Optional ReadonlybucketExpected owner account id of the S3 bucket (cross-account confused-deputy protection). MDAA defaults this to the deploying account when omitted (or empty), so the gateway verifies the bucket owner on the cross-account read. An explicit value is validated at synth: it must be a 12-digit account id (or an unresolved CDK token).
AWS: S3Configuration BucketOwnerAccountId
Validation: Optional; 12-digit account id; defaults to the deploying account
ReadonlyuriS3 URI of the schema object (s3://bucket/key).
AWS: S3Configuration Uri
Validation: Required; S3 URI
S3 location of a schema document (a Lambda tool schema, or an OpenAPI / Smithy API schema).
AWS: AWS::BedrockAgentCore::GatewayTarget S3Configuration