RuntimeAuthorizerConfiguration Class
Abstract base class for runtime authorizer configurations.
Provides static factory methods to create different authentication types.
Example
ts
const repository = new ecr.Repository(this, "TestRepository", {
repositoryName: "test-agent-runtime",
});
const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");
// String claim - validates that the claim exactly equals the specified value
// Uses EQUALS operator automatically
const departmentClaim = agentcore.RuntimeCustomClaim.withStringValue('department', 'engineering');
// String array claim with CONTAINS operator (default)
// Validates that the claim array contains a specific string value
// IMPORTANT: CONTAINS requires exactly one value in the array parameter
const rolesClaim = agentcore.RuntimeCustomClaim.withStringArrayValue('roles', ['admin']);
// String array claim with CONTAINS_ANY operator
// Validates that the claim array contains at least one of the specified values
// Use this when you want to check for multiple possible values
const permissionsClaim = agentcore.RuntimeCustomClaim.withStringArrayValue(
'permissions',
['read', 'write'],
agentcore.CustomClaimOperator.CONTAINS_ANY
);
// Use custom claims in authorizer configuration
const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
runtimeName: "myAgent",
agentRuntimeArtifact: agentRuntimeArtifact,
authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingJWT(
"https://example.com/.well-known/openid-configuration",
["client1", "client2"],
["audience1"],
["read", "write"],
[departmentClaim, rolesClaim, permissionsClaim] // Custom claims
),
});
Initializer
ts
new RuntimeAuthorizerConfiguration()
python
RuntimeAuthorizerConfiguration()
java
new RuntimeAuthorizerConfiguration()
csharp
new RuntimeAuthorizerConfiguration()
go
NewRuntimeAuthorizerConfiguration()
Methods
usingCognito(userPool: IUserPool, userPoolClients: IUserPoolClient[], allowedAudience?: string[], allowedScopes?: string[], customClaims?: RuntimeCustomClaim[]): RuntimeAuthorizerConfiguration // chainable@staticmethod def using_cognito(user_pool: IUserPool, user_pool_clients: typing.List[IUserPoolClient], allowed_audience: typing.Optional[typing.List[str]] = None, allowed_scopes: typing.Optional[typing.List[str]] = None, custom_claims: typing.Optional[typing.List[RuntimeCustomClaim]] = None) -> RuntimeAuthorizerConfigurationpublic static RuntimeAuthorizerConfiguration usingCognito(IUserPool userPool, List<IUserPoolClient> userPoolClients, List<String> allowedAudience, List<String> allowedScopes, List<RuntimeCustomClaim> customClaims)public static RuntimeAuthorizerConfiguration UsingCognito(IUserPool userPool, IUserPoolClient[] userPoolClients, string[]? allowedAudience = null, string[]? allowedScopes = null, RuntimeCustomClaim[]? customClaims = null)func UsingCognito(UserPool IUserPool, UserPoolClients *[]IUserPoolClient, AllowedAudience *[]*string, AllowedScopes *[]*string, CustomClaims *[]RuntimeCustomClaim) RuntimeAuthorizerConfigurationstatic#Use AWS Cognito User Pool authentication.
Validates Cognito-issued JWT tokens.
5 parameters · returns
Parameters
userPooluser_pooluserPooluserPoolUserPool— The Cognito User Pool.userPoolClientsuser_pool_clientsuserPoolClientsuserPoolClientsUserPoolClients— The Cognito User Pool App Clients.allowedAudienceallowed_audienceallowedAudienceallowedAudienceAllowedAudience— Optional array of allowed audiences.allowedScopesallowed_scopesallowedScopesallowedScopesAllowedScopes— Optional array of allowed scopes.customClaimscustom_claimscustomClaimscustomClaimsCustomClaims— Optional array of custom claim validations.
Returns: RuntimeAuthorizerConfiguration for Cognito authentication
usingIAM(): RuntimeAuthorizerConfiguration // chainable@staticmethod def using_iam() -> RuntimeAuthorizerConfigurationpublic static RuntimeAuthorizerConfiguration usingIAM()public static RuntimeAuthorizerConfiguration UsingIAM()func UsingIAM() RuntimeAuthorizerConfigurationstatic#Use IAM authentication (default).
Requires AWS credentials to sign requests using SigV4.
returns
Returns: RuntimeAuthorizerConfiguration for IAM authentication
usingJWT(discoveryUrl: string, allowedClients?: string[], allowedAudience?: string[], allowedScopes?: string[], customClaims?: RuntimeCustomClaim[]): RuntimeAuthorizerConfiguration // chainable@staticmethod def using_jwt(discovery_url: str, allowed_clients: typing.Optional[typing.List[str]] = None, allowed_audience: typing.Optional[typing.List[str]] = None, allowed_scopes: typing.Optional[typing.List[str]] = None, custom_claims: typing.Optional[typing.List[RuntimeCustomClaim]] = None) -> RuntimeAuthorizerConfigurationpublic static RuntimeAuthorizerConfiguration usingJWT(String discoveryUrl, List<String> allowedClients, List<String> allowedAudience, List<String> allowedScopes, List<RuntimeCustomClaim> customClaims)public static RuntimeAuthorizerConfiguration UsingJWT(string discoveryUrl, string[]? allowedClients = null, string[]? allowedAudience = null, string[]? allowedScopes = null, RuntimeCustomClaim[]? customClaims = null)func UsingJWT(DiscoveryUrl *string, AllowedClients *[]*string, AllowedAudience *[]*string, AllowedScopes *[]*string, CustomClaims *[]RuntimeCustomClaim) RuntimeAuthorizerConfigurationstatic#Use custom JWT authentication.
Validates JWT tokens against the specified OIDC provider.
5 parameters · returns
Parameters
discoveryUrldiscovery_urldiscoveryUrldiscoveryUrlDiscoveryUrl— The OIDC discovery URL (must end with /.well-known/openid-configuration).allowedClientsallowed_clientsallowedClientsallowedClientsAllowedClients— Optional array of allowed client IDs.allowedAudienceallowed_audienceallowedAudienceallowedAudienceAllowedAudience— Optional array of allowed audiences.allowedScopesallowed_scopesallowedScopesallowedScopesAllowedScopes— Optional array of allowed scopes.customClaimscustom_claimscustomClaimscustomClaimsCustomClaims— Optional array of custom claim validations.
Returns: RuntimeAuthorizerConfiguration for JWT authentication
usingOAuth(discoveryUrl: string, clientId: string, allowedAudience?: string[], allowedScopes?: string[], customClaims?: RuntimeCustomClaim[]): RuntimeAuthorizerConfiguration // chainable@staticmethod def using_o_auth(discovery_url: str, client_id: str, allowed_audience: typing.Optional[typing.List[str]] = None, allowed_scopes: typing.Optional[typing.List[str]] = None, custom_claims: typing.Optional[typing.List[RuntimeCustomClaim]] = None) -> RuntimeAuthorizerConfigurationpublic static RuntimeAuthorizerConfiguration usingOAuth(String discoveryUrl, String clientId, List<String> allowedAudience, List<String> allowedScopes, List<RuntimeCustomClaim> customClaims)public static RuntimeAuthorizerConfiguration UsingOAuth(string discoveryUrl, string clientId, string[]? allowedAudience = null, string[]? allowedScopes = null, RuntimeCustomClaim[]? customClaims = null)func UsingOAuth(DiscoveryUrl *string, ClientId *string, AllowedAudience *[]*string, AllowedScopes *[]*string, CustomClaims *[]RuntimeCustomClaim) RuntimeAuthorizerConfigurationstatic#Use OAuth 2.0 authentication. Supports various OAuth providers.
5 parameters · returns
Parameters
discoveryUrldiscovery_urldiscoveryUrldiscoveryUrlDiscoveryUrl— The OIDC discovery URL (must end with /.well-known/openid-configuration).clientIdclient_idclientIdclientIdClientId— OAuth client ID.allowedAudienceallowed_audienceallowedAudienceallowedAudienceAllowedAudience— Optional array of allowed audiences.allowedScopesallowed_scopesallowedScopesallowedScopesAllowedScopes— Optional array of allowed scopes.customClaimscustom_claimscustomClaimscustomClaimsCustomClaims— Optional array of custom claim validations.
Returns: RuntimeAuthorizerConfiguration for OAuth authentication