CustomJwtConfiguration Struct
Custom JWT authorizer configuration.
Example
ts
// Create a custom execution role
const executionRole = new iam.Role(this, "GatewayExecutionRole", {
assumedBy: new iam.ServicePrincipal("bedrock-agentcore.amazonaws.com"),
managedPolicies: [
iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonBedrockAgentCoreGatewayExecutionRolePolicy"),
],
});
// Create gateway with custom execution role
const gateway = new agentcore.Gateway(this, "MyGateway", {
gatewayName: "my-gateway",
description: "Gateway with custom execution role",
protocolConfiguration: new agentcore.McpProtocolConfiguration({
instructions: "Use this gateway to connect to external MCP tools",
searchType: agentcore.McpGatewaySearchType.SEMANTIC,
supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],
}),
authorizerConfiguration: agentcore.GatewayAuthorizer.usingCustomJwt({
discoveryUrl: "https://auth.example.com/.well-known/openid-configuration",
allowedAudience: ["my-app"],
allowedClients: ["my-client-id"],
allowedScopes: ["read", "write"],
}),
role: executionRole,
});
Properties
allowedAudiencestring[]allowed_audiencetyping.List[str]allowedAudienceList<String>AllowedAudiencestring[]AllowedAudience*[]*string= No audience validation#Represents individual audience values that are validated in the incoming JWT token validation process.
allowedClientsstring[]allowed_clientstyping.List[str]allowedClientsList<String>AllowedClientsstring[]AllowedClients*[]*string= No client ID validation#Represents individual client IDs that are validated in the incoming JWT token validation process.
allowedScopesstring[]allowed_scopestyping.List[str]allowedScopesList<String>AllowedScopesstring[]AllowedScopes*[]*string= No scope validation#Represents individual scopes that are validated in the incoming JWT token validation process.
customClaimsGatewayCustomClaim[]custom_claimstyping.List[GatewayCustomClaim]customClaimsList<GatewayCustomClaim>CustomClaimsGatewayCustomClaim[]CustomClaims*[]GatewayCustomClaim= No custom claim validation#Custom claims for additional JWT token validation.
Allows you to validate additional fields in JWT tokens beyond the standard audience, client, and scope validations.
This URL is used to fetch OpenID Connect configuration or authorization server metadata for validating incoming tokens.
Pattern: .+/.well-known/openid-configuration Required: Yes