{
  "typeName" : "AWS::BedrockAgentCore::Gateway",
  "description" : "Definition of AWS::BedrockAgentCore::Gateway Resource Type",
  "definitions" : {
    "AuthorizerConfiguration" : {
      "oneOf" : [ {
        "type" : "object",
        "title" : "CustomJWTAuthorizer",
        "properties" : {
          "CustomJWTAuthorizer" : {
            "$ref" : "#/definitions/CustomJWTAuthorizerConfiguration"
          }
        },
        "required" : [ "CustomJWTAuthorizer" ],
        "additionalProperties" : false
      } ]
    },
    "AuthorizerType" : {
      "type" : "string",
      "enum" : [ "CUSTOM_JWT", "AWS_IAM", "NONE", "AUTHENTICATE_ONLY" ]
    },
    "CustomJWTAuthorizerConfiguration" : {
      "type" : "object",
      "properties" : {
        "DiscoveryUrl" : {
          "type" : "string",
          "pattern" : "^.+/\\.well-known/openid-configuration$"
        },
        "AllowedAudience" : {
          "type" : "array",
          "items" : {
            "type" : "string"
          },
          "minItems" : 1
        },
        "AllowedClients" : {
          "type" : "array",
          "items" : {
            "type" : "string"
          },
          "minItems" : 1
        },
        "AllowedScopes" : {
          "type" : "array",
          "items" : {
            "$ref" : "#/definitions/AllowedScope"
          },
          "minItems" : 1
        },
        "CustomClaims" : {
          "type" : "array",
          "items" : {
            "$ref" : "#/definitions/CustomClaimValidationType"
          },
          "minItems" : 1
        }
      },
      "required" : [ "DiscoveryUrl" ],
      "additionalProperties" : false
    },
    "AllowedScope" : {
      "type" : "string",
      "pattern" : "[\\x21\\x23-\\x5B\\x5D-\\x7E]+",
      "description" : "Allowed scope value"
    },
    "CustomClaimValidationType" : {
      "type" : "object",
      "description" : "Required custom claim",
      "properties" : {
        "AuthorizingClaimMatchValue" : {
          "$ref" : "#/definitions/AuthorizingClaimMatchValueType"
        },
        "InboundTokenClaimName" : {
          "$ref" : "#/definitions/InboundTokenClaimName"
        },
        "InboundTokenClaimValueType" : {
          "$ref" : "#/definitions/InboundTokenClaimValueType"
        }
      },
      "required" : [ "AuthorizingClaimMatchValue", "InboundTokenClaimName", "InboundTokenClaimValueType" ],
      "additionalProperties" : false
    },
    "InboundTokenClaimName" : {
      "type" : "string",
      "pattern" : "[A-Za-z0-9_.-:]+",
      "description" : "The name of the custom claim to validate"
    },
    "InboundTokenClaimValueType" : {
      "type" : "string",
      "description" : "Token claim data type",
      "enum" : [ "STRING", "STRING_ARRAY" ]
    },
    "AuthorizingClaimMatchValueType" : {
      "type" : "object",
      "description" : "The value or values in the custom claim to match and relationship of match",
      "properties" : {
        "ClaimMatchOperator" : {
          "$ref" : "#/definitions/ClaimMatchOperator"
        },
        "ClaimMatchValue" : {
          "$ref" : "#/definitions/ClaimMatchValueType"
        }
      },
      "required" : [ "ClaimMatchOperator", "ClaimMatchValue" ],
      "additionalProperties" : false
    },
    "ClaimMatchOperator" : {
      "type" : "string",
      "description" : "The relationship between the claim field value and the value or values being matched",
      "enum" : [ "EQUALS", "CONTAINS", "CONTAINS_ANY" ]
    },
    "ClaimMatchValueType" : {
      "type" : "object",
      "description" : "The value or values in the custom claim to match for",
      "oneOf" : [ {
        "required" : [ "MatchValueString" ]
      }, {
        "required" : [ "MatchValueStringList" ]
      } ],
      "properties" : {
        "MatchValueString" : {
          "$ref" : "#/definitions/MatchValueString"
        },
        "MatchValueStringList" : {
          "$ref" : "#/definitions/MatchValueStringList"
        }
      },
      "additionalProperties" : false
    },
    "MatchValueString" : {
      "type" : "string",
      "pattern" : "[A-Za-z0-9_.-]+",
      "description" : "The string value to match for"
    },
    "MatchValueStringList" : {
      "type" : "array",
      "description" : "The list of strings to check for a match",
      "minItems" : 1,
      "maxItems" : 255,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/MatchValueString"
      }
    },
    "ExceptionLevel" : {
      "type" : "string",
      "enum" : [ "DEBUG" ]
    },
    "GatewayInterceptionPoint" : {
      "type" : "string",
      "enum" : [ "REQUEST", "RESPONSE" ]
    },
    "GatewayInterceptorConfiguration" : {
      "type" : "object",
      "properties" : {
        "Interceptor" : {
          "$ref" : "#/definitions/InterceptorConfiguration"
        },
        "InterceptionPoints" : {
          "type" : "array",
          "items" : {
            "$ref" : "#/definitions/GatewayInterceptionPoint"
          },
          "minItems" : 1,
          "maxItems" : 2
        },
        "InputConfiguration" : {
          "$ref" : "#/definitions/InterceptorInputConfiguration"
        }
      },
      "required" : [ "Interceptor", "InterceptionPoints" ],
      "additionalProperties" : false
    },
    "InterceptorConfiguration" : {
      "oneOf" : [ {
        "type" : "object",
        "title" : "Lambda",
        "properties" : {
          "Lambda" : {
            "$ref" : "#/definitions/LambdaInterceptorConfiguration"
          }
        },
        "required" : [ "Lambda" ],
        "additionalProperties" : false
      } ]
    },
    "InterceptorInputConfiguration" : {
      "type" : "object",
      "properties" : {
        "PassRequestHeaders" : {
          "type" : "boolean"
        }
      },
      "required" : [ "PassRequestHeaders" ],
      "additionalProperties" : false
    },
    "LambdaInterceptorConfiguration" : {
      "type" : "object",
      "properties" : {
        "Arn" : {
          "type" : "string",
          "maxLength" : 170,
          "minLength" : 1,
          "pattern" : "^arn:[a-z0-9-]{1,20}:lambda:([a-z]{2}(-gov)?-[a-z]+-\\d{1}):(\\d{12}):function:([a-zA-Z0-9-_.]+)(:(\\$LATEST|[a-zA-Z0-9-_]+))?$"
        }
      },
      "required" : [ "Arn" ],
      "additionalProperties" : false
    },
    "GatewayPolicyEngineMode" : {
      "type" : "string",
      "description" : "The enforcement mode for the policy engine. LOG_ONLY - The policy engine evaluates each action against your policies and adds traces on whether tool calls would be allowed or denied, but does not enforce the decision. Use this mode to test and validate policies before enabling enforcement. ENFORCE - The policy engine evaluates actions against your policies and enforces decisions by allowing or denying agent operations. Test and validate policies in LOG_ONLY mode before enabling enforcement to avoid unintended denials or adversely affecting production traffic.",
      "enum" : [ "LOG_ONLY", "ENFORCE" ]
    },
    "GatewayPolicyEngineConfiguration" : {
      "type" : "object",
      "description" : "The configuration for a policy engine associated with a gateway. A policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with a gateway, the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies.",
      "properties" : {
        "Arn" : {
          "type" : "string",
          "description" : "The ARN of the policy engine. The policy engine contains Cedar policies that define fine-grained authorization rules specifying who can perform what actions on which resources as agents interact through the gateway.",
          "maxLength" : 170,
          "minLength" : 1,
          "pattern" : "^arn:[a-z0-9-]{1,20}:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:policy-engine/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9_]{10}$"
        },
        "Mode" : {
          "$ref" : "#/definitions/GatewayPolicyEngineMode"
        }
      },
      "required" : [ "Arn", "Mode" ],
      "additionalProperties" : false
    },
    "GatewayProtocolConfiguration" : {
      "oneOf" : [ {
        "type" : "object",
        "title" : "Mcp",
        "properties" : {
          "Mcp" : {
            "$ref" : "#/definitions/MCPGatewayConfiguration"
          }
        },
        "required" : [ "Mcp" ],
        "additionalProperties" : false
      } ]
    },
    "GatewayProtocolType" : {
      "type" : "string",
      "enum" : [ "MCP" ]
    },
    "GatewayStatus" : {
      "type" : "string",
      "enum" : [ "CREATING", "UPDATING", "UPDATE_UNSUCCESSFUL", "DELETING", "READY", "FAILED" ]
    },
    "MCPGatewayConfiguration" : {
      "type" : "object",
      "properties" : {
        "SupportedVersions" : {
          "type" : "array",
          "items" : {
            "type" : "string",
            "default" : "2025-03-26"
          }
        },
        "Instructions" : {
          "type" : "string",
          "maxLength" : 2048,
          "minLength" : 1
        },
        "SearchType" : {
          "$ref" : "#/definitions/SearchType"
        },
        "SessionConfiguration" : {
          "$ref" : "#/definitions/SessionConfiguration"
        },
        "StreamingConfiguration" : {
          "$ref" : "#/definitions/StreamingConfiguration"
        }
      },
      "additionalProperties" : false
    },
    "SessionConfiguration" : {
      "type" : "object",
      "properties" : {
        "SessionTimeoutInSeconds" : {
          "type" : "integer",
          "minimum" : 900,
          "maximum" : 28800
        }
      },
      "additionalProperties" : false
    },
    "StreamingConfiguration" : {
      "type" : "object",
      "properties" : {
        "EnableResponseStreaming" : {
          "type" : "boolean"
        }
      },
      "additionalProperties" : false
    },
    "SearchType" : {
      "type" : "string",
      "enum" : [ "SEMANTIC" ]
    },
    "TagsMap" : {
      "type" : "object",
      "maxProperties" : 50,
      "minProperties" : 0,
      "patternProperties" : {
        "^[a-zA-Z0-9\\s._:/=+@-]*$" : {
          "type" : "string",
          "maxLength" : 256,
          "minLength" : 0,
          "pattern" : "^[a-zA-Z0-9\\s._:/=+@-]*$"
        }
      },
      "additionalProperties" : false
    },
    "WorkloadIdentityDetails" : {
      "type" : "object",
      "properties" : {
        "WorkloadIdentityArn" : {
          "type" : "string",
          "maxLength" : 1024,
          "minLength" : 1
        }
      },
      "required" : [ "WorkloadIdentityArn" ],
      "additionalProperties" : false
    }
  },
  "properties" : {
    "AuthorizerConfiguration" : {
      "$ref" : "#/definitions/AuthorizerConfiguration"
    },
    "AuthorizerType" : {
      "$ref" : "#/definitions/AuthorizerType"
    },
    "CreatedAt" : {
      "type" : "string",
      "format" : "date-time"
    },
    "Description" : {
      "type" : "string",
      "maxLength" : 200,
      "minLength" : 1
    },
    "ExceptionLevel" : {
      "$ref" : "#/definitions/ExceptionLevel"
    },
    "InterceptorConfigurations" : {
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/GatewayInterceptorConfiguration"
      },
      "minItems" : 1,
      "maxItems" : 2
    },
    "PolicyEngineConfiguration" : {
      "$ref" : "#/definitions/GatewayPolicyEngineConfiguration"
    },
    "GatewayArn" : {
      "type" : "string",
      "pattern" : "^arn:[a-z0-9-]{1,20}:bedrock-agentcore:[a-z0-9-]{1,20}:[0-9]{12}:gateway/([0-9a-z][-]?){1,100}-[a-z0-9]{10}$"
    },
    "GatewayIdentifier" : {
      "type" : "string",
      "pattern" : "^([0-9a-z][-]?){1,100}-[0-9a-z]{10}$"
    },
    "GatewayUrl" : {
      "type" : "string",
      "maxLength" : 1024,
      "minLength" : 1
    },
    "KmsKeyArn" : {
      "type" : "string",
      "maxLength" : 2048,
      "minLength" : 1,
      "pattern" : "^arn:[a-z0-9-]{1,20}:kms:[a-zA-Z0-9-]*:[0-9]{12}:key/[a-zA-Z0-9-]{36}$"
    },
    "Name" : {
      "type" : "string",
      "pattern" : "^([0-9a-zA-Z][-]?){1,100}$"
    },
    "ProtocolConfiguration" : {
      "$ref" : "#/definitions/GatewayProtocolConfiguration"
    },
    "ProtocolType" : {
      "allOf" : [ {
        "$ref" : "#/definitions/GatewayProtocolType"
      }, {
        "default" : "MCP"
      } ]
    },
    "RoleArn" : {
      "type" : "string",
      "maxLength" : 2048,
      "minLength" : 1,
      "pattern" : "^arn:[a-z0-9-]{1,20}:iam::([0-9]{12})?:role/.+$"
    },
    "Status" : {
      "$ref" : "#/definitions/GatewayStatus"
    },
    "StatusReasons" : {
      "type" : "array",
      "items" : {
        "type" : "string",
        "maxLength" : 2048
      },
      "maxItems" : 100
    },
    "Tags" : {
      "$ref" : "#/definitions/TagsMap"
    },
    "UpdatedAt" : {
      "type" : "string",
      "format" : "date-time"
    },
    "WorkloadIdentityDetails" : {
      "$ref" : "#/definitions/WorkloadIdentityDetails"
    }
  },
  "required" : [ "AuthorizerType", "Name", "RoleArn" ],
  "readOnlyProperties" : [ "/properties/CreatedAt", "/properties/GatewayArn", "/properties/GatewayIdentifier", "/properties/GatewayUrl", "/properties/Status", "/properties/StatusReasons", "/properties/UpdatedAt", "/properties/WorkloadIdentityDetails" ],
  "primaryIdentifier" : [ "/properties/GatewayIdentifier" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "bedrock-agentcore:CreateGateway", "bedrock-agentcore:CreateWorkloadIdentity", "bedrock-agentcore:DeleteWorkloadIdentity", "bedrock-agentcore:GetGateway", "bedrock-agentcore:ListTagsForResource", "bedrock-agentcore:SynchronizeGatewayTargets", "bedrock-agentcore:TagResource", "iam:PassRole", "kms:CreateGrant", "kms:Decrypt", "kms:DescribeKey", "kms:GenerateDataKey" ]
    },
    "read" : {
      "permissions" : [ "bedrock-agentcore:GetGateway", "bedrock-agentcore:ListTagsForResource" ]
    },
    "update" : {
      "permissions" : [ "bedrock-agentcore:GetGateway", "bedrock-agentcore:ListTagsForResource", "bedrock-agentcore:TagResource", "bedrock-agentcore:UntagResource", "bedrock-agentcore:UpdateGateway", "iam:PassRole", "kms:Decrypt", "kms:DescribeKey", "kms:GenerateDataKey", "kms:ListGrants" ]
    },
    "delete" : {
      "permissions" : [ "bedrock-agentcore:DeleteGateway", "bedrock-agentcore:DeleteWorkloadIdentity", "bedrock-agentcore:GetGateway" ]
    },
    "list" : {
      "permissions" : [ "bedrock-agentcore:ListGateways" ]
    }
  },
  "additionalProperties" : false,
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "bedrock-agentcore:ListTagsForResource", "bedrock-agentcore:TagResource", "bedrock-agentcore:UntagResource" ]
  }
}