Resource Type definition for AWS::BedrockAgentCore::ApiKeyCredentialProvider.

CfnApiKeyCredentialProvider

The name of the API key credential provider.

name

apiKey

Tags to assign to the API key credential provider.

CfnBrowserCustom

The network configuration for a code interpreter.

This structure defines how the code interpreter connects to the network.

networkConfiguration

browserSigning

description

The Amazon Resource Name (ARN) of the execution role.

executionRoleArn

recordingConfig

Resource definition for AWS::BedrockAgentCore::BrowserProfile.

CfnBrowserProfile

The AgentCore Code Interpreter tool enables agents to securely execute code in isolated sandbox environments.

It offers advanced configuration support and seamless integration with popular frameworks.

For more information about using the custom code interpreter, see [Execute code and analyze data using Amazon Bedrock AgentCore Code Interpreter](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/code-interpreter-tool.html) .

See the *Properties* section below for descriptions of both the required and optional properties.

CfnCodeInterpreterCustom

Resource Type definition for AWS::BedrockAgentCore::Evaluator - Creates a custom evaluator for agent quality assessment using LLM-as-a-Judge configurations.

CfnEvaluator

The configuration that defines how an evaluator assesses agent performance.

evaluatorConfig

The name of the evaluator.

Must be unique within your account.

evaluatorName

level

A list of tags to assign to the evaluator.

Amazon Bedrock AgentCore Gateway provides a unified connectivity layer between agents and the tools and resources they need to interact with.

For more information about creating a gateway, see [Set up an Amazon Bedrock AgentCore gateway](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-building.html) .

See the *Properties* section below for descriptions of both the required and optional properties.

CfnGateway

authorizerType

The protocol type for the gateway target.

protocolType

roleArn

authorizerConfiguration

exceptionLevel

interceptorConfigurations

kmsKeyArn

The configuration for a policy engine associated with a gateway.

A policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with a gateway, the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies.

policyEngineConfiguration

The protocol configuration for the gateway target.

protocolConfiguration

After creating a gateway, you can add targets, which define the tools that your gateway will host.

For more information about adding gateway targets, see [Add targets to an existing gateway](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-building-adding-targets.html) .

See the *Properties* section below for descriptions of both the required and optional properties.

CfnGatewayTarget

The target configuration for the Smithy model target.

targetConfiguration

The OAuth credential provider configuration.

credentialProviderConfigurations

gatewayIdentifier

metadataConfiguration

Memory allows AI agents to maintain both immediate and long-term knowledge, enabling context-aware and personalized interactions.

For more information about using Memory in Amazon Bedrock AgentCore, see [Host agent or tools with Amazon Bedrock AgentCore Memory](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/memory-getting-started.html) .

See the *Properties* section below for descriptions of both the required and optional properties.

CfnMemory

eventExpiryDuration

The memory encryption key Amazon Resource Name (ARN).

encryptionKeyArn

memoryExecutionRoleArn

memoryStrategies

streamDeliveryResources

Resource Type definition for AWS::BedrockAgentCore::OAuth2CredentialProvider.

CfnOAuth2CredentialProvider

The vendor of the OAuth2 credential provider.

credentialProviderVendor

The name of the OAuth2 credential provider.

Input configuration for an OAuth2 provider.

oauth2ProviderConfigInput

Tags to assign to the OAuth2 credential provider.

Resource Type definition for AWS::BedrockAgentCore::OnlineEvaluationConfig - Creates an online evaluation configuration for continuous monitoring of agent performance.

CfnOnlineEvaluationConfig

The configuration that specifies where to read agent traces for online evaluation.

dataSourceConfig

The Amazon Resource Name (ARN) of the IAM role that grants permissions for evaluation.

evaluationExecutionRoleArn

The list of evaluators to apply during online evaluation.

evaluators

The name of the online evaluation configuration.

Must be unique within your account.

onlineEvaluationConfigName

The evaluation rule that defines sampling configuration, filtering criteria, and session detection settings.

rule

The description of the online evaluation configuration.

executionStatus

A list of tags to assign to the online evaluation configuration.

Resource Type definition for AWS::BedrockAgentCore::Policy.

CfnPolicy

The definition structure for policies.

Encapsulates different policy formats.

definition

The customer-assigned immutable name for the policy.

Must be unique within the policy engine.

The identifier of the policy engine which contains this policy.

policyEngineId

A human-readable description of the policy's purpose and functionality.

The validation mode for the policy.

Determines how Cedar analyzer validation results are handled.

validationMode

Resource Type definition for AWS::BedrockAgentCore::PolicyEngine.

CfnPolicyEngine

The customer-assigned immutable name for the policy engine.

A human-readable description of the policy engine's purpose and scope.

The ARN of the KMS key used to encrypt the policy engine data.

A list of tags to assign to the policy engine.

Contains information about an agent runtime. An agent runtime is the execution environment for a Amazon Bedrock Agent.

AgentCore Runtime is a secure, serverless runtime purpose-built for deploying and scaling dynamic AI agents and tools using any open-source framework including LangGraph, CrewAI, and Strands Agents, any protocol, and any model.

For more information about using agent runtime in Amazon Bedrock AgentCore, see [Host agent or tools with Amazon Bedrock AgentCore Runtime](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agents-tools-runtime.html) .

See the *Properties* section below for descriptions of both the required and optional properties.

CfnRuntime

agentRuntimeArtifact

The name of the AgentCore Runtime endpoint.

agentRuntimeName

The Amazon Resource Name (ARN) for for the role.

Represents inbound authorization configuration options used to authenticate incoming requests.

environmentVariables

filesystemConfigurations

Configuration for managing the lifecycle of runtime sessions and resources.

lifecycleConfiguration

The protocol configuration for an agent runtime.

This structure defines how the agent runtime communicates with clients.

requestHeaderConfiguration

AgentCore Runtime is a secure, serverless runtime purpose-built for deploying and scaling dynamic AI agents and tools using any open-source framework including LangGraph, CrewAI, and Strands Agents, any protocol, and any model.

For more information about using agent runtime endpoints in Amazon Bedrock AgentCore, see [AgentCore Runtime versioning and endpoints](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agent-runtime-versioning.html) .

See the *Properties* section below for descriptions of both the required and optional properties.

CfnRuntimeEndpoint

agentRuntimeId

agentRuntimeVersion

Contains information about an agent runtime endpoint.

An agent runtime is the execution environment for a Amazon Bedrock Agent.

The tags for the AgentCore Runtime endpoint.

Creates a workload identity for Amazon Bedrock AgentCore.

A workload identity provides OAuth2-based authentication for resources associated with agent runtimes.

For more information about using workload identities in Amazon Bedrock AgentCore, see [Managing workload identities](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/workload-identity.html) .

See the *Properties* section below for descriptions of both the required and optional properties.

CfnWorkloadIdentity

The name of the workload identity.

The name must be unique within your account.

The list of allowed OAuth2 return URLs for resources associated with this workload identity.

AWS bedrockagentcore

L1 Constructs15