gateways

Creates, updates, deletes, gets or lists a gateways resource.

Overview

Name	gateways
Type	Resource
Id	aws.bedrock_agentcore_control.gateways

Fields

The following fields are returned by SELECT queries:

get_gateway

Name	Datatype	Description
name	string	The name of the gateway. (pattern: <code>([0-9a-zA-Z][-]?){1,48}</code>)
authorizer_configuration	object	Represents inbound authorization configuration options used to authenticate incoming requests.
authorizer_type	string	Authorizer type for the gateway. (CUSTOM_JWT, AWS_IAM, NONE, AUTHENTICATE_ONLY)
created_at	string (date-time)	The timestamp when the gateway was created.
custom_transform_configuration	object	The custom transformation configuration for the gateway. This configuration defines how the gateway transforms requests and responses.
description	string	The description of the gateway.
exception_level	string	The level of detail in error messages returned when invoking the gateway. If the value is DEBUG, granular exception messages are returned to help a user debug the gateway. If the value is omitted, a generic error message is returned to the end user. (DEBUG)
gateway_arn	string	The Amazon Resource Name (ARN) of the gateway. (pattern: <code>arn:aws(|-cn|-us-gov):bedrock-agentcore:[a-z0-9-]{1,20}:[0-9]{12}:gateway/([0-9a-z][-]?){1,48}-[a-z0-9]{10}</code>)
gateway_id	string	The unique identifier of the gateway. (pattern: <code>([0-9a-z][-]?){1,100}-[0-9a-z]{10}</code>)
gateway_url	string	An endpoint for invoking gateway.
interceptor_configurations	array	The interceptors configured on the gateway.
kms_key_arn	string	The Amazon Resource Name (ARN) of the KMS key used to encrypt the gateway. (pattern: <code>arn:aws(|-cn|-us-gov):kms:[a-zA-Z0-9-]*:[0-9]{12}:key/[a-zA-Z0-9-]{36}</code>)
policy_engine_configuration	object	The configuration for a policy engine associated with a gateway. A policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with a gateway, the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies.
protocol_configuration	object	The configuration for a gateway protocol. This structure defines how the gateway communicates with external services.
protocol_type	string	Protocol applied to a gateway. (MCP)
role_arn	string	The IAM role ARN that provides permissions for the gateway. (pattern: <code>arn:aws(-[^:]+)?:iam::([0-9]{12})?:role/.+</code>)
status	string	The current status of the gateway. (CREATING, UPDATING, UPDATE_UNSUCCESSFUL, DELETING, READY, FAILED)
status_reasons	array	The reasons for the current status of the gateway.
updated_at	string (date-time)	The timestamp when the gateway was last updated.
waf_configuration	object	The Amazon Web Services WAF configuration for the gateway.
web_acl_arn	string	The Amazon Resource Name (ARN) of the Amazon Web Services WAF web ACL associated with the gateway. (pattern: <code>arn:[a-z0-9-]+:wafv2:[a-z0-9-]+:[0-9]{12}:regional/webacl/.+</code>)
workload_identity_details	object	The information about the workload identity.

list_gateways

Name	Datatype	Description
name	string	The name of the gateway. (pattern: <code>([0-9a-zA-Z][-]?){1,48}</code>)
authorizer_type	string	The type of authorizer used by the gateway. (CUSTOM_JWT, AWS_IAM, NONE, AUTHENTICATE_ONLY)
created_at	string (date-time)	The timestamp when the gateway was created.
description	string	The description of the gateway.
gateway_id	string	The unique identifier of the gateway. (pattern: <code>([0-9a-z][-]?){1,100}-[0-9a-z]{10}</code>)
protocol_type	string	The protocol type used by the gateway. (MCP)
status	string	The current status of the gateway. (CREATING, UPDATING, UPDATE_UNSUCCESSFUL, DELETING, READY, FAILED)
updated_at	string (date-time)	The timestamp when the gateway was last updated.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_gateway	select	gateway_identifier, region		Retrieves information about a specific Gateway.
list_gateways	select	region	maxResults, nextToken	Lists all gateways in the account.
create_gateway	insert	region, name, roleArn, authorizerType		Creates a gateway for Amazon Bedrock Agent. A gateway serves as an integration point between your agent and external services. If you specify CUSTOM_JWT as the authorizerType, you must provide an authorizerConfiguration.
update_gateway	update	gateway_identifier, region, name, roleArn, authorizerType		Updates an existing gateway.
delete_gateway	delete	gateway_identifier, region		Deletes a gateway.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
gateway_identifier	string	The identifier of the gateway to delete.
region	string	AWS region (default: us-east-1)
maxResults	integer	The maximum number of results to return in the response. If the total number of results is greater than this value, use the token returned in the response in the nextToken field when making another request to return the next batch of results.
nextToken	string	If the total number of results is greater than the maxResults value provided in the request, enter the token returned in the nextToken field in the response in this field to return the next batch of results.

SELECT examples

get_gateway

Retrieves information about a specific Gateway.

SELECT
name,
authorizer_configuration,
authorizer_type,
created_at,
custom_transform_configuration,
description,
exception_level,
gateway_arn,
gateway_id,
gateway_url,
interceptor_configurations,
kms_key_arn,
policy_engine_configuration,
protocol_configuration,
protocol_type,
role_arn,
status,
status_reasons,
updated_at,
waf_configuration,
web_acl_arn,
workload_identity_details
FROM aws.bedrock_agentcore_control.gateways
WHERE gateway_identifier = '{{ gateway_identifier }}' -- required
AND region = '{{ region }}' -- required
;

list_gateways

Lists all gateways in the account.

SELECT
name,
authorizer_type,
created_at,
description,
gateway_id,
protocol_type,
status,
updated_at
FROM aws.bedrock_agentcore_control.gateways
WHERE region = '{{ region }}' -- required
AND maxResults = '{{ maxResults }}'
AND nextToken = '{{ nextToken }}'
;

INSERT examples

create_gateway

Creates a gateway for Amazon Bedrock Agent. A gateway serves as an integration point between your agent and external services. If you specify CUSTOM_JWT as the authorizerType, you must provide an authorizerConfiguration.

INSERT INTO aws.bedrock_agentcore_control.gateways (
name,
description,
clientToken,
roleArn,
protocolType,
protocolConfiguration,
authorizerType,
authorizerConfiguration,
kmsKeyArn,
interceptorConfigurations,
policyEngineConfiguration,
exceptionLevel,
tags,
region
)
SELECT 
'{{ name }}' /* required */,
'{{ description }}',
'{{ clientToken }}',
'{{ roleArn }}' /* required */,
'{{ protocolType }}',
'{{ protocolConfiguration }}',
'{{ authorizerType }}' /* required */,
'{{ authorizerConfiguration }}',
'{{ kmsKeyArn }}',
'{{ interceptorConfigurations }}',
'{{ policyEngineConfiguration }}',
'{{ exceptionLevel }}',
'{{ tags }}',
'{{ region }}'
RETURNING
name,
authorizer_configuration,
authorizer_type,
created_at,
custom_transform_configuration,
description,
exception_level,
gateway_arn,
gateway_id,
gateway_url,
interceptor_configurations,
kms_key_arn,
policy_engine_configuration,
protocol_configuration,
protocol_type,
role_arn,
status,
status_reasons,
updated_at,
waf_configuration,
web_acl_arn,
workload_identity_details
;

Manifest

# Description fields are for documentation purposes
- name: gateways
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the gateways resource.
  - name: name
    value: "{{ name }}"
  - name: description
    value: "{{ description }}"
  - name: clientToken
    value: "{{ clientToken }}"
  - name: roleArn
    value: "{{ roleArn }}"
  - name: protocolType
    value: "{{ protocolType }}"
    valid_values: ['MCP']
  - name: protocolConfiguration
    description: |
      The configuration for a gateway protocol. This structure defines how the gateway communicates with external services.
    value:
      mcp:
        supportedVersions:
          - "{{ supportedVersions }}"
        instructions: "{{ instructions }}"
        searchType: "{{ searchType }}"
        sessionConfiguration:
          sessionTimeoutInSeconds: {{ sessionTimeoutInSeconds }}
        streamingConfiguration:
          enableResponseStreaming: {{ enableResponseStreaming }}
  - name: authorizerType
    value: "{{ authorizerType }}"
    valid_values: ['CUSTOM_JWT', 'AWS_IAM', 'NONE', 'AUTHENTICATE_ONLY']
  - name: authorizerConfiguration
    description: |
      Represents inbound authorization configuration options used to authenticate incoming requests.
    value:
      customJWTAuthorizer:
        discoveryUrl: "{{ discoveryUrl }}"
        allowedAudience:
          - "{{ allowedAudience }}"
        allowedClients:
          - "{{ allowedClients }}"
        allowedScopes:
          - "{{ allowedScopes }}"
        advertisedScopeMapping: "{{ advertisedScopeMapping }}"
        customClaims:
          - inboundTokenClaimName: "{{ inboundTokenClaimName }}"
            inboundTokenClaimValueType: "{{ inboundTokenClaimValueType }}"
            authorizingClaimMatchValue:
              claimMatchValue:
                matchValueString: "{{ matchValueString }}"
                matchValueStringList: "{{ matchValueStringList }}"
              claimMatchOperator: "{{ claimMatchOperator }}"
        privateEndpoint:
          selfManagedLatticeResource:
            resourceConfigurationIdentifier: "{{ resourceConfigurationIdentifier }}"
          managedVpcResource:
            vpcIdentifier: "{{ vpcIdentifier }}"
            subnetIds:
              - "{{ subnetIds }}"
            endpointIpAddressType: "{{ endpointIpAddressType }}"
            securityGroupIds:
              - "{{ securityGroupIds }}"
            tags: "{{ tags }}"
            routingDomain: "{{ routingDomain }}"
        privateEndpointOverrides:
          - domain: "{{ domain }}"
            privateEndpoint:
              selfManagedLatticeResource:
                resourceConfigurationIdentifier: "{{ resourceConfigurationIdentifier }}"
              managedVpcResource:
                vpcIdentifier: "{{ vpcIdentifier }}"
                subnetIds: "{{ subnetIds }}"
                endpointIpAddressType: "{{ endpointIpAddressType }}"
                securityGroupIds: "{{ securityGroupIds }}"
                tags: "{{ tags }}"
                routingDomain: "{{ routingDomain }}"
        allowedWorkloadConfiguration:
          hostingEnvironments:
            - arn: "{{ arn }}"
          workloadIdentities:
            - "{{ workloadIdentities }}"
  - name: kmsKeyArn
    value: "{{ kmsKeyArn }}"
  - name: interceptorConfigurations
    value:
      - interceptor:
          lambda:
            arn: "{{ arn }}"
        interceptionPoints: "{{ interceptionPoints }}"
        inputConfiguration:
          passRequestHeaders: {{ passRequestHeaders }}
          payloadFilter:
            exclude:
              - field: "{{ field }}"
  - name: policyEngineConfiguration
    description: |
      The configuration for a policy engine associated with a gateway. A policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with a gateway, the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies.
    value:
      arn: "{{ arn }}"
      mode: "{{ mode }}"
  - name: exceptionLevel
    value: "{{ exceptionLevel }}"
    valid_values: ['DEBUG']
  - name: tags
    value: "{{ tags }}"

UPDATE examples

update_gateway

Updates an existing gateway.

UPDATE aws.bedrock_agentcore_control.gateways
SET 
name = '{{ name }}',
description = '{{ description }}',
roleArn = '{{ roleArn }}',
protocolType = '{{ protocolType }}',
protocolConfiguration = '{{ protocolConfiguration }}',
authorizerType = '{{ authorizerType }}',
authorizerConfiguration = '{{ authorizerConfiguration }}',
kmsKeyArn = '{{ kmsKeyArn }}',
customTransformConfiguration = '{{ customTransformConfiguration }}',
interceptorConfigurations = '{{ interceptorConfigurations }}',
policyEngineConfiguration = '{{ policyEngineConfiguration }}',
exceptionLevel = '{{ exceptionLevel }}',
wafConfiguration = '{{ wafConfiguration }}'
WHERE 
gateway_identifier = '{{ gateway_identifier }}' --required
AND region = '{{ region }}' --required
AND name = '{{ name }}' --required
AND roleArn = '{{ roleArn }}' --required
AND authorizerType = '{{ authorizerType }}' --required
RETURNING
name,
authorizer_configuration,
authorizer_type,
created_at,
custom_transform_configuration,
description,
exception_level,
gateway_arn,
gateway_id,
gateway_url,
interceptor_configurations,
kms_key_arn,
policy_engine_configuration,
protocol_configuration,
protocol_type,
role_arn,
status,
status_reasons,
updated_at,
waf_configuration,
web_acl_arn,
workload_identity_details;

DELETE examples

delete_gateway

Deletes a gateway.

DELETE FROM aws.bedrock_agentcore_control.gateways
WHERE gateway_identifier = '{{ gateway_identifier }}' --required
AND region = '{{ region }}' --required
;