ReadonlyinterceptionInterception points at which this interceptor runs.
Use cases: request validation, response transformation
AWS: GatewayInterceptorConfiguration InterceptionPoints
Validation: Required; non-empty subset of ['REQUEST', 'RESPONSE']
Optional ReadonlylambdaARN of an already-deployed interceptor Lambda (alternative to inline lambdaFunction). MDAA
deploys nothing; it wires the gateway to this ARN and grants scoped lambda:InvokeFunction. For
orchestrating modules that own the Lambda in a shared pool.
Use cases: referencing an interceptor Lambda owned by an orchestrating module or defined elsewhere
AWS: LambdaInterceptorConfiguration Arn
Validation: exactly one of lambdaFunction / lambdaArn; when present, a Lambda function ARN
Optional ReadonlylambdaInline definition of the interceptor Lambda. MDAA deploys it (via LambdaFunctionL3Construct,
encrypted with the gateway CMK) and wires the gateway to its ARN; its execution role comes from
roleArn. Provide exactly one of lambdaFunction or lambdaArn.
Use cases: custom interception logic deployed from config
AWS: LambdaInterceptorConfiguration Arn (resolved from the deployed function)
Validation: exactly one of lambdaFunction / lambdaArn; FunctionProps (functionName, srcDir, handler, runtime, roleArn, ...)
Optional ReadonlypassWhether to pass inbound request headers to the interceptor. Defaults to false, since headers may contain sensitive authorization tokens.
Use cases: header-aware interception
AWS: InterceptorInputConfiguration PassRequestHeaders
Validation: Optional; Boolean
Lambda interceptor configuration. Interceptors run custom code during gateway invocations (REQUEST before the target call, RESPONSE after) — the in-scope per-tool authorization mechanism.
Use cases: per-tool/operation/parameter authorization, request/response transformation
AWS: AWS::BedrockAgentCore::Gateway GatewayInterceptorConfiguration
Validation: at most one REQUEST and one RESPONSE interceptor (max 2 total)