# LambdaInterceptor

A Lambda-based interceptor for Gateway.

Interceptors allow you to run custom code during each invocation of your gateway:
- REQUEST interceptors execute before calling the target
- RESPONSE interceptors execute after the target responds

Extends: LambdaInterceptor
Implements: IInterceptor

- Source: [`aws-bedrockagentcore/lib/gateway/interceptor.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/gateway/interceptor.ts#L94)
- Type last changed: v2.255.0 · 19 May 2026

## Example

```ts
// Create Lambda functions for interceptors
const requestInterceptorFn = new lambda.Function(this, "RequestInterceptor", {
  runtime: lambda.Runtime.PYTHON_3_12,
  handler: "index.handler",
  code: lambda.Code.fromInline(`
def handler(event, context):
    # Validate and transform request
    return {
        "interceptorOutputVersion": "1.0",
        "mcp": {
            "transformedGatewayRequest": event["mcp"]["gatewayRequest"]
        }
    }
  `),
});

const responseInterceptorFn = new lambda.Function(this, "ResponseInterceptor", {
  runtime: lambda.Runtime.PYTHON_3_12,
  handler: "index.handler",
  code: lambda.Code.fromInline(`
def handler(event, context):
    # Filter or transform response
    return {
        "interceptorOutputVersion": "1.0",
        "mcp": {
            "transformedGatewayResponse": event["mcp"]["gatewayResponse"]
        }
    }
  `),
});

// Create gateway with interceptors
const gateway = new agentcore.Gateway(this, "MyGateway", {
  gatewayName: "my-gateway",
  interceptorConfigurations: [
    agentcore.LambdaInterceptor.forRequest(requestInterceptorFn, {
      passRequestHeaders: true  // Only if you need to inspect headers
    }),
    agentcore.LambdaInterceptor.forResponse(responseInterceptorFn)
  ]
});
```

## Properties

- `interceptionPoint`: [InterceptionPoint](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.InterceptionPoint.html) — The interception point (REQUEST or RESPONSE).

## Methods

- `bind(_scope: Construct, gateway: IGateway): InterceptorBindConfig` — Binds this Lambda interceptor to a Gateway.

  This method:
  1. Grants the Gateway's IAM role permission to invoke the Lambda function
  2. Returns the CloudFormation configuration for this interceptor

  **Parameters**

  - `_scope` — The construct scope (currently unused, reserved for future extensions).
  - `gateway` — The gateway this interceptor is being bound to.

  **Returns:** Configuration for CloudFormation rendering

- `forRequest(lambdaFunction: IFunction, options?: InterceptorOptions): LambdaInterceptor // chainable` (static) — Create a REQUEST interceptor that executes before the gateway calls the target.

  **Important:** When this interceptor is added to a gateway, the gateway's IAM role
  will automatically be granted `lambda:InvokeFunction` permission on the specified
  Lambda function.

  **Parameters**

  - `lambdaFunction` — The Lambda function to invoke.
  - `options` — Optional configuration for the interceptor.

  **Returns:** A configured LambdaInterceptor for request interception

- `forResponse(lambdaFunction: IFunction, options?: InterceptorOptions): LambdaInterceptor // chainable` (static) — Create a RESPONSE interceptor that executes after the target responds.

  **Important:** When this interceptor is added to a gateway, the gateway's IAM role
  will automatically be granted `lambda:InvokeFunction` permission on the specified
  Lambda function.

  **Parameters**

  - `lambdaFunction` — The Lambda function to invoke.
  - `options` — Optional configuration for the interceptor.

  **Returns:** A configured LambdaInterceptor for response interception