CustomJwtConfiguration Struct
Custom JWT authorizer configuration.
Example
ts
// Create a custom execution role
const executionRole = new iam.Role(this, "GatewayExecutionRole", {
assumedBy: new iam.ServicePrincipal("bedrock-agentcore.amazonaws.com"),
managedPolicies: [
iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonBedrockAgentCoreGatewayExecutionRolePolicy"),
],
});
// Create gateway with custom execution role
const gateway = new agentcore.Gateway(this, "MyGateway", {
gatewayName: "my-gateway",
description: "Gateway with custom execution role",
protocolConfiguration: new agentcore.McpProtocolConfiguration({
instructions: "Use this gateway to connect to external MCP tools",
searchType: agentcore.McpGatewaySearchType.SEMANTIC,
supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],
}),
authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({
discoveryUrl: "https://auth.example.com/.well-known/openid-configuration",
allowedAudience: ["my-app"],
allowedClients: ["my-client-id"],
allowedScopes: ["read", "write"],
}),
role: executionRole,
});
Properties
allowedAudienceoptionalstring[]allowed_audienceoptionaltyping.List[str]allowedAudienceoptionalList<String>AllowedAudienceoptionalstring[]AllowedAudienceoptional*[]*string#Represents individual audience values that are validated in the incoming JWT token validation process.
Default: No audience validation
allowedClientsoptionalstring[]allowed_clientsoptionaltyping.List[str]allowedClientsoptionalList<String>AllowedClientsoptionalstring[]AllowedClientsoptional*[]*string#Represents individual client IDs that are validated in the incoming JWT token validation process.
Default: No client ID validation
allowedScopesoptionalstring[]allowed_scopesoptionaltyping.List[str]allowedScopesoptionalList<String>AllowedScopesoptionalstring[]AllowedScopesoptional*[]*string#Represents individual scopes that are validated in the incoming JWT token validation process.
Default: No scope validation
customClaimsoptionalGatewayCustomClaim[]custom_claimsoptionaltyping.List[GatewayCustomClaim]customClaimsoptionalList<GatewayCustomClaim>CustomClaimsoptionalGatewayCustomClaim[]CustomClaimsoptional*[]GatewayCustomClaim#Custom claims for additional JWT token validation.
Default: No custom claim validation
Allows you to validate additional fields in JWT tokens beyond the standard audience, client, and scope validations.
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
Pattern: .+/.well-known/openid-configuration Required: Yes