# RuntimeAuthorizerConfiguration

Abstract base class for runtime authorizer configurations.

Provides static factory methods to create different authentication types.

- Source: [`aws-bedrockagentcore/lib/runtime/inbound-auth/runtime-authorizer-configuration.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/runtime/inbound-auth/runtime-authorizer-configuration.ts#L25)
- Type last changed: v2.255.0 · 19 May 2026

## Example

```ts
const repository = new ecr.Repository(this, "TestRepository", {
  repositoryName: "test-agent-runtime",
});
const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");

// String claim - validates that the claim exactly equals the specified value
// Uses EQUALS operator automatically
const departmentClaim = agentcore.RuntimeCustomClaim.withStringValue('department', 'engineering');

// String array claim with CONTAINS operator (default)
// Validates that the claim array contains a specific string value
// IMPORTANT: CONTAINS requires exactly one value in the array parameter
const rolesClaim = agentcore.RuntimeCustomClaim.withStringArrayValue('roles', ['admin']);

// String array claim with CONTAINS_ANY operator
// Validates that the claim array contains at least one of the specified values
// Use this when you want to check for multiple possible values
const permissionsClaim = agentcore.RuntimeCustomClaim.withStringArrayValue(
  'permissions',
  ['read', 'write'],
  agentcore.CustomClaimOperator.CONTAINS_ANY
);

// Use custom claims in authorizer configuration
const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
  runtimeName: "myAgent",
  agentRuntimeArtifact: agentRuntimeArtifact,
  authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingJWT(
    "https://example.com/.well-known/openid-configuration",
    ["client1", "client2"],
    ["audience1"],
    ["read", "write"],
    [departmentClaim, rolesClaim, permissionsClaim] // Custom claims
  ),
});
```

## Initializer

```ts
new RuntimeAuthorizerConfiguration()
```

## Methods

- `usingCognito(userPool: IUserPool, userPoolClients: IUserPoolClient[], allowedAudience?: string[], allowedScopes?: string[], customClaims?: RuntimeCustomClaim[]): RuntimeAuthorizerConfiguration // chainable` (static) — Use AWS Cognito User Pool authentication.

  Validates Cognito-issued JWT tokens.

  **Parameters**

  - `userPool` — The Cognito User Pool.
  - `userPoolClients` — The Cognito User Pool App Clients.
  - `allowedAudience` — Optional array of allowed audiences.
  - `allowedScopes` — Optional array of allowed scopes.
  - `customClaims` — Optional array of custom claim validations.

  **Returns:** RuntimeAuthorizerConfiguration for Cognito authentication

- `usingIAM(): RuntimeAuthorizerConfiguration // chainable` (static) — Use IAM authentication (default).

  Requires AWS credentials to sign requests using SigV4.

  **Returns:** RuntimeAuthorizerConfiguration for IAM authentication

- `usingJWT(discoveryUrl: string, allowedClients?: string[], allowedAudience?: string[], allowedScopes?: string[], customClaims?: RuntimeCustomClaim[]): RuntimeAuthorizerConfiguration // chainable` (static) — Use custom JWT authentication.

  Validates JWT tokens against the specified OIDC provider.

  **Parameters**

  - `discoveryUrl` — The OIDC discovery URL (must end with /.well-known/openid-configuration).
  - `allowedClients` — Optional array of allowed client IDs.
  - `allowedAudience` — Optional array of allowed audiences.
  - `allowedScopes` — Optional array of allowed scopes.
  - `customClaims` — Optional array of custom claim validations.

  **Returns:** RuntimeAuthorizerConfiguration for JWT authentication

- `usingOAuth(discoveryUrl: string, clientId: string, allowedAudience?: string[], allowedScopes?: string[], customClaims?: RuntimeCustomClaim[]): RuntimeAuthorizerConfiguration // chainable` (static) — Use OAuth 2.0 authentication. Supports various OAuth providers.

  **Parameters**

  - `discoveryUrl` — The OIDC discovery URL (must end with /.well-known/openid-configuration).
  - `clientId` — OAuth client ID.
  - `allowedAudience` — Optional array of allowed audiences.
  - `allowedScopes` — Optional array of allowed scopes.
  - `customClaims` — Optional array of custom claim validations.

  **Returns:** RuntimeAuthorizerConfiguration for OAuth authentication