API-key credential provider (token vault).
The gateway forwards the caller's IAM credentials to the target.
The gateway invokes the tool using its own execution role (no separate credential).
The gateway passes the inbound JWT through to the target.
OAuth 2.0 credential provider (token vault).
Credential provider type a gateway target uses for outbound authorization to its tool source. These are the values AWS accepts for
AWS::BedrockAgentCore::GatewayTarget CredentialProviderConfiguration.CredentialProviderType(https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-bedrockagentcore-gatewaytarget-credentialproviderconfiguration.html).All values are declared so the configuration surface is stable as support is added; MDAA validation currently accepts only
GATEWAY_IAM_ROLE(the gateway invokes the tool with its own execution role, no separate credential sub-object) and rejects the others as not yet supported.