# Amazon Bedrock AgentCore Construct Library

> Version 2.275.0-alpha.0

> **Separate package**
>
> `@aws-cdk/aws-bedrock-agentcore-alpha` is not part of `aws-cdk-lib` — install it separately:
>
> ```sh
> npm install @aws-cdk/aws-bedrock-agentcore-alpha
> pip install aws-cdk.aws-bedrock-agentcore-alpha
> ```
>
> This module is [**experimental**](/stability) (alpha): its API may change in any release, without a major version bump.
---

![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)

> The APIs of higher level constructs in this module are experimental and under active development.
> They are subject to non-backward compatible changes or removal in any future version. These are
> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be
> announced in the release notes. This means that while you may use them, you may need to update
> your source code when upgrading to a newer version of this package.

---

> The **Policy** submodule is the only submodule that remains in alpha. All other constructs have graduated to stable in `aws-cdk-lib/aws-bedrockagentcore` and we recommend migrating to the stable versions.

| **Language**                                                                                   | **Package**                             |
| :--------------------------------------------------------------------------------------------- | --------------------------------------- |
| ![Typescript Logo](https://docs.aws.amazon.com/cdk/api/latest/img/typescript32.png) TypeScript | `@aws-cdk/aws-bedrock-agentcore-alpha` |

## Migration to Stable

All constructs except Policy have moved to `aws-cdk-lib/aws-bedrockagentcore`:

```ts
// Before
import * as agentcore from '@aws-cdk/aws-bedrock-agentcore-alpha';
```

```ts
// After (for all non-Policy constructs)
import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';
```

The following constructs are now in stable:

- **Runtime**: [`Runtime`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.Runtime), [`RuntimeEndpoint`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.RuntimeEndpoint), [`AgentRuntimeArtifact`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AgentRuntimeArtifact), [`NetworkConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.NetworkConfiguration), `Observability`
- **Gateway**: [`Gateway`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.Gateway), [`GatewayTarget`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayTarget), [`GatewayAuthorizer`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayAuthorizer), [`GatewayCredentialProvider`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayCredentialProvider), `Interceptor`
- **Tools**: [`BrowserCustom`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.BrowserCustom), [`CodeInterpreterCustom`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CodeInterpreterCustom)
- **Memory**: [`Memory`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.Memory), [`MemoryStrategy`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.MemoryStrategy)
- **Evaluation**: [`OnlineEvaluationConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OnlineEvaluationConfig), [`Evaluator`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.Evaluator), `EvaluatorSelector`
- **Identity**: [`OAuth2CredentialProvider`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OAuth2CredentialProvider), [`ApiKeyCredentialProvider`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiKeyCredentialProvider), [`WorkloadIdentity`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.WorkloadIdentity)

## What Remains in Alpha

The Policy submodule remains experimental:

- [`PolicyEngine`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyEngine)
- [`Policy`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.Policy)
- [`PolicyStatement`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyStatement)
- [`PolicyValidationMode`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyValidationMode)
- [`PolicyEngineMode`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyEngineMode)

## Policy Engine

A policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with a gateway, the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies.

For more information, see the [Policy in Amazon Bedrock AgentCore documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.html).

### PolicyEngine Properties

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `policyEngineName` | `string` | No | The name of the policy engine. Valid characters: a-z, A-Z, 0-9, _ (underscore). Must start with a letter, 1-48 characters. If not provided, a unique name will be auto-generated |
| `description` | `string` | No | Optional description for the policy engine (max 4,096 characters). Default: no description |
| `kmsKey` | `IKey` | No | Custom KMS key for encryption. **IMPORTANT**: Once set, cannot be changed (requires replacement). Must be symmetric ENCRYPT_DECRYPT key. If key becomes inaccessible, all authorization decisions will be DENIED. Default: AWS owned key |
| `tags` | `{ [key: string]: string }` | No | Tags for the policy engine (max 50 tags). Default: no tags |

### Understanding Cedar Policies in AgentCore

Policies are constructed using [Cedar language](https://www.cedarpolicy.com/en/tutorial), an open source language for writing and enforcing authorization policies.
Cedar policies in AgentCore follow a specific structure with three main components: **Principal**, **Action**, and **Resource**. Understanding how these components work together is critical for writing effective policies.

#### Policy Structure

Every Cedar policy has this basic structure:

```cedar
permit(              // or forbid
  principal,         // Who is making the request
  action,            // What operation they want to perform
  resource           // What Gateway/tool they want to access
)
when {               // Optional conditions
  // Additional constraints
};
```

Example Policy

```cedar
permit(
  principal,
  action == AgentCore::Action::"ApplicationToolTarget___create_application",
  resource == AgentCore::Gateway::"<gateway-arn>"
) when {
  context.input.coverage_amount <= 1000000
};
```

### Basic PolicyEngine and Policy Creation

Create a policy engine and add policies to it.

#### Policy Engine Mode

When associating a policy engine with a gateway, you can control the enforcement behavior using [`PolicyEngineMode`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyEngineMode):

- `PolicyEngineMode.LOG_ONLY` (default) — evaluates actions and adds traces but does not enforce decisions. Use this mode for testing and validation before enabling enforcement.
- `PolicyEngineMode.ENFORCE` — actively allows or denies agent operations based on Cedar policy evaluation.

```ts

// Create a Policy engine
const policyEngine = new agentcore.PolicyEngine(this, "MyPolicyEngine", {
  policyEngineName: "my_policy_engine",
  description: "Policy engine for access control",
});

const gateway = new agentcore.Gateway(this, "MyGateway", {
  gatewayName: "my-gateway",
  policyEngineConfiguration: {
    policyEngine: policyEngine,
    mode: agentcore.PolicyEngineMode.ENFORCE, // Default is LOG_ONLY
  },
});

// Add policy to policy engine
policyEngine.addPolicy("AllowAllActions", {
  definition: `
    permit(
      principal,
      action,
      resource == AgentCore::Gateway::"${gateway.gatewayArn}"
    );
  `,
  description: "Allow all actions on specific gateway (development)",
  validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS, // This will ignore all cedar warnings
});

// you can add multiple policies to the policy engine
policyEngine.addPolicy("SpecificToolPolicy", {
  definition: `
    permit(
      principal is AgentCore::OAuthUser,
      action == AgentCore::Action::"WeatherTool__get_forecast",
      resource == AgentCore::Gateway::"${gateway.gatewayArn}"
    );
  `,
  description: "Allow specific weather tool access",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS, // This will fail policy creation for any cedar warning
});
```

### Type-Safe Policy Builder

For a more type-safe approach, use the [`PolicyStatement`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyStatement) builder instead of writing raw Cedar syntax.

```ts
const gateway = new agentcore.Gateway(this, "MyGateway", {
  gatewayName: "my-gateway",
});

const policyEngine = new agentcore.PolicyEngine(this, "MyPolicyEngine", {
  policyEngineName: "my_policy_engine",
});

const allowAllPolicy = new agentcore.Policy(this, "AllowAllPolicy", {
  policyEngine: policyEngine,
  policyName: "allow_all",
  statement: agentcore.PolicyStatement.permit()
    .forAllPrincipals() // ** This will give overly permission to all principals
    .onAllActions()
    .onResource('AgentCore::Gateway', gateway.gatewayArn),
  description: "Allow all actions on specific gateway (development only)",
  validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal,
//   action,
//   resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:region:account:gateway/gateway-id"
// );
```

#### Policy with Specific Actions

```ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow specific tool actions on specific gateway
// Action names follow pattern: "ToolName__operation"
policyEngine.addPolicy("SpecificToolPolicy", {
  statement: agentcore.PolicyStatement.permit()
    .forPrincipal('AgentCore::OAuthUser::your-client-id')
    .onActions([
      'AgentCore::Action::WeatherTool__get_forecast',
      'AgentCore::Action::WeatherTool__get_current',
    ])
    .onResource('AgentCore::Gateway', gateway.gatewayArn),
  description: "Allow specific weather tool operations",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action in [
//     AgentCore::Action::"WeatherTool__get_forecast",
//     AgentCore::Action::"WeatherTool__get_current"
//   ],
//   resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-123"
// );
```

#### Policy with Conditions

Use `when` clauses to add advanced conditions based on principal tags (from OAuth token) or context:

```ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Policy with when conditions using principal tags
const conditionalPolicy = new agentcore.Policy(this, "ConditionalPolicy", {
  policyEngine: policyEngine,
  policyName: "conditional_access",
  statement: agentcore.PolicyStatement.permit()
    .forPrincipal('AgentCore::OAuthUser')  // Type constraint
    .onAllActions()
    .onResource('AgentCore::Gateway', gateway.gatewayArn)  // Specific ARN
    .when()
      .principalAttribute('department').equalTo('Engineering')
      .and()
      .contextAttribute('input.priority').equalTo('high')
      .done(),
  description: "Allow engineers for high-priority requests",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action,
//   resource == AgentCore::Gateway::"arn:..."
// )
// when {
//   principal.department == "Engineering" && context.input.priority == "high"
// };
```

#### Policy with Exclusions (unless)

Use `unless` clauses to exclude specific conditions from a policy. The policy applies when the `unless` conditions are NOT met:

```ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow access unless the user is suspended
const policyWithUnless = new agentcore.Policy(this, "UnlessPolicy", {
  policyEngine: policyEngine,
  policyName: "unless_suspended",
  statement: agentcore.PolicyStatement.permit()
    .forPrincipal('AgentCore::OAuthUser')
    .onAllActions()
    .onResource('AgentCore::Gateway', gateway.gatewayArn)
    .unless()
      .principalAttribute('suspended').equalTo(true)
      .done(),
  description: "Allow all actions unless user is suspended",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action,
//   resource == AgentCore::Gateway::"arn:..."
// )
// unless {
//   principal.suspended == true
// };
```

You can combine `when` and `unless` clauses in the same policy:

```ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow engineers unless they are on probation
policyEngine.addPolicy("CombinedConditions", {
  statement: agentcore.PolicyStatement.permit()
    .forPrincipal('AgentCore::OAuthUser')
    .onAllActions()
    .onResource('AgentCore::Gateway', gateway.gatewayArn)
    .when()
      .principalAttribute('department').equalTo('Engineering')
      .done()
    .unless()
      .principalAttribute('status').equalTo('probation')
      .done(),
  description: "Allow engineers unless on probation",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});
```

#### Forbid (Deny) Policy

Use `forbid` to explicitly deny access. Forbid policies override permit policies.

```ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Explicitly deny dangerous tool operations
policyEngine.addPolicy("DenyDangerous", {
  statement: agentcore.PolicyStatement.forbid()
    .forAllPrincipals()
    .onAction('AgentCore::Action::DeleteTool__delete_all')
    .onResource('AgentCore::Gateway', gateway.gatewayArn),
  description: "Forbid delete_all operation for all users",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// forbid(
//   principal,
//   action == AgentCore::Action::"DeleteTool__delete_all",
//   resource == AgentCore::Gateway::"arn:..."
// );
```

#### Raw Cedar for Advanced Cases

For advanced Cedar features not supported by the builder, use raw Cedar strings:

```ts
declare const policyEngine: agentcore.PolicyEngine;

// Option 1: Using definition property
const advancedPolicy = new agentcore.Policy(this, "AdvancedPolicy", {
  policyEngine: policyEngine,
  definition: 'permit(principal, action, resource) when { context.custom > 10 };',
  description: "Advanced policy with custom Cedar logic",
});

// Option 2: Using fromCedar() with statement property
policyEngine.addPolicy("CustomPolicy", {
  statement: agentcore.PolicyStatement.fromCedar(
    'forbid(principal, action, resource) when { resource.confidential == true };'
  ),
  description: "Custom policy from Cedar string",
});
```

**Note**: You must specify **either** `definition` (raw Cedar string) **or** `statement` (PolicyStatement builder), but not both.

#### Accessing Policies on PolicyEngine

You can access the list of policies added to a PolicyEngine using policyEngine.policies.

### PolicyEngine with KMS Encryption

Encrypt policy data with a custom KMS key.

```ts
// Create a custom KMS key
const policyKey = new kms.Key(this, "PolicyEngineKey", {
  enableKeyRotation: true,
  description: "KMS key for policy engine encryption",
});

// Create policy engine with encryption
const policyEngine = new agentcore.PolicyEngine(this, "EncryptedEngine", {
  policyEngineName: "encrypted_engine",
  description: "Policy engine with KMS encryption",
  kmsKey: policyKey,
});
```

### Importing Existing PolicyEngine

Import an existing policy engine from its ARN:

```ts
const importedEngine = agentcore.PolicyEngine.fromPolicyEngineAttributes(
  this,
  "ImportedEngine",
  {
    policyEngineArn: "policy-engine-arn",
    kmsKeyArn: "kms-arn",
  }
);

// Use the imported engine
const policy = new agentcore.Policy(this, "PolicyForImportedEngine", {
  policyEngine: importedEngine,
  definition: "permit(principal, action, resource);",
});
```

### Importing Existing Policy

Import an existing policy from its ARN:

```ts
const importedEngine = agentcore.PolicyEngine.fromPolicyEngineAttributes(
  this,
  "ImportedEngine",
  {
    policyEngineArn: "policy-engine/my-engine-id",
  }
);

const importedPolicy = agentcore.Policy.fromPolicyAttributes(
  this,
  "ImportedPolicy",
  {
    policyArn: "my-policy-arn",
    policyEngine: importedEngine,
  }
);

// Grant permissions to the imported policy
const role = new iam.Role(this, "PolicyRole", {
  assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
});

importedPolicy.grantRead(role);
```

### PolicyEngine IAM Permissions

Grant various levels of access to policy engines:

```ts
const policyEngine = new agentcore.PolicyEngine(this, "MyEngine", {
  policyEngineName: "my_engine",
});

const lambdaRole = new iam.Role(this, "LambdaRole", {
  assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
});

// Grant read permissions
policyEngine.grantRead(lambdaRole);

// Grant evaluation permissions
policyEngine.grantEvaluate(lambdaRole);
```

## Using Policy with Stable Gateway

Since Gateway is now in `aws-cdk-lib/aws-bedrockagentcore` but Policy remains in alpha, use the L1 escape hatch to associate a policy engine with a stable gateway:

> Proper L2 integration will be added in a future update.

```ts
import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';
import * as agentcoreAlpha from '@aws-cdk/aws-bedrock-agentcore-alpha';

// Create policy engine (alpha)
const policyEngine = new agentcoreAlpha.PolicyEngine(this, 'Engine', {
  policyEngineName: 'my_engine',
});

// Create gateway (stable)
const gateway = new agentcore.Gateway(this, 'Gateway', {
  gatewayName: 'my-gateway',
});

// Wire policy engine to gateway via the L1 construct
const cfnGateway = gateway.node.defaultChild as agentcore.CfnGateway;
cfnGateway.policyEngineConfiguration = {
  arn: policyEngine.policyEngineArn,
  mode: agentcoreAlpha.PolicyEngineMode.ENFORCE.value,
};

// Grant evaluate permissions to the gateway role
gateway.role.addToPrincipalPolicy(new iam.PolicyStatement({
  actions: ['bedrock-agentcore:GetPolicyEngine'],
  resources: [policyEngine.policyEngineArn],
}));
gateway.role.addToPrincipalPolicy(new iam.PolicyStatement({
  actions: ['bedrock-agentcore:AuthorizeAction', 'bedrock-agentcore:PartiallyAuthorizeActions'],
  resources: [policyEngine.policyEngineArn, gateway.gatewayArn],
}));
```

## Types

| Name | Kind | Summary |
| --- | --- | --- |
| [`ApiKeyCredentialProvider`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiKeyCredentialProvider) | Construct (L2) | L2 construct for `AWS::BedrockAgentCore::ApiKeyCredentialProvider`. |
| [`BrowserCustom`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.BrowserCustom) | Construct (L2) | Browser resource for AWS Bedrock Agent Core. |
| [`BrowserCustomBase`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.BrowserCustomBase) | Construct (L2) | Abstract base class for a Browser. |
| [`CodeInterpreterCustom`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CodeInterpreterCustom) | Construct (L2) | Custom code interpreter resource for AWS Bedrock Agent Core. |
| [`CodeInterpreterCustomBase`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CodeInterpreterCustomBase) | Construct (L2) | Abstract base class for a Code Interpreter. |
| [`Evaluator`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.Evaluator) | Construct (L2) | A custom evaluator for Amazon Bedrock AgentCore. |
| [`EvaluatorBase`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.EvaluatorBase) | Construct (L2) | Abstract base class for Evaluator. |
| [`Gateway`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.Gateway) | Construct (L2) | Gateway resource for AWS Bedrock Agent Core. |
| [`GatewayBase`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayBase) | Construct (L2) | Base class for Gateway constructs. |
| [`GatewayTarget`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayTarget) | Construct (L2) | Defines tools that your gateway will host. |
| [`GatewayTargetBase`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayTargetBase) | Construct (L2) | Base class for gateway target implementations. |
| [`Memory`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.Memory) | Construct (L2) | Long-term memory store for extracted insights like user preferences, semantic facts and summaries. |
| [`MemoryBase`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.MemoryBase) | Construct (L2) | Abstract base class for a Memory. |
| [`OAuth2CredentialProvider`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OAuth2CredentialProvider) | Construct (L2) | L2 construct for `AWS::BedrockAgentCore::OAuth2CredentialProvider`. |
| [`OnlineEvaluationBase`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OnlineEvaluationBase) | Construct (L2) | Abstract base class for OnlineEvaluationConfig. |
| [`OnlineEvaluationConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OnlineEvaluationConfig) | Construct (L2) | Online evaluation configuration for Amazon Bedrock AgentCore. |
| [`Policy`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.Policy) | Construct (L2) | Individual Cedar policy defining what agents can access. |
| [`PolicyBase`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyBase) | Construct (L2) | Abstract base class for a Policy. |
| [`PolicyEngine`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyEngine) | Construct (L2) | Container that manages Cedar authorization policies associated with gateways. |
| [`PolicyEngineBase`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyEngineBase) | Construct (L2) | Abstract base class for a PolicyEngine. |
| [`Runtime`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.Runtime) | Construct (L2) | Bedrock Agent Core Runtime Enables running containerized agents with specific network configurations, security settings, and runtime artifacts. |
| [`RuntimeBase`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.RuntimeBase) | Construct (L2) | Base class for Agent Runtime. |
| [`RuntimeEndpoint`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.RuntimeEndpoint) | Construct (L2) | Bedrock Agent Core Runtime Endpoint Provides a stable endpoint for invoking agent runtimes with versioning support. |
| [`RuntimeEndpointBase`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.RuntimeEndpointBase) | Construct (L2) | Base class for Runtime Endpoint. |
| [`WorkloadIdentity`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.WorkloadIdentity) | Construct (L2) | L2 construct for `AWS::BedrockAgentCore::WorkloadIdentity`. |
| [`AddApiGatewayTargetOptions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AddApiGatewayTargetOptions) | Struct | Options for adding an API Gateway target to a gateway. |
| [`AddEndpointOptions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AddEndpointOptions) | Struct | Options for adding an endpoint to the runtime. |
| [`AddLambdaTargetOptions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AddLambdaTargetOptions) | Struct | Options for adding a Lambda target to a gateway. |
| [`AddMcpServerTargetOptions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AddMcpServerTargetOptions) | Struct | Options for adding an MCP Server target to a gateway. |
| [`AddOpenApiTargetOptions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AddOpenApiTargetOptions) | Struct | Options for adding an OpenAPI target to a gateway. |
| [`AddPolicyOptions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AddPolicyOptions) | Struct | Options for adding a policy via PolicyEngine.addPolicy(). |
| [`AddSmithyTargetOptions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AddSmithyTargetOptions) | Struct | Options for adding a Smithy target to a gateway. |
| [`AgentCoreRuntime`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AgentCoreRuntime) | Enum | Bedrock AgentCore runtime environment for code execution Allowed values: PYTHON_3_10 \| PYTHON_3_11 \| PYTHON_3_12 \| PYTHON_3_13 \| PYTHON_3_14 \| NODE_22. |
| [`AgentRuntimeArtifact`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AgentRuntimeArtifact) | Class | Abstract base class for agent runtime artifacts. |
| [`AgentRuntimeAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AgentRuntimeAttributes) | Struct | Attributes for importing an existing Agent Runtime. |
| [`ApiGatewayHttpMethod`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiGatewayHttpMethod) | Enum | HTTP methods supported by API Gateway. |
| [`ApiGatewayTargetConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiGatewayTargetConfiguration) | Class | Configuration for API Gateway-based MCP targets. |
| [`ApiGatewayTargetConfigurationProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiGatewayTargetConfigurationProps) | Struct | Properties for creating an API Gateway target configuration. |
| [`ApiGatewayToolConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiGatewayToolConfiguration) | Struct | Configuration for API Gateway tools. |
| [`ApiGatewayToolFilter`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiGatewayToolFilter) | Struct | Configuration for filtering API Gateway tools. |
| [`ApiGatewayToolOverride`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiGatewayToolOverride) | Struct | Configuration for overriding API Gateway tool metadata. |
| [`ApiKeyAdditionalConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiKeyAdditionalConfiguration) | Struct | API Key additional configuration. |
| [`ApiKeyCredentialLocation`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiKeyCredentialLocation) | Class | API Key location within the request. |
| [`ApiKeyCredentialProviderAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiKeyCredentialProviderAttributes) | Struct | Attributes for importing an existing API key credential provider. |
| [`ApiKeyCredentialProviderIdentityPerms`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiKeyCredentialProviderIdentityPerms) | Class | IAM actions for AgentCore API key credential providers (Token Vault). |
| [`ApiKeyCredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiKeyCredentialProviderProps) | Struct | API key credential provider ARNs for gateway outbound auth (Token Vault identity). |
| [`ApiKeyCredentialProviderResourceProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiKeyCredentialProviderResourceProps) | Struct | Properties for a new {@link ApiKeyCredentialProvider} (Token Vault resource). |
| [`ApiSchema`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ApiSchema) | Class | Represents the concept of an API Schema for a Gateway Target. |
| [`AssetApiSchema`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AssetApiSchema) | Class | API Schema from a local asset. |
| [`AssetToolSchema`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AssetToolSchema) | Class | Tool Schema from a local asset. |
| [`AtlassianOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AtlassianOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingAtlassian}. |
| [`AttributeAccessor`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.AttributeAccessor) | Class | Accessor for building type-safe attribute comparisons. |
| [`BrowserCustomAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.BrowserCustomAttributes) | Struct | Attributes for specifying an imported Browser Custom. |
| [`BrowserCustomProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.BrowserCustomProps) | Struct | Properties for creating a Browser resource. |
| [`BrowserNetworkConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.BrowserNetworkConfiguration) | Class | Network configuration for the Browser tool. |
| [`BrowserSigning`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.BrowserSigning) | Enum | Browser signing. |
| [`BuiltinEvaluator`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.BuiltinEvaluator) | Class | Built-in evaluators provided by Amazon Bedrock AgentCore. |
| [`CategoricalRatingOption`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CategoricalRatingOption) | Struct | A categorical rating scale option for custom evaluators. |
| [`CloudWatchLogsDataSourceConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CloudWatchLogsDataSourceConfig) | Struct | Configuration for CloudWatch Logs data source. |
| [`CodeAssetOptions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CodeAssetOptions) | Struct | Options for configuring an S3 code asset from local files for agent runtime artifact. |
| [`CodeBasedOptions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CodeBasedOptions) | Struct | Options for configuring a code-based custom evaluator using a Lambda function. |
| [`CodeInterpreterCustomAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CodeInterpreterCustomAttributes) | Struct | Attributes for specifying an imported Code Interpreter Custom. |
| [`CodeInterpreterCustomProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CodeInterpreterCustomProps) | Struct | Properties for creating a CodeInterpreter resource. |
| [`CodeInterpreterNetworkConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CodeInterpreterNetworkConfiguration) | Class | Network configuration for the Code Interpreter tool. |
| [`CognitoAuthorizerProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CognitoAuthorizerProps) | Struct | Properties for configuring a Cognito authorizer. |
| [`ConditionalAttributeAccessor`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ConditionalAttributeAccessor) | Class | Accessor for building type-safe attribute comparisons within conditional statements. |
| [`ConditionalPolicyStatement`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ConditionalPolicyStatement) | Class | Wrapper class for conditionally building policy statements. |
| [`ConditionBuilder`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ConditionBuilder) | Class | Builder for condition expressions in Cedar policies. |
| [`CredentialProviderType`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CredentialProviderType) | Enum | Credential provider types supported by gateway target. |
| [`CustomClaimOperator`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CustomClaimOperator) | Enum | Custom claim match operator. |
| [`CustomJwtAuthorizer`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CustomJwtAuthorizer) | Class | Custom JWT authorizer configuration implementation. |
| [`CustomJwtConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CustomJwtConfiguration) | Struct | Custom JWT authorizer configuration. |
| [`CustomOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.CustomOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingCustom}. |
| [`DataSourceConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.DataSourceConfig) | Class | Configuration for the data source used in online evaluation. |
| [`DataSourceConfigBindResult`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.DataSourceConfigBindResult) | Struct | The result of binding a DataSourceConfig. |
| [`DropboxOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.DropboxOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingDropbox}. |
| [`EpisodicReflectionConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.EpisodicReflectionConfiguration) | Struct | Configuration for episodic memory reflection. |
| [`EvaluationLevel`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.EvaluationLevel) | Class | The level at which a custom evaluator assesses agent performance. |
| [`EvaluatorAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.EvaluatorAttributes) | Struct | Attributes for importing an existing Evaluator. |
| [`EvaluatorConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.EvaluatorConfig) | Class | Configuration for a custom evaluator. |
| [`EvaluatorInferenceConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.EvaluatorInferenceConfig) | Struct | Inference configuration for a custom LLM-as-a-Judge evaluator. |
| [`EvaluatorProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.EvaluatorProps) | Struct | Properties for creating an Evaluator. |
| [`EvaluatorRatingScale`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.EvaluatorRatingScale) | Class | Represents a rating scale for custom LLM-as-a-Judge evaluators. |
| [`EvaluatorReference`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.EvaluatorReference) | Class | Represents a reference to an evaluator for online evaluation. |
| [`EvaluatorReferenceBindResult`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.EvaluatorReferenceBindResult) | Struct | The result of binding an EvaluatorReference. |
| [`ExecutionStatus`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ExecutionStatus) | Class | The execution status of an online evaluation configuration. |
| [`FacebookOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.FacebookOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingFacebook}. |
| [`FilterConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.FilterConfig) | Struct | Filter configuration for online evaluation. |
| [`FilterOperator`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.FilterOperator) | Class | Filter operators for online evaluation filtering. |
| [`FilterValue`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.FilterValue) | Class | A typed filter value for online evaluation filtering. |
| [`FromApiKeyIdentityOptions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.FromApiKeyIdentityOptions) | Struct | Optional gateway settings when binding an {@link IApiKeyCredentialProvider} to a target. |
| [`FromOauthIdentityOptions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.FromOauthIdentityOptions) | Struct | OAuth scopes (and optional custom parameters) when binding an {@link IOAuth2CredentialProvider} to a gateway target. |
| [`GatewayApiKeyIdentityBinding`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayApiKeyIdentityBinding) | Struct | Provider and secret ARNs for wiring a Token Vault API key identity into a gateway target. |
| [`GatewayAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayAttributes) | Struct | Attributes for importing an existing Gateway. |
| [`GatewayAuthorizer`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayAuthorizer) | Class | Factory class for creating Gateway Authorizers. |
| [`GatewayAuthorizerType`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayAuthorizerType) | Enum | Gateway authorizer type. |
| [`GatewayCredentialProvider`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayCredentialProvider) | Class | Factory class for creating different Gateway Credential Providers. |
| [`GatewayCustomClaim`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayCustomClaim) | Class | Represents a custom claim validation configuration for Gateway JWT authorizers. |
| [`GatewayExceptionLevel`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayExceptionLevel) | Enum | Exception levels for gateway. |
| [`GatewayOAuth2IdentityBinding`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayOAuth2IdentityBinding) | Struct | Provider ARN, secret ARN, and OAuth scopes for wiring a Token Vault OAuth2 identity into a gateway target. |
| [`GatewayPolicyEngineConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayPolicyEngineConfig) | Struct | Configuration for associating a policy engine with a gateway. |
| [`GatewayProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayProps) | Struct | Properties for defining a Gateway. |
| [`GatewayProtocol`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayProtocol) | Class | Factory class for instantiating Gateway Protocols. |
| [`GatewayTargetApiGatewayProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayTargetApiGatewayProps) | Struct | Properties for creating an API Gateway-based Gateway Target. |
| [`GatewayTargetAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayTargetAttributes) | Struct | Attributes for importing an existing Gateway Target. |
| [`GatewayTargetCommonProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayTargetCommonProps) | Struct | Common properties for all Gateway Target types. |
| [`GatewayTargetLambdaProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayTargetLambdaProps) | Struct | Properties for creating a Lambda-based Gateway Target Convenience interface for the most common use case. |
| [`GatewayTargetMcpServerProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayTargetMcpServerProps) | Struct | Properties for creating an MCP Server-based Gateway Target. |
| [`GatewayTargetOpenApiProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayTargetOpenApiProps) | Struct | Properties for creating an OpenAPI-based Gateway Target. |
| [`GatewayTargetProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayTargetProps) | Struct | Properties for creating a Gateway Target resource. |
| [`GatewayTargetProtocolType`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayTargetProtocolType) | Enum | Protocol types supported by gateway targets. |
| [`GatewayTargetSmithyProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GatewayTargetSmithyProps) | Struct | Properties for creating a Smithy-based Gateway Target. |
| [`GithubOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GithubOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingGithub}. |
| [`GoogleOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.GoogleOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingGoogle}. |
| [`HubspotOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.HubspotOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingHubspot}. |
| [`IamAuthorizer`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IamAuthorizer) | Class | AWS IAM authorizer configuration implementation. |
| [`IApiKeyCredentialProvider`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IApiKeyCredentialProvider) | Interface | An API key credential provider registered in AgentCore Token Vault. |
| [`IBedrockAgentRuntime`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IBedrockAgentRuntime) | Interface | Interface for Agent Runtime resources. |
| [`IBrowserCustom`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IBrowserCustom) | Interface | Interface for Browser resources. |
| [`ICodeInterpreterCustom`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ICodeInterpreterCustom) | Interface | Interface for CodeInterpreterCustom resources. |
| [`ICredentialProviderConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ICredentialProviderConfig) | Interface | Abstract interface for gateway credential provider configuration. |
| [`IEvaluator`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IEvaluator) | Interface | Interface for Evaluator resources. |
| [`IGateway`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IGateway) | Interface | Interface for Gateway resources. |
| [`IGatewayAuthorizerConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IGatewayAuthorizerConfig) | Interface | Abstract interface for gateway authorizer configuration. |
| [`IGatewayProtocolConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IGatewayProtocolConfig) | Interface | Abstract interface for gateway protocol configuration. |
| [`IGatewayTarget`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IGatewayTarget) | Interface | Interface for GatewayTarget resources. |
| [`IInterceptor`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IInterceptor) | Interface | Represents an interceptor that can be bound to a Gateway. |
| [`IMcpGatewayTarget`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IMcpGatewayTarget) | Interface | Interface for MCP gateway targets. |
| [`IMemory`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IMemory) | Interface | Interface for Memory resources. |
| [`IMemoryStrategy`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IMemoryStrategy) | Interface | Interface for Memory strategies. |
| [`IncludedOauth2TenantCredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IncludedOauth2TenantCredentialProviderProps) | Struct | Props for `IncludedOauth2ProviderConfig` IdPs whose [outbound documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity-idps.html) requires `issuer`, `authorizationEndpoint`, and/or `tokenEndpoint` (for example Okta, Auth0, Amazon Cognito, OneLogin, PingOne, CyberArk, FusionAuth). |
| [`IncludedOauth2TenantEndpoints`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IncludedOauth2TenantEndpoints) | Struct | Optional tenant OAuth endpoints for IdPs that use CloudFormation `IncludedOauth2ProviderConfig` with issuer and/or endpoints per the IdP’s outbound documentation. |
| [`InlineApiSchema`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.InlineApiSchema) | Class | Class to define an API Schema from an inline string. |
| [`InlineToolSchema`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.InlineToolSchema) | Class | Class to define a Tool Schema from an inline string. |
| [`InterceptionPoint`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.InterceptionPoint) | Enum | The interception point where the interceptor will be invoked. |
| [`InterceptorBindConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.InterceptorBindConfig) | Struct | Configuration returned from binding an interceptor to a Gateway. |
| [`InterceptorOptions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.InterceptorOptions) | Struct | Options for configuring an interceptor. |
| [`InvocationConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.InvocationConfiguration) | Struct | Invocation configuration for self managed memory strategy. |
| [`IOAuth2CredentialProvider`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IOAuth2CredentialProvider) | Interface | An OAuth2 credential provider registered in AgentCore Token Vault. |
| [`IOnlineEvaluationConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IOnlineEvaluationConfig) | Interface | Interface for OnlineEvaluationConfig resources. |
| [`IPolicy`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IPolicy) | Interface | Minimal reference interface for Policy resources. |
| [`IPolicyEngine`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IPolicyEngine) | Interface | Contains all properties and methods for both created and imported policy engines. |
| [`IRuntimeEndpoint`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IRuntimeEndpoint) | Interface | Interface for Runtime Endpoint resources. |
| [`ITargetConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ITargetConfiguration) | Interface | Base interface for target configurations. |
| [`IWorkloadIdentity`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IWorkloadIdentity) | Interface | A workload identity for Amazon Bedrock AgentCore. |
| [`LambdaInterceptor`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.LambdaInterceptor) | Class | A Lambda-based interceptor for Gateway. |
| [`LambdaTargetConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.LambdaTargetConfiguration) | Class | Configuration for Lambda-based MCP targets. |
| [`LifecycleConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.LifecycleConfiguration) | Struct | LifecycleConfiguration lets you manage the lifecycle of runtime sessions and resources in AgentCore Runtime. |
| [`LinkedinOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.LinkedinOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingLinkedin}. |
| [`LlmAsAJudgeOptions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.LlmAsAJudgeOptions) | Struct | Options for configuring an LLM-as-a-Judge custom evaluator. |
| [`LoggingConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.LoggingConfig) | Struct | Configuration for logging with log type and destination. |
| [`LoggingDestination`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.LoggingDestination) | Class | Represents a logging destination for AgentCore Runtime. |
| [`LogType`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.LogType) | Class | Log types for AgentCore Runtime observability. |
| [`ManagedMemoryStrategy`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ManagedMemoryStrategy) | Class | Managed memory strategy that handles both built-in and override configurations. |
| [`ManagedStrategyProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ManagedStrategyProps) | Struct | Configuration parameters for a memory strategy that can override existing built-in default prompts/models. |
| [`McpConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.McpConfiguration) | Struct | MCP protocol configuration The configuration for the Model Context Protocol (MCP). |
| [`McpGatewaySearchType`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.McpGatewaySearchType) | Enum | Search types supported by MCP gateway. |
| [`McpProtocolConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.McpProtocolConfiguration) | Class | MCP (Model Context Protocol) configuration implementation. |
| [`MCPProtocolVersion`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.MCPProtocolVersion) | Enum | MCP protocol versions. |
| [`McpServerTargetConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.McpServerTargetConfiguration) | Class | Configuration for MCP Server-based targets. |
| [`McpTargetConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.McpTargetConfiguration) | Class | Abstract base class for MCP target configurations Provides common functionality for all MCP target types. |
| [`McpTargetType`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.McpTargetType) | Enum | MCP target types. |
| [`MemoryAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.MemoryAttributes) | Struct | Attributes for specifying an imported Memory. |
| [`MemoryProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.MemoryProps) | Struct | Properties for creating a Memory resource. |
| [`MemoryStrategy`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.MemoryStrategy) | Class | Factory class for creating memory strategies If you need long-term memory for context recall across sessions, you can setup memory extraction strategies to extract the relevant memory from the raw events. |
| [`MemoryStrategyCommonProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.MemoryStrategyCommonProps) | Struct | Configuration parameters common for any memory strategy. |
| [`MemoryStrategyType`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.MemoryStrategyType) | Enum | Long-term memory extraction strategy types. |
| [`MetadataConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.MetadataConfiguration) | Struct | Configuration for passing metadata (headers and query parameters) to the API Gateway target. |
| [`MicrosoftOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.MicrosoftOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingMicrosoft}. |
| [`NetworkConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.NetworkConfiguration) | Class | Abstract base class for network configuration. |
| [`NoAuthAuthorizer`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.NoAuthAuthorizer) | Class | No authorization configuration implementation. |
| [`NotionOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.NotionOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingNotion}. |
| [`NumericalRatingOption`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.NumericalRatingOption) | Struct | A numerical rating scale option for custom evaluators. |
| [`OAuth2AuthorizationServerMetadata`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OAuth2AuthorizationServerMetadata) | Struct | Static OAuth2 authorization server metadata for custom credential providers. |
| [`OAuth2ClientCredentials`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OAuth2ClientCredentials) | Struct | OAuth2 client identifier and secret registered with the identity provider (all vendors). |
| [`OAuth2CredentialProviderAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OAuth2CredentialProviderAttributes) | Struct | Attributes for importing an existing OAuth2 credential provider. |
| [`OAuth2CredentialProviderBaseProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OAuth2CredentialProviderBaseProps) | Struct | Shared properties for OAuth2 credential providers created via {@link OAuth2CredentialProvider} factory methods. |
| [`OAuth2CredentialProviderFactoryBaseProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OAuth2CredentialProviderFactoryBaseProps) | Struct | Naming, tags, and client credentials shared by every {@link OAuth2CredentialProvider} factory. |
| [`OAuth2CredentialProviderIdentityPerms`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OAuth2CredentialProviderIdentityPerms) | Class | IAM actions for AgentCore OAuth2 credential providers (Token Vault). |
| [`OAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OAuth2CredentialProviderProps) | Struct | Low-level properties when you need full control (prefer {@link OAuth2CredentialProvider.usingSlack} and other factories). |
| [`OAuth2CredentialProviderVendor`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OAuth2CredentialProviderVendor) | Enum | Built-in OAuth2 vendors supported by `AWS::BedrockAgentCore::OAuth2CredentialProvider`. |
| [`OAuthConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OAuthConfiguration) | Struct | OAuth configuration. |
| [`OnlineEvaluationBaseProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OnlineEvaluationBaseProps) | Struct | Base properties for creating an OnlineEvaluationConfig. |
| [`OnlineEvaluationConfigAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OnlineEvaluationConfigAttributes) | Struct | Attributes for importing an existing OnlineEvaluationConfig. |
| [`OnlineEvaluationConfigProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OnlineEvaluationConfigProps) | Struct | Properties for creating an OnlineEvaluationConfig. |
| [`OpenApiTargetConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OpenApiTargetConfiguration) | Class | Configuration for OpenAPI-based MCP targets. |
| [`OverrideConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.OverrideConfig) | Struct | Configuration for overriding model and prompt template. |
| [`PolicyAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyAttributes) | Struct | Attributes for importing an existing Policy. |
| [`PolicyEngineAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyEngineAttributes) | Struct | Attributes for importing an existing PolicyEngine. |
| [`PolicyEngineMode`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyEngineMode) | Class | The enforcement mode for a policy engine associated with a gateway. |
| [`PolicyEngineProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyEngineProps) | Struct | Properties for creating a PolicyEngine resource. |
| [`PolicyProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyProps) | Struct | Properties for creating a Policy resource. |
| [`PolicyStatement`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyStatement) | Class | Type-safe builder for creating Cedar authorization policy statements. |
| [`PolicyValidationMode`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyValidationMode) | Class | Validation mode for Cedar policy definitions. |
| [`ProtocolType`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ProtocolType) | Enum | Protocol configuration for Agent Runtime. |
| [`RecordingConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.RecordingConfig) | Struct | Recording configuration for browser. |
| [`RedditOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.RedditOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingReddit}. |
| [`RequestHeaderConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.RequestHeaderConfiguration) | Struct | Configuration for HTTP request headers that will be passed through to the runtime. |
| [`RuntimeAuthorizerConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.RuntimeAuthorizerConfiguration) | Class | Abstract base class for runtime authorizer configurations. |
| [`RuntimeCustomClaim`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.RuntimeCustomClaim) | Class | Represents a custom claim validation configuration for Runtime JWT authorizers. |
| [`RuntimeEndpointAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.RuntimeEndpointAttributes) | Struct | Attributes for importing an existing Runtime Endpoint. |
| [`RuntimeEndpointProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.RuntimeEndpointProps) | Struct | Properties for creating a Bedrock Agent Core Runtime Endpoint resource. |
| [`RuntimeNetworkConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.RuntimeNetworkConfiguration) | Class | Network configuration for the Runtime. |
| [`RuntimeProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.RuntimeProps) | Struct | Properties for creating a Bedrock Agent Core Runtime resource. |
| [`S3ApiSchema`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.S3ApiSchema) | Class | Class to define an API Schema from an S3 object. |
| [`S3ToolSchema`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.S3ToolSchema) | Class | Class to define a Tool Schema from an S3 object. |
| [`SalesforceOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.SalesforceOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingSalesforce}. |
| [`SchemaDefinition`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.SchemaDefinition) | Struct | Schema definition for tool input/output. |
| [`SchemaDefinitionType`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.SchemaDefinitionType) | Enum | Schema definition types. |
| [`SelfManagedMemoryStrategy`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.SelfManagedMemoryStrategy) | Class | Use AgentCore memory for event storage with custom triggers. |
| [`SelfManagedStrategyProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.SelfManagedStrategyProps) | Struct | Configuration parameters for a self managed memory strategy existing built-in default prompts/models. |
| [`SlackOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.SlackOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingSlack}. |
| [`SmithyTargetConfiguration`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.SmithyTargetConfiguration) | Class | Configuration for Smithy-based MCP targets. |
| [`SpotifyOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.SpotifyOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingSpotify}. |
| [`TargetConfigurationConfig`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.TargetConfigurationConfig) | Struct | Configuration returned by binding a target configuration. |
| [`ToolDefinition`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ToolDefinition) | Struct | Tool definition for inline payload. |
| [`ToolSchema`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ToolSchema) | Class | Defines the schema for tools available to a gateway target. |
| [`TriggerConditions`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.TriggerConditions) | Struct | Trigger conditions for self managed memory strategy When first condition is met, batched payloads are sent to specified S3 bucket. |
| [`TwitchOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.TwitchOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingTwitch}. |
| [`VpcConfigProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.VpcConfigProps) | Struct | VPC configuration properties. |
| [`WorkloadIdentityAttributes`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.WorkloadIdentityAttributes) | Struct | Attributes for importing an existing workload identity. |
| [`WorkloadIdentityPerms`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.WorkloadIdentityPerms) | Class | IAM actions for AgentCore workload identities. |
| [`WorkloadIdentityProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.WorkloadIdentityProps) | Struct | Properties for a new {@link WorkloadIdentity}. |
| [`XOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.XOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingX}. |
| [`YandexOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.YandexOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingYandex}. |
| [`ZoomOAuth2CredentialProviderProps`](/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.ZoomOAuth2CredentialProviderProps) | Struct | Props for {@link OAuth2CredentialProvider.usingZoom}. |