aws-cdk-lib.aws_bedrockagentcore.GatewayIamRoleCredentialProviderProps

GatewayIamRoleCredentialProviderProps Struct

Properties for configuring the IAM role credential provider.

When a target is authenticated via the gateway's execution role, the gateway signs outbound requests with SigV4. These properties let you tell the gateway which AWS service and region to sign for, instead of letting it infer them from the target endpoint.

Source

aws-bedrockagentcore/lib/gateway/outbound-auth/iam-role.ts

Type last changed

v2.262.0 · 22 Jul 2026

Example

agentcore.GatewayCredentialProvider.fromIamRole({
  service: 'bedrock-runtime', // SigV4 signing name (typically the endpoint prefix); see the AWS service authorization reference
  region: 'us-east-1',         // defaults to the gateway's region
});

Properties

region?optionalstringregion?optionalstrregion?optionalStringRegion?optionalstringRegion?optional*string#

The AWS Region used for SigV4 signing of outbound requests. Can be up to 32 characters long.

Default: Gateway's own Region

Pattern: ^[a-zA-Z0-9-]+$

service?optionalstringservice?optionalstrservice?optionalStringService?optionalstringService?optional*string#

The AWS service name used for SigV4 signing of outbound requests.

Default: Gateway infers the service from the target endpoint

Use the SigV4 signing name (typically the endpoint prefix), e.g. bedrock-runtime, s3, execute-api, dynamodb. Can be up to 64 characters long.

Pattern: ^[a-zA-Z0-9._-]+$