
'agentCoreBrowser': {
'browserArn': 'string'
},
'agentCoreGateway': {
'gatewayArn': 'string',
'outboundAuth': {
'awsIam': {}
,
'none': {}
,
'oauth': {
'providerArn': 'string',
'scopes': [
'string',
],
'customParameters': {
'string': 'string'
},
'grantType': 'CLIENT_CREDENTIALS'|'AUTHORIZATION_CODE'|'TOKEN_EXCHANGE',
'defaultReturnUrl': 'string'
}
}
},
'inlineFunction': {
'description': 'string',
'inputSchema': {...}|[...]|123|123.4|'string'|True|None
},
'agentCoreCodeInterpreter': {
'codeInterpreterArn': 'string'
}
}
},
],
skills=[
{
'path': 'string',
's3': {
'uri': 'string'
},
'git': {
'url': 'string',
'path': 'string',
'auth': {
'credentialArn': 'string',
'username': 'string'
}
},
'awsSkills': {
'paths': [
'string',
]
}
},
],
allowedTools=[
'string',
],
memory={
'optionalValue': {
'agentCoreMemoryConfiguration': {
'arn': 'string',
'actorId': 'string',
'messagesCount': 123,
'retrievalConfig': {
'string': {
'topK': 123,
'relevanceScore': ...,
'strategyId': 'string'
}
}
},
'managedMemoryConfiguration': {
'arn': 'string',
'strategies': [
'SEMANTIC'|'SUMMARIZATION'|'USER_PREFERENCE'|'EPISODIC',
],
'eventExpiryDuration': 123,
'encryptionKeyArn': 'string'
},
'disabled': {}
}
},
truncation={
'strategy': 'sliding_window'|'summarization'|'none',
'config': {
'slidingWindow': {
'messagesCount': 123
},
'summarization': {
'summaryRatio': ...,
'preserveRecentMessages': 123,
'summarizationSystemPrompt': 'string'
}
}
},
hooks=[
{
'beforeInvocation': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'afterInvocation': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'beforeToolCall': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'afterToolCall': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
}
},
],
maxIterations=123,
maxTokens=123,
timeoutSeconds=123
)
string
[REQUIRED]
The ID of the harness to update.
string
A unique, case-sensitive identifier to ensure idempotency of the request.
This field is autopopulated if not provided.
string
The ARN of the IAM role that the harness assumes when running. If not specified, the existing value is retained.
dict
The compute environment configuration for the harness. If not specified, the existing value is retained.
agentCoreRuntimeEnvironment (dict) --
The AgentCore Runtime environment configuration.
lifecycleConfiguration (dict) --
The lifecycle configuration for the harness's runtime environment. For a harness, idleRuntimeSessionTimeout and maxLifetime each accept a value between 60 and 28800 seconds (8 hours), and idleRuntimeSessionTimeout must be less than or equal to maxLifetime. Values above 28800 seconds are rejected with a ValidationException.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
networkConfiguration (dict) --
SecurityConfig for the Agent.
networkMode (string) -- [REQUIRED]
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) -- [REQUIRED]
The security groups associated with the VPC configuration.
(string) --
subnets (list) -- [REQUIRED]
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
filesystemConfigurations (list) --
The filesystem configurations for the runtime environment.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) -- [REQUIRED]
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) -- [REQUIRED]
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) -- [REQUIRED]
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) -- [REQUIRED]
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) -- [REQUIRED]
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
dict
The environment artifact for the harness. Use the optionalValue wrapper to set a new value, or set it to null to clear the existing configuration.
optionalValue (dict) --
The updated environment artifact value, or null to clear the existing configuration.
containerConfiguration (dict) --
Representation of a container configuration.
containerUri (string) -- [REQUIRED]
The ECR URI of the container.
dict
Environment variables to set in the harness runtime environment. If specified, this replaces all existing environment variables. If not specified, the existing value is retained.
(string) --
(string) --
dict
Wrapper for updating an optional AuthorizerConfiguration field with PATCH semantics. When present in an update request, the authorizer configuration is replaced with optionalValue. When absent, the authorizer configuration is left unchanged. To unset, include the wrapper with optionalValue not specified.
optionalValue (dict) --
The updated authorizer configuration value. If not specified, it will clear the current authorizer configuration of the resource.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) -- [REQUIRED]
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
dict
The model configuration for the harness. If not specified, the existing value is retained.
bedrockModelConfig (dict) --
Configuration for an Amazon Bedrock model.
modelId (string) -- [REQUIRED]
The Bedrock model ID.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the Bedrock provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
openAiModelConfig (dict) --
Configuration for an OpenAI model.
modelId (string) -- [REQUIRED]
The OpenAI model ID.
apiKeyArn (string) -- [REQUIRED]
The ARN of your OpenAI API key on AgentCore Identity.
apiBase (string) --
Optional custom endpoint URL for an OpenAI-compatible endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the OpenAI provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
geminiModelConfig (dict) --
Configuration for a Google Gemini model.
modelId (string) -- [REQUIRED]
The Gemini model ID.
apiKeyArn (string) -- [REQUIRED]
The ARN of your Gemini API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
topK (integer) --
The topK set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the Gemini model provider unchanged.
liteLlmModelConfig (dict) --
The LiteLLM model configuration for connecting to third-party model providers.
modelId (string) -- [REQUIRED]
The LiteLLM model identifier (e.g., "anthropic/claude-3-sonnet").
apiKeyArn (string) --
The ARN of the API key in AgentCore Identity for authenticating with the model provider.
apiBase (string) --
The base URL for the model provider's API endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per iteration.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
list
The system prompt that defines the agent's behavior. If not specified, the existing value is retained.
(dict) --
A content block in the system prompt.
text (string) --
The text content of the system prompt block.
list
The tools available to the agent. If specified, this replaces all existing tools. If not specified, the existing value is retained.
(dict) --
A tool available to the agent loop.
type (string) -- [REQUIRED]
The type of tool.
name (string) --
Unique name for the tool. If not provided, a name will be inferred or generated.
config (dict) --
Tool-specific configuration.
remoteMcp (dict) --
Configuration for remote MCP server.
url (string) -- [REQUIRED]
URL of the MCP endpoint.
headers (dict) --
Custom headers to include when connecting to the remote MCP server.
(string) --
The key of an HTTP header.
(string) --
The value of an HTTP header.
outboundAuth (dict) --
How the harness authenticates to this MCP server. Defaults to no authentication.
awsIam (dict) --
Sign requests to the remote MCP server with Signature Version 4 (SigV4) using the harness execution role. If you don't specify a Region, the harness Region is used.
service (string) -- [REQUIRED]
The target Amazon Web Services service name used for SigV4 signing. This value identifies the service that the gateway authenticates with when making requests to the target endpoint.
region (string) --
The Amazon Web Services Region used for SigV4 signing. If not specified, defaults to the gateway's Region.
none (dict) --
No authentication.
agentCoreBrowser (dict) --
Configuration for AgentCore Browser.
browserArn (string) --
If not populated, the built-in Browser ARN is used.
agentCoreGateway (dict) --
Configuration for AgentCore Gateway.
gatewayArn (string) -- [REQUIRED]
The ARN of the desired AgentCore Gateway.
outboundAuth (dict) --
How harness authenticates to this Gateway. Defaults to AWS_IAM (SigV4) if omitted.
awsIam (dict) --
SigV4-sign requests using the agent's execution role.
none (dict) --
No authentication.
oauth (dict) --
Use OAuth credentials for outbound authentication to the gateway.
The AUTHORIZATION_CODE grant type is not supported for outbound authentication from a harness to an AgentCore Gateway, even when defaultReturnUrl is specified.
providerArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the OAuth credential provider. This ARN identifies the provider in Amazon Web Services.
scopes (list) -- [REQUIRED]
The OAuth scopes for the credential provider. These scopes define the level of access requested from the OAuth provider.
(string) --
customParameters (dict) --
The custom parameters for the OAuth credential provider. These parameters provide additional configuration for the OAuth authentication process.
(string) --
(string) --
grantType (string) --
Specifies the kind of credentials to use for authorization:
CLIENT_CREDENTIALS - Authorization with a client ID and secret.
AUTHORIZATION_CODE - Authorization with a token that is specific to an individual end user.
TOKEN_EXCHANGE - Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience.
defaultReturnUrl (string) --
The URL where the end user's browser is redirected after obtaining the authorization code. Generally points to the customer's application.
inlineFunction (dict) --
Configuration for an inline function tool.
description (string) -- [REQUIRED]
Description of what the tool does, provided to the model.
inputSchema (:ref:`document<document>`) -- [REQUIRED]
JSON Schema describing the tool's input parameters.
agentCoreCodeInterpreter (dict) --
Configuration for AgentCore Code Interpreter.
codeInterpreterArn (string) --
If not populated, the built-in Code Interpreter ARN is used.
list
The skills available to the agent. If specified, this replaces all existing skills. If not specified, the existing value is retained.
(dict) --
A skill available to the agent.
path (string) --
The filesystem path to the skill definition.
s3 (dict) --
An S3 source containing the skill.
uri (string) -- [REQUIRED]
The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
git (dict) --
A git repository containing the skill.
url (string) -- [REQUIRED]
The HTTPS URL of the git repository.
path (string) --
Subdirectory within the repository containing the skill.
auth (dict) --
Authentication configuration for private repositories.
credentialArn (string) -- [REQUIRED]
The ARN of the credential in AgentCore Identity containing the password or personal access token.
username (string) --
Username for authentication. Defaults to 'oauth2' if not specified.
awsSkills (dict) --
Amazon Web Services Skills baked into the harness's underlying Runtime.
paths (list) --
Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
(string) --
list
The tools that the agent is allowed to use. If specified, this replaces all existing allowed tools. If not specified, the existing value is retained.
(string) --
dict
The AgentCore Memory configuration. Use the optionalValue wrapper to set a new value, or set it to null to clear the existing configuration.
optionalValue (dict) --
The updated memory configuration value, or null to clear the existing configuration.
agentCoreMemoryConfiguration (dict) --
The AgentCore Memory configuration.
arn (string) -- [REQUIRED]
The ARN of the AgentCore Memory resource.
actorId (string) --
The actor ID for memory operations.
messagesCount (integer) --
The number of messages to retrieve from memory.
retrievalConfig (dict) --
The retrieval configuration for long-term memory, mapping namespace path templates to retrieval settings.
(string) --
(dict) --
Configuration for memory retrieval within a namespace.
topK (integer) --
The maximum number of memory entries to retrieve.
relevanceScore (float) --
The minimum relevance score for retrieved memories.
strategyId (string) --
The ID of the retrieval strategy to use.
managedMemoryConfiguration (dict) --
Harness creates and manages a memory resource in the customer's account.
arn (string) --
The ARN of the managed AgentCore Memory resource. Read-only on Get, ignored on Create/Update input.
strategies (list) --
Strategy types to enable. Defaults to [SEMANTIC, SUMMARIZATION].
(string) --
eventExpiryDuration (integer) --
Event retention in days. Defaults to 30.
encryptionKeyArn (string) --
Customer-managed KMS key. Defaults to Amazon Web Services-owned key. Not updatable after creation.
disabled (dict) --
Explicitly opt out of memory.
dict
The truncation configuration for managing conversation context. If not specified, the existing value is retained.
strategy (string) -- [REQUIRED]
The truncation strategy to use.
config (dict) --
The strategy-specific configuration.
slidingWindow (dict) --
Configuration for sliding window truncation.
messagesCount (integer) --
The number of recent messages to retain in the context window.
summarization (dict) --
Configuration for summarization-based truncation.
summaryRatio (float) --
The ratio of content to summarize.
preserveRecentMessages (integer) --
The number of recent messages to preserve without summarization.
summarizationSystemPrompt (string) --
The system prompt used for generating summaries.
list
The lifecycle hooks to run at defined points in the agent loop. If specified, this replaces all existing hooks. If not specified, the existing hooks are retained.
(dict) --
A lifecycle hook configuration. Specify one hook type.
beforeInvocation (dict) --
A hook that runs before an invocation begins.
name (string) -- [REQUIRED]
The name of the hook.
target (dict) -- [REQUIRED]
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) -- [REQUIRED]
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon EventBridge event bus to send hook events to.
afterInvocation (dict) --
A hook that runs after an invocation completes.
name (string) -- [REQUIRED]
The name of the hook.
target (dict) -- [REQUIRED]
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) -- [REQUIRED]
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon EventBridge event bus to send hook events to.
beforeToolCall (dict) --
A hook that runs before the agent calls a tool.
name (string) -- [REQUIRED]
The name of the hook.
target (dict) -- [REQUIRED]
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) -- [REQUIRED]
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon EventBridge event bus to send hook events to.
afterToolCall (dict) --
A hook that runs after a tool call completes.
name (string) -- [REQUIRED]
The name of the hook.
target (dict) -- [REQUIRED]
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) -- [REQUIRED]
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) -- [REQUIRED]
The ARN of the Amazon EventBridge event bus to send hook events to.
integer
The maximum number of iterations the agent loop can execute per invocation. If not specified, the existing value is retained.
integer
The maximum total number of output tokens the agent can generate across all model calls within a single invocation. If not specified, the existing value is retained.
integer
The maximum duration in seconds for the agent loop execution per invocation. If not specified, the existing value is retained.
dict
Response Syntax
{
'harness': {
'harnessId': 'string',
'harnessName': 'string',
'arn': 'string',
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED',
'harnessVersion': 'string',
'executionRoleArn': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'model': {
'bedrockModelConfig': {
'modelId': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'converse_stream'|'responses'|'chat_completions',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'openAiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'apiFormat': 'chat_completions'|'responses',
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'geminiModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'topK': 123,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
},
'liteLlmModelConfig': {
'modelId': 'string',
'apiKeyArn': 'string',
'apiBase': 'string',
'maxTokens': 123,
'temperature': ...,
'topP': ...,
'additionalParams': {...}|[...]|123|123.4|'string'|True|None
}
},
'systemPrompt': [
{
'text': 'string'
},
],
'tools': [
{
'type': 'remote_mcp'|'agentcore_browser'|'agentcore_gateway'|'inline_function'|'agentcore_code_interpreter',
'name': 'string',
'config': {
'remoteMcp': {
'url': 'string',
'headers': {
'string': 'string'
},
'outboundAuth': {
'awsIam': {
'service': 'string',
'region': 'string'
},
'none': {}
}
},
'agentCoreBrowser': {
'browserArn': 'string'
},
'agentCoreGateway': {
'gatewayArn': 'string',
'outboundAuth': {
'awsIam': {},
'none': {},
'oauth': {
'providerArn': 'string',
'scopes': [
'string',
],
'customParameters': {
'string': 'string'
},
'grantType': 'CLIENT_CREDENTIALS'|'AUTHORIZATION_CODE'|'TOKEN_EXCHANGE',
'defaultReturnUrl': 'string'
}
}
},
'inlineFunction': {
'description': 'string',
'inputSchema': {...}|[...]|123|123.4|'string'|True|None
},
'agentCoreCodeInterpreter': {
'codeInterpreterArn': 'string'
}
}
},
],
'skills': [
{
'path': 'string',
's3': {
'uri': 'string'
},
'git': {
'url': 'string',
'path': 'string',
'auth': {
'credentialArn': 'string',
'username': 'string'
}
},
'awsSkills': {
'paths': [
'string',
]
}
},
],
'allowedTools': [
'string',
],
'truncation': {
'strategy': 'sliding_window'|'summarization'|'none',
'config': {
'slidingWindow': {
'messagesCount': 123
},
'summarization': {
'summaryRatio': ...,
'preserveRecentMessages': 123,
'summarizationSystemPrompt': 'string'
}
}
},
'environment': {
'agentCoreRuntimeEnvironment': {
'agentRuntimeArn': 'string',
'agentRuntimeName': 'string',
'agentRuntimeId': 'string',
'lifecycleConfiguration': {
'idleRuntimeSessionTimeout': 123,
'maxLifetime': 123
},
'networkConfiguration': {
'networkMode': 'PUBLIC'|'VPC',
'networkModeConfig': {
'securityGroups': [
'string',
],
'subnets': [
'string',
],
'requireServiceS3Endpoint': True|False
}
},
'filesystemConfigurations': [
{
'sessionStorage': {
'mountPath': 'string'
},
's3FilesAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'efsAccessPoint': {
'accessPointArn': 'string',
'mountPath': 'string'
},
'capacityProviderVolume': {
'volumeName': 'string',
'mountPath': 'string'
}
},
]
}
},
'environmentArtifact': {
'containerConfiguration': {
'containerUri': 'string'
}
},
'environmentVariables': {
'string': 'string'
},
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'memory': {
'agentCoreMemoryConfiguration': {
'arn': 'string',
'actorId': 'string',
'messagesCount': 123,
'retrievalConfig': {
'string': {
'topK': 123,
'relevanceScore': ...,
'strategyId': 'string'
}
}
},
'managedMemoryConfiguration': {
'arn': 'string',
'strategies': [
'SEMANTIC'|'SUMMARIZATION'|'USER_PREFERENCE'|'EPISODIC',
],
'eventExpiryDuration': 123,
'encryptionKeyArn': 'string'
},
'disabled': {}
},
'hooks': [
{
'beforeInvocation': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'afterInvocation': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'beforeToolCall': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
},
'afterToolCall': {
'name': 'string',
'target': {
'lambda': {
'arn': 'string',
'timeoutSeconds': 123,
'failureMode': 'allow'|'deny'
},
'sns': {
'arn': 'string'
},
'eventBridge': {
'arn': 'string'
}
}
}
},
],
'maxIterations': 123,
'maxTokens': 123,
'timeoutSeconds': 123,
'failureReason': 'string'
}
}
Response Structure
(dict) --
harness (dict) --
The updated harness.
harnessId (string) --
The ID of the harness.
harnessName (string) --
The name of the harness.
arn (string) --
The ARN of the harness.
status (string) --
The status of the harness.
harnessVersion (string) --
The version of the harness. Incremented on every successful UpdateHarness.
executionRoleArn (string) --
IAM role the harness assumes when running.
createdAt (datetime) --
The createdAt time of the harness.
updatedAt (datetime) --
The updatedAt time of the harness.
model (dict) --
The configuration of the default model used by the Harness.
bedrockModelConfig (dict) --
Configuration for an Amazon Bedrock model.
modelId (string) --
The Bedrock model ID.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the Bedrock provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
openAiModelConfig (dict) --
Configuration for an OpenAI model.
modelId (string) --
The OpenAI model ID.
apiKeyArn (string) --
The ARN of your OpenAI API key on AgentCore Identity.
apiBase (string) --
Optional custom endpoint URL for an OpenAI-compatible endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
apiFormat (string) --
The API format to use when calling the OpenAI provider.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
geminiModelConfig (dict) --
Configuration for a Google Gemini model.
modelId (string) --
The Gemini model ID.
apiKeyArn (string) --
The ARN of your Gemini API key on AgentCore Identity.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per model call.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
topK (integer) --
The topK set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the Gemini model provider unchanged.
liteLlmModelConfig (dict) --
The LiteLLM model configuration for connecting to third-party model providers.
modelId (string) --
The LiteLLM model identifier (e.g., "anthropic/claude-3-sonnet").
apiKeyArn (string) --
The ARN of the API key in AgentCore Identity for authenticating with the model provider.
apiBase (string) --
The base URL for the model provider's API endpoint.
maxTokens (integer) --
The maximum number of tokens to allow in the generated response per iteration.
temperature (float) --
The temperature to set when calling the model.
topP (float) --
The topP set when calling the model.
additionalParams (:ref:`document<document>`) --
Provider-specific parameters passed through to the model provider unchanged.
systemPrompt (list) --
The system prompt of the harness.
(dict) --
A content block in the system prompt.
text (string) --
The text content of the system prompt block.
tools (list) --
The tools of the harness.
(dict) --
A tool available to the agent loop.
type (string) --
The type of tool.
name (string) --
Unique name for the tool. If not provided, a name will be inferred or generated.
config (dict) --
Tool-specific configuration.
remoteMcp (dict) --
Configuration for remote MCP server.
url (string) --
URL of the MCP endpoint.
headers (dict) --
Custom headers to include when connecting to the remote MCP server.
(string) --
The key of an HTTP header.
(string) --
The value of an HTTP header.
outboundAuth (dict) --
How the harness authenticates to this MCP server. Defaults to no authentication.
awsIam (dict) --
Sign requests to the remote MCP server with Signature Version 4 (SigV4) using the harness execution role. If you don't specify a Region, the harness Region is used.
service (string) --
The target Amazon Web Services service name used for SigV4 signing. This value identifies the service that the gateway authenticates with when making requests to the target endpoint.
region (string) --
The Amazon Web Services Region used for SigV4 signing. If not specified, defaults to the gateway's Region.
none (dict) --
No authentication.
agentCoreBrowser (dict) --
Configuration for AgentCore Browser.
browserArn (string) --
If not populated, the built-in Browser ARN is used.
agentCoreGateway (dict) --
Configuration for AgentCore Gateway.
gatewayArn (string) --
The ARN of the desired AgentCore Gateway.
outboundAuth (dict) --
How harness authenticates to this Gateway. Defaults to AWS_IAM (SigV4) if omitted.
awsIam (dict) --
SigV4-sign requests using the agent's execution role.
none (dict) --
No authentication.
oauth (dict) --
Use OAuth credentials for outbound authentication to the gateway.
The AUTHORIZATION_CODE grant type is not supported for outbound authentication from a harness to an AgentCore Gateway, even when defaultReturnUrl is specified.
providerArn (string) --
The Amazon Resource Name (ARN) of the OAuth credential provider. This ARN identifies the provider in Amazon Web Services.
scopes (list) --
The OAuth scopes for the credential provider. These scopes define the level of access requested from the OAuth provider.
(string) --
customParameters (dict) --
The custom parameters for the OAuth credential provider. These parameters provide additional configuration for the OAuth authentication process.
(string) --
(string) --
grantType (string) --
Specifies the kind of credentials to use for authorization:
CLIENT_CREDENTIALS - Authorization with a client ID and secret.
AUTHORIZATION_CODE - Authorization with a token that is specific to an individual end user.
TOKEN_EXCHANGE - Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience.
defaultReturnUrl (string) --
The URL where the end user's browser is redirected after obtaining the authorization code. Generally points to the customer's application.
inlineFunction (dict) --
Configuration for an inline function tool.
description (string) --
Description of what the tool does, provided to the model.
inputSchema (:ref:`document<document>`) --
JSON Schema describing the tool's input parameters.
agentCoreCodeInterpreter (dict) --
Configuration for AgentCore Code Interpreter.
codeInterpreterArn (string) --
If not populated, the built-in Code Interpreter ARN is used.
skills (list) --
The skills of the harness.
(dict) --
A skill available to the agent.
path (string) --
The filesystem path to the skill definition.
s3 (dict) --
An S3 source containing the skill.
uri (string) --
The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/).
git (dict) --
A git repository containing the skill.
url (string) --
The HTTPS URL of the git repository.
path (string) --
Subdirectory within the repository containing the skill.
auth (dict) --
Authentication configuration for private repositories.
credentialArn (string) --
The ARN of the credential in AgentCore Identity containing the password or personal access token.
username (string) --
Username for authentication. Defaults to 'oauth2' if not specified.
awsSkills (dict) --
Amazon Web Services Skills baked into the harness's underlying Runtime.
paths (list) --
Optionally filter allowed skills with glob syntax, e.g., ['core-skills/*'].
(string) --
allowedTools (list) --
The allowed tools of the harness. All tools are allowed by default.
(string) --
truncation (dict) --
Configuration for truncating model context.
strategy (string) --
The truncation strategy to use.
config (dict) --
The strategy-specific configuration.
slidingWindow (dict) --
Configuration for sliding window truncation.
messagesCount (integer) --
The number of recent messages to retain in the context window.
summarization (dict) --
Configuration for summarization-based truncation.
summaryRatio (float) --
The ratio of content to summarize.
preserveRecentMessages (integer) --
The number of recent messages to preserve without summarization.
summarizationSystemPrompt (string) --
The system prompt used for generating summaries.
environment (dict) --
The compute environment on which the Harness runs.
agentCoreRuntimeEnvironment (dict) --
The AgentCore Runtime environment configuration.
agentRuntimeArn (string) --
The ARN of the underlying AgentCore Runtime.
agentRuntimeName (string) --
The name of the underlying AgentCore Runtime.
agentRuntimeId (string) --
The ID of the underlying AgentCore Runtime.
lifecycleConfiguration (dict) --
The lifecycle configuration for the harness's runtime environment. For a harness, idleRuntimeSessionTimeout and maxLifetime each accept a value between 60 and 28800 seconds (8 hours), and idleRuntimeSessionTimeout must be less than or equal to maxLifetime.
idleRuntimeSessionTimeout (integer) --
Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
maxLifetime (integer) --
Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
networkConfiguration (dict) --
SecurityConfig for the Agent.
networkMode (string) --
The network mode for the AgentCore Runtime.
networkModeConfig (dict) --
The network mode configuration for the AgentCore Runtime.
securityGroups (list) --
The security groups associated with the VPC configuration.
(string) --
subnets (list) --
The subnets associated with the VPC configuration.
(string) --
requireServiceS3Endpoint (boolean) --
Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup.
Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an UpdateAgentRuntime request for these agent runtimes returns a ValidationException.
Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to false via the UpdateAgentRuntime API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to true, the service-managed Amazon S3 gateway remains provisioned.
This field is only supported in the UpdateAgentRuntime API for pre-rollout agent runtimes. Passing this field in a CreateAgentRuntime request returns a ValidationException.
filesystemConfigurations (list) --
The filesystem configurations for the runtime environment.
(dict) --
Configuration for a filesystem that can be mounted into the AgentCore Runtime.
sessionStorage (dict) --
Configuration for session storage. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.
mountPath (string) --
The mount path for the session storage filesystem inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
s3FilesAccessPoint (dict) --
Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the S3 Files access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
efsAccessPoint (dict) --
Configuration for an Amazon EFS access point to mount into the AgentCore Runtime.
accessPointArn (string) --
The ARN of the EFS access point to mount into the AgentCore Runtime.
mountPath (string) --
The mount path for the EFS access point inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
capacityProviderVolume (dict) --
Configuration for a capacity provider volume to mount into the AgentCore Runtime. This mounts a persistent volume that is defined on the capacity provider, referenced by its logical name.
volumeName (string) --
The logical name of the capacity provider volume to mount. This name must match a volume that is defined in the capacity provider's list of volumes.
mountPath (string) --
The mount path for the capacity provider volume inside the AgentCore Runtime. The path must be under /mnt with exactly one subdirectory level (for example, /mnt/data).
environmentArtifact (dict) --
The environment artifact (e.g., container) in which the Harness operates.
containerConfiguration (dict) --
Representation of a container configuration.
containerUri (string) --
The ECR URI of the container.
environmentVariables (dict) --
Environment variables exposed in the environment in which the harness operates.
(string) --
(string) --
authorizerConfiguration (dict) --
Represents inbound authorization configuration options used to authenticate incoming requests.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
memory (dict) --
AgentCore Memory instance configuration for short and long term memory.
agentCoreMemoryConfiguration (dict) --
The AgentCore Memory configuration.
arn (string) --
The ARN of the AgentCore Memory resource.
actorId (string) --
The actor ID for memory operations.
messagesCount (integer) --
The number of messages to retrieve from memory.
retrievalConfig (dict) --
The retrieval configuration for long-term memory, mapping namespace path templates to retrieval settings.
(string) --
(dict) --
Configuration for memory retrieval within a namespace.
topK (integer) --
The maximum number of memory entries to retrieve.
relevanceScore (float) --
The minimum relevance score for retrieved memories.
strategyId (string) --
The ID of the retrieval strategy to use.
managedMemoryConfiguration (dict) --
Harness creates and manages a memory resource in the customer's account.
arn (string) --
The ARN of the managed AgentCore Memory resource. Read-only on Get, ignored on Create/Update input.
strategies (list) --
Strategy types to enable. Defaults to [SEMANTIC, SUMMARIZATION].
(string) --
eventExpiryDuration (integer) --
Event retention in days. Defaults to 30.
encryptionKeyArn (string) --
Customer-managed KMS key. Defaults to Amazon Web Services-owned key. Not updatable after creation.
disabled (dict) --
Explicitly opt out of memory.
hooks (list) --
The lifecycle hooks configured for the harness.
(dict) --
A lifecycle hook configuration. Specify one hook type.
beforeInvocation (dict) --
A hook that runs before an invocation begins.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
afterInvocation (dict) --
A hook that runs after an invocation completes.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
beforeToolCall (dict) --
A hook that runs before the agent calls a tool.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
afterToolCall (dict) --
A hook that runs after a tool call completes.
name (string) --
The name of the hook.
target (dict) --
The target that receives the hook event.
lambda (dict) --
A Lambda hook target that invokes an Amazon Web Services Lambda function synchronously and waits for its response.
arn (string) --
The ARN of the Lambda function to invoke.
timeoutSeconds (integer) --
The maximum number of seconds to wait for the Lambda function response. The default is 60 seconds.
failureMode (string) --
The behavior when the Lambda function times out, returns an error, or returns an invalid response. The default is DENY.
sns (dict) --
An Amazon SNS hook target that publishes the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon SNS topic to publish hook events to.
eventBridge (dict) --
An Amazon EventBridge hook target that sends the hook event without waiting for a response.
arn (string) --
The ARN of the Amazon EventBridge event bus to send hook events to.
maxIterations (integer) --
The maximum number of iterations in the agent loop allowed before exiting per invocation.
maxTokens (integer) --
The maximum total number of output tokens the agent can generate across all model calls within a single invocation.
timeoutSeconds (integer) --
The maximum duration per invocation.
failureReason (string) --
Reason why create or update operations fail.
{'oauth2ProviderConfigInput': {'customOauth2ProviderConfig': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Response {'oauth2ProviderConfigOutput': {'customOauth2ProviderConfig': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Updates an existing OAuth2 credential provider.
See also: AWS API Documentation
Request Syntax
client.update_oauth2_credential_provider(
name='string',
credentialProviderVendor='GoogleOauth2'|'GithubOauth2'|'SlackOauth2'|'SalesforceOauth2'|'MicrosoftOauth2'|'CustomOauth2'|'AtlassianOauth2'|'LinkedinOauth2'|'XOauth2'|'OktaOauth2'|'OneLoginOauth2'|'PingOneOauth2'|'FacebookOauth2'|'YandexOauth2'|'RedditOauth2'|'ZoomOauth2'|'TwitchOauth2'|'SpotifyOauth2'|'DropboxOauth2'|'NotionOauth2'|'HubspotOauth2'|'CyberArkOauth2'|'FusionAuthOauth2'|'Auth0Oauth2'|'CognitoOauth2',
oauth2ProviderConfigInput={
'customOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL',
'onBehalfOfTokenExchangeConfig': {
'grantType': 'TOKEN_EXCHANGE'|'JWT_AUTHORIZATION_GRANT',
'tokenExchangeGrantTypeConfig': {
'actorTokenContent': 'NONE'|'M2M'|'AWS_IAM_ID_TOKEN_JWT',
'actorTokenScopes': [
'string',
]
},
'onBehalfOfAuthenticationConfig': {
'clientAuthenticationMethod': 'NO_CLIENT'
}
},
'clientAuthenticationMethod': 'CLIENT_SECRET_BASIC'|'CLIENT_SECRET_POST'|'AWS_IAM_ID_TOKEN_JWT'|'PRIVATE_KEY_JWT',
'privateKeyJwtConfig': {
'privateKeySource': {
'kmsKeySource': {
'kmsKeyArn': 'string'
}
},
'signingAlgorithm': 'RS256'|'PS256'|'ES256',
'additionalHeaderClaims': {
'string': 'string'
},
'additionalPayloadClaims': {
'string': 'string'
}
},
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
]
},
'googleOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL'
},
'githubOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL'
},
'slackOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL'
},
'salesforceOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL'
},
'microsoftOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL',
'tenantId': 'string'
},
'atlassianOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL'
},
'linkedinOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL'
},
'includedOauth2ProviderConfig': {
'clientId': 'string',
'clientSecret': 'string',
'clientSecretConfig': {
'secretId': 'string',
'jsonKey': 'string'
},
'clientSecretSource': 'MANAGED'|'EXTERNAL',
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string'
}
}
)
string
[REQUIRED]
The name of the OAuth2 credential provider to update.
string
[REQUIRED]
The vendor of the OAuth2 credential provider.
dict
[REQUIRED]
The configuration input for the OAuth2 provider.
customOauth2ProviderConfig (dict) --
The configuration for a custom OAuth2 provider.
oauthDiscovery (dict) -- [REQUIRED]
The OAuth2 discovery information for the custom provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) -- [REQUIRED]
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) -- [REQUIRED]
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) -- [REQUIRED]
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the custom OAuth2 provider.
clientSecret (string) --
The client secret for the custom OAuth2 provider.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
onBehalfOfTokenExchangeConfig (dict) --
The configuration for on-behalf-of token exchange. This enables authentication flows that use RFC 8693 token exchange or RFC 7523 JWT authorization grants.
grantType (string) -- [REQUIRED]
The grant type for the on-behalf-of token exchange.
tokenExchangeGrantTypeConfig (dict) --
Configuration specific to the TOKEN_EXCHANGE grant type (RFC 8693).
actorTokenContent (string) -- [REQUIRED]
The content type for the actor token in the token exchange.
actorTokenScopes (list) --
The scopes for the actor token. Only valid when actorTokenContent is M2M.
(string) --
onBehalfOfAuthenticationConfig (dict) --
Specify the client authentication configuration to use for the on-behalf-of token exchange. With this configuration, you override the provider level client authentication method for the on-behalf-of exchange with the identity provider. If you don't specify this configuration, we use the provider level client authentication method.
clientAuthenticationMethod (string) -- [REQUIRED]
The client authentication method to use during the on-behalf-of token exchange. The NO_CLIENT option omits the clientId and clientSecret during the on-behalf-of token exchange with the identity provider.
clientAuthenticationMethod (string) --
The client authentication method to use when authenticating with the token endpoint.
privateKeyJwtConfig (dict) --
The private_key_jwt client authentication configuration for this credential provider. When specified, the credential provider uses JWT client assertions to authenticate with the token endpoint.
privateKeySource (dict) --
The private key source for the JWT client assertion.
kmsKeySource (dict) --
The KMS key source for the JWT client assertion.
kmsKeyArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the KMS key used to sign the JWT client assertion. The key must be an asymmetric key with key usage SIGN_VERIFY and a key spec compatible with the configured signing algorithm.
signingAlgorithm (string) --
The algorithm used to sign the JWT client assertion. Valid values are RS256, PS256, and ES256.
additionalHeaderClaims (dict) --
A map of additional claims to include in the JWT client assertion header. Standard header claims such as alg and typ cannot be added.
(string) --
(string) --
additionalPayloadClaims (dict) --
A map of additional claims to include in the JWT client assertion payload. Payload claims generated by the service, such as iss, sub, jti, and exp, cannot be added.
(string) --
(string) --
privateEndpoint (dict) --
The default private endpoint for the custom OAuth2 provider, enabling secure connectivity through a VPC Lattice resource configuration.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom OAuth2 provider configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) -- [REQUIRED]
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
googleOauth2ProviderConfig (dict) --
The configuration for a Google OAuth2 provider.
clientId (string) -- [REQUIRED]
The client ID for the Google OAuth2 provider.
clientSecret (string) --
The client secret for the Google OAuth2 provider.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
githubOauth2ProviderConfig (dict) --
The configuration for a GitHub OAuth2 provider.
clientId (string) -- [REQUIRED]
The client ID for the GitHub OAuth2 provider.
clientSecret (string) --
The client secret for the GitHub OAuth2 provider.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
slackOauth2ProviderConfig (dict) --
The configuration for a Slack OAuth2 provider.
clientId (string) -- [REQUIRED]
The client ID for the Slack OAuth2 provider.
clientSecret (string) --
The client secret for the Slack OAuth2 provider.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
salesforceOauth2ProviderConfig (dict) --
The configuration for a Salesforce OAuth2 provider.
clientId (string) -- [REQUIRED]
The client ID for the Salesforce OAuth2 provider.
clientSecret (string) --
The client secret for the Salesforce OAuth2 provider.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
microsoftOauth2ProviderConfig (dict) --
The configuration for a Microsoft OAuth2 provider.
clientId (string) -- [REQUIRED]
The client ID for the Microsoft OAuth2 provider.
clientSecret (string) --
The client secret for the Microsoft OAuth2 provider.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
tenantId (string) --
The Microsoft Entra ID (formerly Azure AD) tenant ID for your organization. This identifies the specific tenant within Microsoft's identity platform where your application is registered.
atlassianOauth2ProviderConfig (dict) --
Configuration settings for Atlassian OAuth2 provider integration.
clientId (string) -- [REQUIRED]
The client ID for the Atlassian OAuth2 provider. This identifier is assigned by Atlassian when you register your application.
clientSecret (string) --
The client secret for the Atlassian OAuth2 provider. This secret is assigned by Atlassian and used along with the client ID to authenticate your application.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret for the Atlassian OAuth2 provider. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
linkedinOauth2ProviderConfig (dict) --
Configuration settings for LinkedIn OAuth2 provider integration.
clientId (string) -- [REQUIRED]
The client ID for the LinkedIn OAuth2 provider. This identifier is assigned by LinkedIn when you register your application.
clientSecret (string) --
The client secret for the LinkedIn OAuth2 provider. This secret is assigned by LinkedIn and used along with the client ID to authenticate your application.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
includedOauth2ProviderConfig (dict) --
The configuration for a non-custom OAuth2 provider. This includes settings for supported OAuth2 providers that have built-in integration support.
clientId (string) -- [REQUIRED]
The client ID for the supported OAuth2 provider. This identifier is assigned by the OAuth2 provider when you register your application.
clientSecret (string) --
The client secret for the supported OAuth2 provider. This secret is assigned by the OAuth2 provider and used along with the client ID to authenticate your application.
clientSecretConfig (dict) --
A reference to the Amazon Web Services Secrets Manager secret that stores the client secret. This includes the secret ID and the JSON key used to extract the client secret value from the secret. Required when clientSecretSource is set to EXTERNAL.
secretId (string) -- [REQUIRED]
The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
jsonKey (string) -- [REQUIRED]
The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Use MANAGED if the secret is managed by the service, or EXTERNAL if you manage the secret yourself in Amazon Web Services Secrets Manager.
issuer (string) --
Token issuer of your isolated OAuth2 application tenant. This URL identifies the authorization server that issues tokens for this provider.
authorizationEndpoint (string) --
OAuth2 authorization endpoint for your isolated OAuth2 application tenant. This is where users are redirected to authenticate and authorize access to their resources.
tokenEndpoint (string) --
OAuth2 token endpoint for your isolated OAuth2 application tenant. This is where authorization codes are exchanged for access tokens.
dict
Response Syntax
{
'clientSecretArn': {
'secretArn': 'string'
},
'clientSecretJsonKey': 'string',
'clientSecretSource': 'MANAGED'|'EXTERNAL',
'name': 'string',
'credentialProviderVendor': 'GoogleOauth2'|'GithubOauth2'|'SlackOauth2'|'SalesforceOauth2'|'MicrosoftOauth2'|'CustomOauth2'|'AtlassianOauth2'|'LinkedinOauth2'|'XOauth2'|'OktaOauth2'|'OneLoginOauth2'|'PingOneOauth2'|'FacebookOauth2'|'YandexOauth2'|'RedditOauth2'|'ZoomOauth2'|'TwitchOauth2'|'SpotifyOauth2'|'DropboxOauth2'|'NotionOauth2'|'HubspotOauth2'|'CyberArkOauth2'|'FusionAuthOauth2'|'Auth0Oauth2'|'CognitoOauth2',
'credentialProviderArn': 'string',
'callbackUrl': 'string',
'oauth2ProviderConfigOutput': {
'customOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string',
'onBehalfOfTokenExchangeConfig': {
'grantType': 'TOKEN_EXCHANGE'|'JWT_AUTHORIZATION_GRANT',
'tokenExchangeGrantTypeConfig': {
'actorTokenContent': 'NONE'|'M2M'|'AWS_IAM_ID_TOKEN_JWT',
'actorTokenScopes': [
'string',
]
},
'onBehalfOfAuthenticationConfig': {
'clientAuthenticationMethod': 'NO_CLIENT'
}
},
'clientAuthenticationMethod': 'CLIENT_SECRET_BASIC'|'CLIENT_SECRET_POST'|'AWS_IAM_ID_TOKEN_JWT'|'PRIVATE_KEY_JWT',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'privateKeyJwtConfig': {
'privateKeySource': {
'kmsKeySource': {
'kmsKeyArn': 'string'
}
},
'signingAlgorithm': 'RS256'|'PS256'|'ES256',
'additionalHeaderClaims': {
'string': 'string'
},
'additionalPayloadClaims': {
'string': 'string'
}
}
},
'googleOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'githubOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'slackOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'salesforceOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'microsoftOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'atlassianOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'linkedinOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
},
'includedOauth2ProviderConfig': {
'oauthDiscovery': {
'discoveryUrl': 'string',
'authorizationServerMetadata': {
'issuer': 'string',
'authorizationEndpoint': 'string',
'tokenEndpoint': 'string',
'responseTypes': [
'string',
],
'tokenEndpointAuthMethods': [
'string',
]
}
},
'clientId': 'string'
}
},
'createdTime': datetime(2015, 1, 1),
'lastUpdatedTime': datetime(2015, 1, 1),
'status': 'CREATING'|'CREATE_FAILED'|'UPDATING'|'UPDATE_FAILED'|'READY'|'DELETING'|'DELETE_FAILED'
}
Response Structure
(dict) --
clientSecretArn (dict) --
The Amazon Resource Name (ARN) of the client secret in Amazon Web Services Secrets Manager.
secretArn (string) --
The Amazon Resource Name (ARN) of the secret in Amazon Web Services Secrets Manager.
clientSecretJsonKey (string) --
The JSON key used to extract the client secret value from the Amazon Web Services Secrets Manager secret.
clientSecretSource (string) --
The source type of the client secret. Either MANAGED if the secret is managed by the service, or EXTERNAL if managed by the user in Amazon Web Services Secrets Manager.
name (string) --
The name of the OAuth2 credential provider.
credentialProviderVendor (string) --
The vendor of the OAuth2 credential provider.
credentialProviderArn (string) --
The Amazon Resource Name (ARN) of the OAuth2 credential provider.
callbackUrl (string) --
Callback URL to register on the OAuth2 credential provider as an allowed callback URL. This URL is where the OAuth2 authorization server redirects users after they complete the authorization flow.
oauth2ProviderConfigOutput (dict) --
The configuration output for the OAuth2 provider.
customOauth2ProviderConfig (dict) --
The output configuration for a custom OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the custom provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the custom OAuth2 provider.
onBehalfOfTokenExchangeConfig (dict) --
The configuration for on-behalf-of token exchange.
grantType (string) --
The grant type for the on-behalf-of token exchange.
tokenExchangeGrantTypeConfig (dict) --
Configuration specific to the TOKEN_EXCHANGE grant type (RFC 8693).
actorTokenContent (string) --
The content type for the actor token in the token exchange.
actorTokenScopes (list) --
The scopes for the actor token. Only valid when actorTokenContent is M2M.
(string) --
onBehalfOfAuthenticationConfig (dict) --
Specify the client authentication configuration to use for the on-behalf-of token exchange. With this configuration, you override the provider level client authentication method for the on-behalf-of exchange with the identity provider. If you don't specify this configuration, we use the provider level client authentication method.
clientAuthenticationMethod (string) --
The client authentication method to use during the on-behalf-of token exchange. The NO_CLIENT option omits the clientId and clientSecret during the on-behalf-of token exchange with the identity provider.
clientAuthenticationMethod (string) --
The client authentication method used when authenticating with the token endpoint.
privateEndpoint (dict) --
The default private endpoint for the custom OAuth2 provider, enabling secure connectivity through a VPC Lattice resource configuration.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom OAuth2 provider configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
privateKeyJwtConfig (dict) --
The configuration for private_key_jwt client authentication used by this OAuth2 credential provider.
privateKeySource (dict) --
The private key source for the JWT client assertion.
kmsKeySource (dict) --
The KMS key source for the JWT client assertion.
kmsKeyArn (string) --
The Amazon Resource Name (ARN) of the KMS key used to sign the JWT client assertion. The key must be an asymmetric key with key usage SIGN_VERIFY and a key spec compatible with the configured signing algorithm.
signingAlgorithm (string) --
The algorithm used to sign the JWT client assertion. Valid values are RS256, PS256, and ES256.
additionalHeaderClaims (dict) --
A map of additional claims to include in the JWT client assertion header. Standard header claims such as alg and typ cannot be added.
(string) --
(string) --
additionalPayloadClaims (dict) --
A map of additional claims to include in the JWT client assertion payload. Payload claims generated by the service, such as iss, sub, jti, and exp, cannot be added.
(string) --
(string) --
googleOauth2ProviderConfig (dict) --
The output configuration for a Google OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the Google provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Google OAuth2 provider.
githubOauth2ProviderConfig (dict) --
The output configuration for a GitHub OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the GitHub provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the GitHub OAuth2 provider.
slackOauth2ProviderConfig (dict) --
The output configuration for a Slack OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the Slack provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Slack OAuth2 provider.
salesforceOauth2ProviderConfig (dict) --
The output configuration for a Salesforce OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the Salesforce provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Salesforce OAuth2 provider.
microsoftOauth2ProviderConfig (dict) --
The output configuration for a Microsoft OAuth2 provider.
oauthDiscovery (dict) --
The OAuth2 discovery information for the Microsoft provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Microsoft OAuth2 provider.
atlassianOauth2ProviderConfig (dict) --
The configuration details for the Atlassian OAuth2 provider.
oauthDiscovery (dict) --
Contains the discovery information for an OAuth2 provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the Atlassian OAuth2 provider.
linkedinOauth2ProviderConfig (dict) --
The configuration details for the LinkedIn OAuth2 provider.
oauthDiscovery (dict) --
Contains the discovery information for an OAuth2 provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the LinkedIn OAuth2 provider.
includedOauth2ProviderConfig (dict) --
The configuration for a non-custom OAuth2 provider. This includes the configuration details for supported OAuth2 providers that have built-in integration support.
oauthDiscovery (dict) --
Contains the discovery information for an OAuth2 provider.
discoveryUrl (string) --
The discovery URL for the OAuth2 provider.
authorizationServerMetadata (dict) --
The authorization server metadata for the OAuth2 provider.
issuer (string) --
The issuer URL for the OAuth2 authorization server.
authorizationEndpoint (string) --
The authorization endpoint URL for the OAuth2 authorization server.
tokenEndpoint (string) --
The token endpoint URL for the OAuth2 authorization server.
responseTypes (list) --
The supported response types for the OAuth2 authorization server.
(string) --
tokenEndpointAuthMethods (list) --
The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.
(string) --
clientId (string) --
The client ID for the supported OAuth2 provider.
createdTime (datetime) --
The timestamp when the OAuth2 credential provider was created.
lastUpdatedTime (datetime) --
The timestamp when the OAuth2 credential provider was last updated.
status (string) --
The current status of the updated OAuth2 credential provider.
{'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Updates an existing payment manager. This operation uses PATCH semantics, so you only need to specify the fields you want to change.
See also: AWS API Documentation
Request Syntax
client.update_payment_manager(
paymentManagerId='string',
description='string',
authorizerType='CUSTOM_JWT'|'AWS_IAM',
authorizerConfiguration={
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
roleArn='string',
clientToken='string',
kmsKeyArn='string'
)
string
[REQUIRED]
The unique identifier of the payment manager to update.
string
The updated description of the payment manager.
string
The updated authorizer type for the payment manager.
dict
The updated authorizer configuration for the payment manager.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) -- [REQUIRED]
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
string
The updated Amazon Resource Name (ARN) of the IAM role for the payment manager.
string
A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If you don't specify this field, a value is randomly generated for you. If this token matches a previous request, the service ignores the request, but doesn't return an error. For more information, see Ensuring idempotency.
This field is autopopulated if not provided.
string
The updated Amazon Resource Name (ARN) of the customer managed KMS key used to encrypt sensitive payment manager data at rest.
dict
Response Syntax
{
'paymentManagerArn': 'string',
'paymentManagerId': 'string',
'name': 'string',
'authorizerType': 'CUSTOM_JWT'|'AWS_IAM',
'roleArn': 'string',
'workloadIdentityDetails': {
'workloadIdentityArn': 'string'
},
'lastUpdatedAt': datetime(2015, 1, 1),
'status': 'CREATING'|'UPDATING'|'DELETING'|'READY'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETE_FAILED',
'kmsKeyArn': 'string'
}
Response Structure
(dict) --
paymentManagerArn (string) --
The Amazon Resource Name (ARN) of the updated payment manager.
paymentManagerId (string) --
The unique identifier of the updated payment manager.
name (string) --
The name of the updated payment manager.
authorizerType (string) --
The type of authorizer for the updated payment manager.
roleArn (string) --
The Amazon Resource Name (ARN) of the IAM role associated with the updated payment manager.
workloadIdentityDetails (dict) --
The information about the workload identity.
workloadIdentityArn (string) --
The ARN associated with the workload identity.
lastUpdatedAt (datetime) --
The timestamp when the payment manager was last updated.
status (string) --
The current status of the updated payment manager. Possible values include CREATING, READY, UPDATING, DELETING, CREATE_FAILED, UPDATE_FAILED, and DELETE_FAILED.
kmsKeyArn (string) --
The Amazon Resource Name (ARN) of the KMS key used to encrypt sensitive payment manager data at rest, if configured.
{'authorizerConfiguration': {'optionalValue': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}}
Response {'authorizerConfiguration': {'customJWTAuthorizer': {'certificateConfigurations': [{'s3': {'bucketOwnerAccountId': 'string',
'uri': 'string'},
'secretsManager': {'secretArn': 'string'}}]}}}
Updates an existing registry. This operation uses PATCH semantics, so you only need to specify the fields you want to change.
See also: AWS API Documentation
Request Syntax
client.update_registry(
registryId='string',
name='string',
description={
'optionalValue': 'string'
},
authorizerConfiguration={
'optionalValue': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
}
},
approvalConfiguration={
'optionalValue': {
'autoApproval': True|False
}
}
)
string
[REQUIRED]
The identifier of the registry to update. You can specify either the Amazon Resource Name (ARN) or the ID of the registry.
string
The updated name of the registry.
dict
The updated description of the registry. To clear the description, include the UpdatedDescription wrapper with optionalValue not specified.
optionalValue (string) --
Represents an optional value that is used to update the human-readable description of the resource. If not specified, it will clear the current description of the resource.
dict
The updated authorizer configuration for the registry. Changing the authorizer configuration can break existing consumers of the registry who are using the authorization type prior to the update.
optionalValue (dict) --
The updated authorizer configuration value. If not specified, it will clear the current authorizer configuration of the resource.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) -- [REQUIRED]
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) -- [REQUIRED]
The name of the custom claim field to check.
inboundTokenClaimValueType (string) -- [REQUIRED]
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) -- [REQUIRED]
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) -- [REQUIRED]
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) -- [REQUIRED]
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) -- [REQUIRED]
The domain to override with a private endpoint.
privateEndpoint (dict) -- [REQUIRED]
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) -- [REQUIRED]
The ID of the VPC that contains your private resource.
subnetIds (list) -- [REQUIRED]
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) -- [REQUIRED]
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) -- [REQUIRED]
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
dict
The updated approval configuration for registry records. The updated configuration only affects new records that move to PENDING_APPROVAL status after the change. Existing records already in PENDING_APPROVAL status are not affected.
optionalValue (dict) --
The updated approval configuration value. Set to null to unset the approval configuration.
autoApproval (boolean) --
Whether registry records are auto-approved. When set to true, records are automatically approved upon creation. When set to false (the default), records require explicit approval for security purposes.
dict
Response Syntax
{
'name': 'string',
'description': 'string',
'registryId': 'string',
'registryArn': 'string',
'authorizerType': 'CUSTOM_JWT'|'AWS_IAM',
'authorizerConfiguration': {
'customJWTAuthorizer': {
'discoveryUrl': 'string',
'allowedAudience': [
'string',
],
'allowedClients': [
'string',
],
'allowedScopes': [
'string',
],
'advertisedScopeMapping': {
'string': 'string'
},
'customClaims': [
{
'inboundTokenClaimName': 'string',
'inboundTokenClaimValueType': 'STRING'|'STRING_ARRAY',
'authorizingClaimMatchValue': {
'claimMatchValue': {
'matchValueString': 'string',
'matchValueStringList': [
'string',
]
},
'claimMatchOperator': 'EQUALS'|'CONTAINS'|'CONTAINS_ANY'
}
},
],
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
},
'privateEndpointOverrides': [
{
'domain': 'string',
'privateEndpoint': {
'selfManagedLatticeResource': {
'resourceConfigurationIdentifier': 'string'
},
'managedVpcResource': {
'vpcIdentifier': 'string',
'subnetIds': [
'string',
],
'endpointIpAddressType': 'IPV4'|'IPV6',
'securityGroupIds': [
'string',
],
'tags': {
'string': 'string'
},
'routingDomain': 'string'
}
}
},
],
'certificateConfigurations': [
{
's3': {
'uri': 'string',
'bucketOwnerAccountId': 'string'
},
'secretsManager': {
'secretArn': 'string'
}
},
],
'allowedWorkloadConfiguration': {
'hostingEnvironments': [
{
'arn': 'string'
},
],
'workloadIdentities': [
'string',
]
}
}
},
'approvalConfiguration': {
'autoApproval': True|False
},
'status': 'CREATING'|'READY'|'UPDATING'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETING'|'DELETE_FAILED',
'statusReason': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
name (string) --
The name of the updated registry.
description (string) --
The description of the updated registry.
registryId (string) --
The unique identifier of the updated registry.
registryArn (string) --
The Amazon Resource Name (ARN) of the updated registry.
authorizerType (string) --
The type of authorizer used by the updated registry. This controls the authorization method for the Search and Invoke APIs used by consumers.
CUSTOM_JWT - Authorize with a bearer token.
AWS_IAM - Authorize with your Amazon Web Services IAM credentials.
authorizerConfiguration (dict) --
The authorizer configuration for the updated registry. For details, see the AuthorizerConfiguration data type.
customJWTAuthorizer (dict) --
The inbound JWT-based authorization, specifying how incoming requests should be authenticated.
discoveryUrl (string) --
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
allowedAudience (list) --
Represents individual audience values that are validated in the incoming JWT token validation process.
(string) --
allowedClients (list) --
Represents individual client IDs that are validated in the incoming JWT token validation process.
(string) --
allowedScopes (list) --
An array of scopes that are allowed to access the token.
(string) --
advertisedScopeMapping (dict) --
A map that associates each scope in allowedScopes with a corresponding advertised scope value. The advertised scope appears in OAuth protected resource metadata and WWW-Authenticate response headers. Use this parameter when the scope that clients request from your identity provider differs from the scope in the validated token. Each key is a scope from allowedScopes that the service uses for token validation. Each value is the corresponding scope that the service advertises to clients. Scopes without a mapping entry appear unchanged to clients.
(string) --
(string) --
customClaims (list) --
An array of objects that define a custom claim validation name, value, and operation
(dict) --
Defines the name of a custom claim field and rules for finding matches to authenticate its value.
inboundTokenClaimName (string) --
The name of the custom claim field to check.
inboundTokenClaimValueType (string) --
The data type of the claim value to check for.
Use STRING if you want to find an exact match to a string you define.
Use STRING_ARRAY if you want to fnd a match to at least one value in an array you define.
authorizingClaimMatchValue (dict) --
Defines the value or values to match for and the relationship of the match.
claimMatchValue (dict) --
The value or values to match for.
matchValueString (string) --
The string value to match for.
matchValueStringList (list) --
An array of strings to check for a match.
(string) --
claimMatchOperator (string) --
Defines the relationship between the claim field value and the value or values you're matching for.
privateEndpoint (dict) --
The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
privateEndpointOverrides (list) --
The private endpoint overrides for the custom JWT authorizer configuration.
(dict) --
A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.
domain (string) --
The domain to override with a private endpoint.
privateEndpoint (dict) --
The private endpoint configuration for the specified domain.
selfManagedLatticeResource (dict) --
Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration.
resourceConfigurationIdentifier (string) --
The ARN or ID of the VPC Lattice resource configuration.
managedVpcResource (dict) --
Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf.
vpcIdentifier (string) --
The ID of the VPC that contains your private resource.
subnetIds (list) --
The subnet IDs within the VPC where the VPC Lattice resource gateway is placed.
(string) --
endpointIpAddressType (string) --
The IP address type for the resource configuration endpoint.
securityGroupIds (list) --
The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used.
(string) --
tags (dict) --
Tags to apply to the managed VPC Lattice resource gateway.
(string) --
(string) --
routingDomain (string) --
An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain].
certificateConfigurations (list) --
The private certificate authority (CA) configurations for the identity provider. Use this to have AgentCore Identity trust a private CA when establishing TLS connections to identity provider endpoints. You can specify only one certificate authority configuration in this list. Provide the certificate by reference to an Amazon S3 object or an Amazon Web Services Secrets Manager secret. You can use this only together with privateEndpoint.
(dict) --
A reference to a private certificate authority (CA) certificate that AgentCore uses to verify TLS connections to an endpoint, such as a gateway target or an identity provider, that presents a certificate issued by a private CA that is not trusted by default. Specify exactly one certificate source. The configuration is a reference only and never contains the certificate content.
s3 (dict) --
The Amazon S3 location of the PEM-encoded private CA certificate.
uri (string) --
The URI of the Amazon S3 object that contains the PEM-encoded certificate.
bucketOwnerAccountId (string) --
The account ID of the Amazon S3 bucket owner. This ID is used for cross-account access to the bucket.
secretsManager (dict) --
The Amazon Web Services Secrets Manager location of the PEM-encoded private CA certificate.
secretArn (string) --
The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret that contains the PEM-encoded certificate.
allowedWorkloadConfiguration (dict) --
The configuration that restricts which workloads in the request's identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways.
hostingEnvironments (list) --
The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
(dict) --
A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway.
arn (string) --
The Amazon Resource Name (ARN) of the hosting environment.
workloadIdentities (list) --
The list of workload identities that are allowed to invoke the target.
(string) --
approvalConfiguration (dict) --
The approval configuration for the updated registry. For details, see the ApprovalConfiguration data type.
autoApproval (boolean) --
Whether registry records are auto-approved. When set to true, records are automatically approved upon creation. When set to false (the default), records require explicit approval for security purposes.
status (string) --
The current status of the updated registry. Possible values include CREATING, READY, UPDATING, CREATE_FAILED, UPDATE_FAILED, DELETING, and DELETE_FAILED.
statusReason (string) --
The reason for the current status of the updated registry.
createdAt (datetime) --
The timestamp when the registry was created.
updatedAt (datetime) --
The timestamp when the registry was last updated.