# GatewayIamRoleCredentialProviderProps

Properties for configuring the IAM role credential provider.

When a target is authenticated via the gateway's execution role, the gateway signs
outbound requests with SigV4. These properties let you tell the gateway which AWS
service and region to sign for, instead of letting it infer them from the target
endpoint.

- Source: [`aws-bedrockagentcore/lib/gateway/outbound-auth/iam-role.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/gateway/outbound-auth/iam-role.ts#L22)
- Type last changed: v2.262.0 · 22 Jul 2026

## Example

```ts
agentcore.GatewayCredentialProvider.fromIamRole({
  service: 'bedrock-runtime', // SigV4 signing name (typically the endpoint prefix); see the AWS service authorization reference
  region: 'us-east-1',         // defaults to the gateway's region
});
```

## Properties

- `region`: string — The AWS Region used for SigV4 signing of outbound requests. Can be up to 32 characters long.

  **Default:** Gateway's own Region

  Pattern: ^[a-zA-Z0-9-]+$

- `service`: string — The AWS service name used for SigV4 signing of outbound requests.

  **Default:** Gateway infers the service from the target endpoint

  Use the SigV4 signing name (typically the endpoint prefix), e.g.
  `bedrock-runtime`, `s3`, `execute-api`, `dynamodb`.
  Can be up to 64 characters long.

  Pattern: ^[a-zA-Z0-9._-]+$