GatewayIamRoleCredentialProviderProps

class aws_cdk.aws_bedrockagentcore.GatewayIamRoleCredentialProviderProps(*, region=None, service=None)

Bases: object

Properties for configuring the IAM role credential provider.

When a target is authenticated via the gateway’s execution role, the gateway signs outbound requests with SigV4. These properties let you tell the gateway which AWS service and region to sign for, instead of letting it infer them from the target endpoint.

Parameters:

region (Optional[str]) – The AWS Region used for SigV4 signing of outbound requests. Can be up to 32 characters long. Pattern: ^[a-zA-Z0-9-]+$ Default: - Gateway’s own Region
service (Optional[str]) – The AWS service name used for SigV4 signing of outbound requests. Use the SigV4 signing name (typically the endpoint prefix), e.g. bedrock-runtime, s3, execute-api, dynamodb. Can be up to 64 characters long. Pattern: ^[a-zA-Z0-9._-]+$ Default: - Gateway infers the service from the target endpoint

ExampleMetadata:

fixture=default infused

Example:

agentcore.GatewayCredentialProvider.from_iam_role(
    service="bedrock-runtime",  # SigV4 signing name (typically the endpoint prefix); see the AWS service authorization reference
    region="us-east-1"
)

Attributes

region

The AWS Region used for SigV4 signing of outbound requests. Can be up to 32 characters long.

Pattern: ^[a-zA-Z0-9-]+$

Default:

Gateway’s own Region

service

The AWS service name used for SigV4 signing of outbound requests.

Use the SigV4 signing name (typically the endpoint prefix), e.g. bedrock-runtime, s3, execute-api, dynamodb. Can be up to 64 characters long.

Pattern: ^[a-zA-Z0-9._-]+$

Default:

Gateway infers the service from the target endpoint

See:

https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html