Package software.amazon.awscdk.services.bedrock.agentcore.alpha

Class Gateway

java.lang.Object

software.amazon.jsii.JsiiObject

software.constructs.Construct

software.amazon.awscdk.Resource

software.amazon.awscdk.services.bedrock.agentcore.alpha.GatewayBase

software.amazon.awscdk.services.bedrock.agentcore.alpha.Gateway

All Implemented Interfaces:

IGatewayRef, IEnvironmentAware, IResource, IGateway, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable

@Generated(value="jsii-pacmak/1.139.0 (build 26a6b54)",
           date="2026-08-13T16:20:32.892Z")
@Stability(Experimental)
public class Gateway
extends GatewayBase

(experimental) Gateway resource for AWS Bedrock Agent Core.

Serves as an integration point between your agent and external services.

Example:

 // Create a Policy engine
 PolicyEngine policyEngine = PolicyEngine.Builder.create(this, "MyPolicyEngine")
         .policyEngineName("my_policy_engine")
         .description("Policy engine for access control")
         .build();
 Gateway gateway = Gateway.Builder.create(this, "MyGateway")
         .gatewayName("my-gateway")
         .policyEngineConfiguration(GatewayPolicyEngineConfig.builder()
                 .policyEngine(policyEngine)
                 .mode(PolicyEngineMode.ENFORCE)
                 .build())
         .build();
 // Add policy to policy engine
 policyEngine.addPolicy("AllowAllActions", AddPolicyOptions.builder()
         .definition(String.format("%n    permit(%n      principal,%n      action,%n      resource == AgentCore::Gateway::\"%s\"%n    );%n  ", gateway.getGatewayArn()))
         .description("Allow all actions on specific gateway (development)")
         .validationMode(PolicyValidationMode.IGNORE_ALL_FINDINGS)
         .build());
 // you can add multiple policies to the policy engine
 policyEngine.addPolicy("SpecificToolPolicy", AddPolicyOptions.builder()
         .definition(String.format("%n    permit(%n      principal is AgentCore::OAuthUser,%n      action == AgentCore::Action::\"WeatherTool__get_forecast\",%n      resource == AgentCore::Gateway::\"%s\"%n    );%n  ", gateway.getGatewayArn()))
         .description("Allow specific weather tool access")
         .validationMode(PolicyValidationMode.FAIL_ON_ANY_FINDINGS)
         .build());
 

See Also:

• https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_CreateGateway.html

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	Gateway.Builder	(experimental) A fluent builder for Gateway.

Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject

software.amazon.jsii.JsiiObject.InitializationMode

Nested classes/interfaces inherited from interface software.constructs.IConstruct

software.constructs.IConstruct.Jsii$Default

Nested classes/interfaces inherited from interface software.amazon.awscdk.services.bedrock.agentcore.alpha.IGateway

IGateway.Jsii$Default

Nested classes/interfaces inherited from interface software.amazon.awscdk.IResource

IResource.Jsii$Default

Field Summary

Fields

Modifier and Type	Field	Description
static final String	PROPERTY_INJECTION_ID	(experimental) Uniquely identifies this class.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	Gateway(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)
protected	Gateway(software.amazon.jsii.JsiiObjectRef objRef)
	Gateway(software.constructs.Construct scope, String id)
	Gateway(software.constructs.Construct scope, String id, GatewayProps props)

Method Summary

Modifier and Type	Method	Description
GatewayTarget	addApiGatewayTarget(String id, AddApiGatewayTargetOptions props)	(experimental) Add an API Gateway target to this gateway This is a convenience method that creates a GatewayTarget associated with this gateway.
void	addInterceptor(IInterceptor interceptor)	(experimental) Add an interceptor to this gateway.
GatewayTarget	addLambdaTarget(String id, AddLambdaTargetOptions props)	(experimental) Add a Lambda target to this gateway This is a convenience method that creates a GatewayTarget associated with this gateway.
GatewayTarget	addMcpServerTarget(String id, AddMcpServerTargetOptions props)	(experimental) Add an MCP server target to this gateway This is a convenience method that creates a GatewayTarget associated with this gateway.
GatewayTarget	addOpenApiTarget(String id, AddOpenApiTargetOptions props)	(experimental) Add an OpenAPI target to this gateway This is a convenience method that creates a GatewayTarget associated with this gateway.
GatewayTarget	addSmithyTarget(String id, AddSmithyTargetOptions props)	(experimental) Add a Smithy target to this gateway This is a convenience method that creates a GatewayTarget associated with this gateway.
static IGateway	fromGatewayAttributes(software.constructs.Construct scope, String id, GatewayAttributes attrs)	(experimental) Import an existing Gateway using its attributes.
IGatewayAuthorizerConfig	getAuthorizerConfiguration()	(experimental) The authorizer configuration for the gateway.
String	getCreatedAt()	(experimental) Timestamp when the gateway was created.
String	getDescription()	(experimental) The description of the gateway.
GatewayExceptionLevel	getExceptionLevel()	(experimental) The exception level for the gateway.
String	getGatewayArn()	(experimental) The ARN of the gateway.
String	getGatewayId()	(experimental) The unique identifier of the gateway.
String	getGatewayUrl()	(experimental) The URL endpoint for the gateway.
IKey	getKmsKey()	(experimental) The KMS key used for encryption.
String	getName()	(experimental) The name of the gateway.
List<String>	getOauthScopes()	(experimental) The OAuth2 scope strings for client credentials flow.
GatewayPolicyEngineConfig	getPolicyEngineConfiguration()	(experimental) The policy engine configuration associated with this gateway.
IGatewayProtocolConfig	getProtocolConfiguration()	(experimental) The protocol configuration for the gateway.
IUserPoolResourceServer	getResourceServer()	(experimental) The Cognito Resource Server created for the gateway (if using default Cognito authorizer).
IRole	getRole()	(experimental) The IAM role for the gateway.
String	getStatus()	(experimental) The status of the gateway.
List<String>	getStatusReason()	(experimental) The status reasons for the gateway.
Map<String,String>	getTags()	(experimental) Tags applied to the gateway.
String	getTokenEndpointUrl()	(experimental) The OAuth2 token endpoint URL for client credentials flow.
String	getUpdatedAt()	(experimental) Timestamp when the gateway was last updated.
IUserPool	getUserPool()	(experimental) The Cognito User Pool created for the gateway (if using default Cognito authorizer).
IUserPoolClient	getUserPoolClient()	(experimental) The Cognito User Pool Client created for the gateway (if using default Cognito authorizer).
IUserPoolDomain	getUserPoolDomain()	(experimental) The Cognito User Pool Domain created for the gateway (if using default Cognito authorizer).
void	setResourceServer(IUserPoolResourceServer value)	(experimental) The Cognito Resource Server created for the gateway (if using default Cognito authorizer).
void	setUserPool(IUserPool value)	(experimental) The Cognito User Pool created for the gateway (if using default Cognito authorizer).
void	setUserPoolClient(IUserPoolClient value)	(experimental) The Cognito User Pool Client created for the gateway (if using default Cognito authorizer).
void	setUserPoolDomain(IUserPoolDomain value)	(experimental) The Cognito User Pool Domain created for the gateway (if using default Cognito authorizer).

Methods inherited from class software.amazon.awscdk.services.bedrock.agentcore.alpha.GatewayBase

getGatewayRef, grant, grantInvoke, grantManage, grantRead, metric, metric, metricDuration, metricDuration, metricInvocations, metricInvocations, metricLatency, metricLatency, metricSystemErrors, metricSystemErrors, metricTargetExecutionTime, metricTargetExecutionTime, metricTargetType, metricTargetType, metricThrottles, metricThrottles, metricUserErrors, metricUserErrors

Methods inherited from class software.amazon.awscdk.Resource

applyCrossStackReferenceStrength, applyRemovalPolicy, generatePhysicalName, getEnv, getPhysicalName, getResourceArnAttribute, getResourceNameAttribute, getStack, isOwnedResource, isResource, with

Methods inherited from class software.constructs.Construct

getNode, isConstruct, toString

Methods inherited from class software.amazon.jsii.JsiiObject

jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface software.constructs.IConstruct

getNode, with

Methods inherited from interface software.amazon.awscdk.interfaces.IEnvironmentAware

getEnv

Methods inherited from interface software.amazon.awscdk.IResource

applyRemovalPolicy, getStack

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Field Details

PROPERTY_INJECTION_ID

@Stability(Experimental)
public static final String PROPERTY_INJECTION_ID

(experimental) Uniquely identifies this class.

Constructor Details

Gateway

protected Gateway(software.amazon.jsii.JsiiObjectRef objRef)

Gateway

protected Gateway(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

Gateway

@Stability(Experimental)
public Gateway(@NotNull
 software.constructs.Construct scope,
 @NotNull
 String id,
 @Nullable
 GatewayProps props)

Parameters:

scope - This parameter is required.

id - This parameter is required.

props -

Gateway

@Stability(Experimental)
public Gateway(@NotNull
 software.constructs.Construct scope,
 @NotNull
 String id)

Parameters:

scope - This parameter is required.

id - This parameter is required.

Method Details

fromGatewayAttributes

@Stability(Experimental)
@NotNull
public static IGateway fromGatewayAttributes(@NotNull
 software.constructs.Construct scope,
 @NotNull
 String id,
 @NotNull
 GatewayAttributes attrs)

(experimental) Import an existing Gateway using its attributes.

Parameters:

scope - The construct scope. This parameter is required.

id - The construct id. This parameter is required.

attrs - The attributes of the existing Gateway. This parameter is required.

Returns:

An IGateway instance representing the imported gateway

addApiGatewayTarget

@Stability(Experimental)
@NotNull
public GatewayTarget addApiGatewayTarget(@NotNull
 String id,
 @NotNull
 AddApiGatewayTargetOptions props)

(experimental) Add an API Gateway target to this gateway This is a convenience method that creates a GatewayTarget associated with this gateway.

Parameters:

id - The construct id for the target. This parameter is required.

props - Properties for the API Gateway target. This parameter is required.

Returns:

The created GatewayTarget

See Also:

• https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-target-api-gateway.html

addInterceptor

@Stability(Experimental)
public void addInterceptor(@NotNull
 IInterceptor interceptor)

(experimental) Add an interceptor to this gateway.

Interceptors allow you to run custom code at specific points in the gateway request/response flow:

• REQUEST interceptors execute before the gateway calls the target
• RESPONSE interceptors execute after the target responds

A gateway can have at most one REQUEST interceptor and one RESPONSE interceptor.

Parameters:

interceptor - The interceptor to add (use LambdaInterceptor factory methods). This parameter is required.

addLambdaTarget

@Stability(Experimental)
@NotNull
public GatewayTarget addLambdaTarget(@NotNull
 String id,
 @NotNull
 AddLambdaTargetOptions props)

(experimental) Add a Lambda target to this gateway This is a convenience method that creates a GatewayTarget associated with this gateway.

Parameters:

id - The construct id for the target. This parameter is required.

props - Properties for the Lambda target. This parameter is required.

Returns:

The created GatewayTarget

addMcpServerTarget

@Stability(Experimental)
@NotNull
public GatewayTarget addMcpServerTarget(@NotNull
 String id,
 @NotNull
 AddMcpServerTargetOptions props)

(experimental) Add an MCP server target to this gateway This is a convenience method that creates a GatewayTarget associated with this gateway.

Parameters:

id - The construct id for the target. This parameter is required.

props - Properties for the MCP server target. This parameter is required.

Returns:

The created GatewayTarget

See Also:

• https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-target-MCPservers.html

addOpenApiTarget

@Stability(Experimental)
@NotNull
public GatewayTarget addOpenApiTarget(@NotNull
 String id,
 @NotNull
 AddOpenApiTargetOptions props)

(experimental) Add an OpenAPI target to this gateway This is a convenience method that creates a GatewayTarget associated with this gateway.

Parameters:

id - The construct id for the target. This parameter is required.

props - Properties for the OpenAPI target. This parameter is required.

Returns:

The created GatewayTarget

addSmithyTarget

@Stability(Experimental)
@NotNull
public GatewayTarget addSmithyTarget(@NotNull
 String id,
 @NotNull
 AddSmithyTargetOptions props)

(experimental) Add a Smithy target to this gateway This is a convenience method that creates a GatewayTarget associated with this gateway.

Parameters:

id - The construct id for the target. This parameter is required.

props - Properties for the Smithy target. This parameter is required.

Returns:

The created GatewayTarget

getAuthorizerConfiguration

@Stability(Experimental)
@NotNull
public IGatewayAuthorizerConfig getAuthorizerConfiguration()

(experimental) The authorizer configuration for the gateway.

Specified by:

getAuthorizerConfiguration in interface IGateway

Specified by:

getAuthorizerConfiguration in class GatewayBase

getGatewayArn

@Stability(Experimental)
@NotNull
public String getGatewayArn()

(experimental) The ARN of the gateway.

Specified by:

getGatewayArn in interface IGateway

Specified by:

getGatewayArn in class GatewayBase

getGatewayId

@Stability(Experimental)
@NotNull
public String getGatewayId()

(experimental) The unique identifier of the gateway.

Specified by:

getGatewayId in interface IGateway

Specified by:

getGatewayId in class GatewayBase

getName

@Stability(Experimental)
@NotNull
public String getName()

(experimental) The name of the gateway.

Specified by:

getName in interface IGateway

Specified by:

getName in class GatewayBase

getProtocolConfiguration

@Stability(Experimental)
@NotNull
public IGatewayProtocolConfig getProtocolConfiguration()

(experimental) The protocol configuration for the gateway.

Specified by:

getProtocolConfiguration in interface IGateway

Specified by:

getProtocolConfiguration in class GatewayBase

getRole

@Stability(Experimental)
@NotNull
public IRole getRole()

(experimental) The IAM role for the gateway.

Specified by:

getRole in interface IGateway

Specified by:

getRole in class GatewayBase

getCreatedAt

@Stability(Experimental)
@Nullable
public String getCreatedAt()

(experimental) Timestamp when the gateway was created.

Specified by:

getCreatedAt in interface IGateway

Specified by:

getCreatedAt in class GatewayBase

getDescription

@Stability(Experimental)
@Nullable
public String getDescription()

(experimental) The description of the gateway.

Specified by:

getDescription in interface IGateway

Specified by:

getDescription in class GatewayBase

getExceptionLevel

@Stability(Experimental)
@Nullable
public GatewayExceptionLevel getExceptionLevel()

(experimental) The exception level for the gateway.

Specified by:

getExceptionLevel in interface IGateway

Specified by:

getExceptionLevel in class GatewayBase

getGatewayUrl

@Stability(Experimental)
@Nullable
public String getGatewayUrl()

(experimental) The URL endpoint for the gateway.

Specified by:

getGatewayUrl in interface IGateway

Specified by:

getGatewayUrl in class GatewayBase

getKmsKey

@Stability(Experimental)
@Nullable
public IKey getKmsKey()

(experimental) The KMS key used for encryption.

Specified by:

getKmsKey in interface IGateway

Specified by:

getKmsKey in class GatewayBase

getOauthScopes

@Stability(Experimental)
@Nullable
public List<String> getOauthScopes()

(experimental) The OAuth2 scope strings for client credentials flow.

Only available when using the default Cognito authorizer.

getPolicyEngineConfiguration

@Stability(Experimental)
@Nullable
public GatewayPolicyEngineConfig getPolicyEngineConfiguration()

(experimental) The policy engine configuration associated with this gateway.

getStatus

@Stability(Experimental)
@Nullable
public String getStatus()

(experimental) The status of the gateway.

Specified by:

getStatus in interface IGateway

Specified by:

getStatus in class GatewayBase

getStatusReason

@Stability(Experimental)
@Nullable
public List<String> getStatusReason()

(experimental) The status reasons for the gateway.

Specified by:

getStatusReason in interface IGateway

Specified by:

getStatusReason in class GatewayBase

getTags

@Stability(Experimental)
@Nullable
public Map<String,String> getTags()

(experimental) Tags applied to the gateway.

getTokenEndpointUrl

@Stability(Experimental)
@Nullable
public String getTokenEndpointUrl()

(experimental) The OAuth2 token endpoint URL for client credentials flow.

Only available when using the default Cognito authorizer.

getUpdatedAt

@Stability(Experimental)
@Nullable
public String getUpdatedAt()

(experimental) Timestamp when the gateway was last updated.

Specified by:

getUpdatedAt in interface IGateway

Specified by:

getUpdatedAt in class GatewayBase

getResourceServer

@Stability(Experimental)
@Nullable
public IUserPoolResourceServer getResourceServer()

(experimental) The Cognito Resource Server created for the gateway (if using default Cognito authorizer).

setResourceServer

@Stability(Experimental)
public void setResourceServer(@Nullable
 IUserPoolResourceServer value)

(experimental) The Cognito Resource Server created for the gateway (if using default Cognito authorizer).

getUserPool

@Stability(Experimental)
@Nullable
public IUserPool getUserPool()

(experimental) The Cognito User Pool created for the gateway (if using default Cognito authorizer).

setUserPool

@Stability(Experimental)
public void setUserPool(@Nullable
 IUserPool value)

(experimental) The Cognito User Pool created for the gateway (if using default Cognito authorizer).

getUserPoolClient

@Stability(Experimental)
@Nullable
public IUserPoolClient getUserPoolClient()

(experimental) The Cognito User Pool Client created for the gateway (if using default Cognito authorizer).

setUserPoolClient

@Stability(Experimental)
public void setUserPoolClient(@Nullable
 IUserPoolClient value)

(experimental) The Cognito User Pool Client created for the gateway (if using default Cognito authorizer).

getUserPoolDomain

@Stability(Experimental)
@Nullable
public IUserPoolDomain getUserPoolDomain()

(experimental) The Cognito User Pool Domain created for the gateway (if using default Cognito authorizer).

setUserPoolDomain

@Stability(Experimental)
public void setUserPoolDomain(@Nullable
 IUserPoolDomain value)

(experimental) The Cognito User Pool Domain created for the gateway (if using default Cognito authorizer).