{
  "typeName" : "AWS::BedrockAgentCore::ApiKeyCredentialProvider",
  "description" : "Resource Type definition for AWS::BedrockAgentCore::ApiKeyCredentialProvider",
  "definitions" : {
    "Tag" : {
      "type" : "object",
      "properties" : {
        "Key" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 128,
          "pattern" : "^[a-zA-Z0-9\\s._:/=+@-]*$"
        },
        "Value" : {
          "type" : "string",
          "minLength" : 0,
          "maxLength" : 256,
          "pattern" : "^[a-zA-Z0-9\\s._:/=+@-]*$"
        }
      },
      "required" : [ "Key", "Value" ],
      "additionalProperties" : false
    },
    "ApiKeySecretArn" : {
      "type" : "object",
      "description" : "Contains information about the API key secret in AWS Secrets Manager",
      "properties" : {
        "SecretArn" : {
          "type" : "string",
          "description" : "The ARN of the secret in AWS Secrets Manager",
          "pattern" : "^arn:(aws|aws-us-gov):secretsmanager:[A-Za-z0-9-]{1,64}:[0-9]{12}:secret:[a-zA-Z0-9-_/+=.@!]+$"
        }
      },
      "required" : [ "SecretArn" ],
      "additionalProperties" : false
    },
    "SecretReference" : {
      "type" : "object",
      "description" : "A reference to a customer-provided secret stored in AWS Secrets Manager",
      "properties" : {
        "SecretId" : {
          "type" : "string",
          "description" : "The ID or ARN of the secret in AWS Secrets Manager",
          "minLength" : 1,
          "maxLength" : 2048
        },
        "JsonKey" : {
          "type" : "string",
          "description" : "The JSON key within the secret that contains the credential value",
          "minLength" : 1,
          "maxLength" : 128
        }
      },
      "required" : [ "SecretId", "JsonKey" ],
      "additionalProperties" : false
    }
  },
  "properties" : {
    "Name" : {
      "type" : "string",
      "description" : "The name of the API key credential provider",
      "minLength" : 1,
      "maxLength" : 128,
      "pattern" : "^[a-zA-Z0-9\\-_]+$"
    },
    "ApiKey" : {
      "type" : "string",
      "description" : "The API key to use for authentication",
      "minLength" : 1,
      "maxLength" : 65536
    },
    "CredentialProviderArn" : {
      "type" : "string",
      "description" : "The Amazon Resource Name (ARN) of the API key credential provider",
      "pattern" : "^arn:(aws|aws-us-gov):bedrock-agentcore:[A-Za-z0-9-]{1,64}:[0-9]{12}:token-vault/[a-zA-Z0-9-.]+/apikeycredentialprovider/[a-zA-Z0-9-]+$"
    },
    "ApiKeySecretConfig" : {
      "$ref" : "#/definitions/SecretReference",
      "description" : "Configuration for a customer-provided secret containing the API key"
    },
    "ApiKeySecretSource" : {
      "type" : "string",
      "description" : "The source of the API key secret. Use MANAGED for service-managed secrets or EXTERNAL for customer-provided secrets.",
      "enum" : [ "MANAGED", "EXTERNAL" ]
    },
    "ApiKeySecretArn" : {
      "$ref" : "#/definitions/ApiKeySecretArn",
      "description" : "The ARN of the API key secret in AWS Secrets Manager"
    },
    "ApiKeySecretJsonKey" : {
      "type" : "string",
      "description" : "The JSON key within the secret that contains the API key value",
      "minLength" : 1,
      "maxLength" : 128
    },
    "CreatedTime" : {
      "type" : "string",
      "format" : "date-time",
      "description" : "The timestamp when the credential provider was created"
    },
    "LastUpdatedTime" : {
      "type" : "string",
      "format" : "date-time",
      "description" : "The timestamp when the credential provider was last updated"
    },
    "Tags" : {
      "type" : "array",
      "description" : "Tags to assign to the API key credential provider",
      "items" : {
        "$ref" : "#/definitions/Tag"
      },
      "maxItems" : 50,
      "insertionOrder" : false
    }
  },
  "additionalProperties" : false,
  "required" : [ "Name" ],
  "readOnlyProperties" : [ "/properties/CredentialProviderArn", "/properties/ApiKeySecretArn", "/properties/ApiKeySecretJsonKey", "/properties/CreatedTime", "/properties/LastUpdatedTime" ],
  "writeOnlyProperties" : [ "/properties/ApiKey", "/properties/ApiKeySecretConfig", "/properties/ApiKeySecretSource" ],
  "createOnlyProperties" : [ "/properties/Name" ],
  "primaryIdentifier" : [ "/properties/CredentialProviderArn" ],
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "tagProperty" : "/properties/Tags",
    "cloudFormationSystemTags" : true,
    "permissions" : [ "bedrock-agentcore:TagResource", "bedrock-agentcore:UntagResource", "bedrock-agentcore:ListTagsForResource" ]
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "bedrock-agentcore:CreateApiKeyCredentialProvider", "bedrock-agentcore:GetApiKeyCredentialProvider", "bedrock-agentcore:CreateTokenVault", "bedrock-agentcore:TagResource", "secretsmanager:CreateSecret", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ]
    },
    "read" : {
      "permissions" : [ "bedrock-agentcore:GetApiKeyCredentialProvider", "bedrock-agentcore:ListTagsForResource" ]
    },
    "update" : {
      "permissions" : [ "bedrock-agentcore:UpdateApiKeyCredentialProvider", "bedrock-agentcore:GetApiKeyCredentialProvider", "bedrock-agentcore:TagResource", "bedrock-agentcore:UntagResource", "bedrock-agentcore:ListTagsForResource", "secretsmanager:PutSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ]
    },
    "delete" : {
      "permissions" : [ "bedrock-agentcore:DeleteApiKeyCredentialProvider", "bedrock-agentcore:GetApiKeyCredentialProvider", "secretsmanager:DeleteSecret" ]
    },
    "list" : {
      "permissions" : [ "bedrock-agentcore:ListApiKeyCredentialProviders" ]
    }
  }
}