MDAA TS Docs
    Preparing search index...

    Interface BuilderGatewayProps

    Configuration for a Bedrock AgentCore Gateway, keyed by gateway name in NamedGatewayProps. The name-less GatewayConfigProps plus a flat targets list of references into the top-level gatewayTargets map. A target's lambdaArn and an interceptor's lambdaArn may use the generated-function:<name> form to reference a function defined once under lambdaFunctions.

    Use cases: exposing a compliant MCP gateway (and its tools) from the same module that owns the agents/knowledge bases/Lambdas it fronts

    AWS: Amazon Bedrock AgentCore Gateway (+ GatewayTargets)

    Validation: each targets entry must name a key in the top-level gatewayTargets map

    interface BuilderGatewayProps {
        authorizerConfiguration?: AgentcoreAuthorizerConfigProperty;
        description?: string;
        exceptionLevel?: DEBUG;
        interceptors?: GatewayInterceptorConfigurationsProperty[];
        logDelivery?: GatewayLogDeliveryProperty;
        protocolConfiguration?: McpProtocolConfigurationProperty;
        role?: MdaaRoleRef;
        targets?: string[];
    }

    Hierarchy (View Summary)

    Index

    Properties

    authorizerConfiguration? description? exceptionLevel? interceptors? logDelivery? protocolConfiguration? role? targets?

    Properties

    authorizerConfiguration?: AgentcoreAuthorizerConfigProperty

    Inbound authorization configuration (shared with the AgentCore Runtime module). Provide customJwt for JWT/OIDC inbound auth, or omit it to use AWS IAM (SigV4). MDAA does not support NONE or AUTHENTICATE_ONLY.

    Use cases: inbound access control

    AWS: AWS::BedrockAgentCore::Gateway AuthorizerType + AuthorizerConfiguration

    Validation: Optional; valid customJwt when present (see AgentcoreAuthorizerConfigProperty)

    description?: string

    Description of the gateway.

    Use cases: documentation, operational clarity

    AWS: AWS::BedrockAgentCore::Gateway Description

    Validation: Optional; String; 1-200 characters (AWS documents no character-set restriction)

    exceptionLevel?: DEBUG

    Exception level. Only DEBUG is settable; omit to leave the secure service default (INFO). DEBUG surfaces more exception detail in responses/logs (possibly sensitive internal error and request context), so use it only for troubleshooting, not in production.

    Use cases: troubleshooting

    AWS: AWS::BedrockAgentCore::Gateway ExceptionLevel

    Validation: Optional; 'DEBUG'

    interceptors?: GatewayInterceptorConfigurationsProperty[]

    Lambda interceptors (at most one REQUEST and one RESPONSE).

    Use cases: per-tool authorization, request/response transformation

    AWS: AWS::BedrockAgentCore::Gateway InterceptorConfigurations

    Validation: Optional; GatewayInterceptorConfigurationsProperty[]; max 2 (one per interception point)

    logDelivery?: GatewayLogDeliveryProperty

    Gateway audit log delivery. Omit for the compliant default (a CMK-encrypted CloudWatch Logs destination log group plus a vended delivery pipeline on the gateway ARN, indefinite retention).

    Use cases: audit logging, retention tuning, opt-out

    AWS: CloudWatch Logs vended delivery (DeliverySource / DeliveryDestination / Delivery)

    Validation: Optional; GatewayLogDeliveryProperty

    protocolConfiguration?: McpProtocolConfigurationProperty

    MCP protocol configuration (instructions, search type, supported versions). MCP is the only protocol the service supports, so protocolType is always MCP (set by the construct). When omitted, the gateway applies the service default (semantic search off). Semantic search is immutable after creation, so enable it here at creation time if needed.

    Use cases: tool discovery semantics, semantic search

    AWS: AWS::BedrockAgentCore::Gateway ProtocolConfiguration.Mcp

    Validation: Optional; McpProtocolConfigurationProperty

    role?: MdaaRoleRef

    Reference to an existing IAM role for the gateway execution role (by name, arn, or id). If omitted, MDAA auto-creates an MdaaRole with a scoped trust policy. Either way MDAA attaches the gateway's required execution permissions (interceptor lambda:InvokeFunction when configured; no CloudWatch Logs permissions, as gateways log via vended delivery) — there is no separate "extra policies" field. To grant more, add it to the referenced role's own definition.

    Use cases: role reuse via a single fully-defined role, or auto-created in place

    AWS: AWS::BedrockAgentCore::Gateway RoleArn

    Validation: Optional; MdaaRoleRef

    targets?: string[]

    Names of gateway targets (keys in the top-level gatewayTargets map) to register against this gateway. Each becomes one AWS::BedrockAgentCore::GatewayTarget.

    Use cases: attaching MCP tool sources to a gateway by reference, keeping the config flat

    AWS: AWS::BedrockAgentCore::GatewayTarget (one per referenced entry)

    Validation: Optional; each entry must be a key in gatewayTargets; a target may be referenced by at most one gateway

    Settings

    Member Visibility

    On This Page

    Properties