{
  "typeName" : "AWS::BedrockAgentCore::Runtime",
  "description" : "Resource Type definition for AWS::BedrockAgentCore::Runtime",
  "additionalProperties" : false,
  "definitions" : {
    "AgentRuntimeArn" : {
      "type" : "string",
      "maxLength" : 2048,
      "pattern" : "^arn:(aws(?:-cn|-us-gov|-iso(?:-[bef])?)?):bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:runtime/[a-zA-Z][a-zA-Z0-9_]{0,99}-[a-zA-Z0-9]{10}$"
    },
    "AgentRuntimeId" : {
      "type" : "string",
      "pattern" : "[a-zA-Z][a-zA-Z0-9_]{0,99}-[a-zA-Z0-9]{10}"
    },
    "AgentRuntimeName" : {
      "type" : "string",
      "pattern" : "[a-zA-Z][a-zA-Z0-9_]{0,47}"
    },
    "ClientToken" : {
      "type" : "string",
      "minLength" : 33,
      "maxLength" : 256,
      "pattern" : "^[a-zA-Z0-9-_]+$"
    },
    "CreatedAt" : {
      "type" : "string"
    },
    "AgentRuntimeVersion" : {
      "type" : "string",
      "maxLength" : 5,
      "pattern" : "([1-9][0-9]{0,4})",
      "minLength" : 1
    },
    "LastUpdatedAt" : {
      "type" : "string"
    },
    "AgentStatus" : {
      "type" : "string",
      "enum" : [ "CREATING", "CREATE_FAILED", "UPDATING", "UPDATE_FAILED", "READY", "DELETING" ]
    },
    "Description" : {
      "type" : "string",
      "maxLength" : 1200,
      "minLength" : 1
    },
    "NetworkConfiguration" : {
      "type" : "object",
      "properties" : {
        "NetworkMode" : {
          "$ref" : "#/definitions/NetworkMode"
        },
        "NetworkModeConfig" : {
          "$ref" : "#/definitions/VpcConfig"
        }
      },
      "required" : [ "NetworkMode" ],
      "additionalProperties" : false
    },
    "NetworkMode" : {
      "type" : "string",
      "description" : "Network mode configuration type",
      "enum" : [ "PUBLIC", "VPC" ]
    },
    "VpcConfig" : {
      "type" : "object",
      "description" : "Network mode configuration for VPC",
      "properties" : {
        "SecurityGroups" : {
          "$ref" : "#/definitions/SecurityGroups"
        },
        "Subnets" : {
          "$ref" : "#/definitions/Subnets"
        }
      },
      "required" : [ "SecurityGroups", "Subnets" ],
      "additionalProperties" : false
    },
    "SecurityGroups" : {
      "type" : "array",
      "description" : "Security groups for VPC",
      "minItems" : 1,
      "maxItems" : 16,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/SecurityGroupId"
      }
    },
    "SecurityGroupId" : {
      "type" : "string",
      "description" : "Security group id",
      "pattern" : "^sg-[0-9a-zA-Z]{8,17}$"
    },
    "Subnets" : {
      "type" : "array",
      "description" : "Subnets for VPC",
      "minItems" : 1,
      "maxItems" : 16,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/SubnetId"
      }
    },
    "SubnetId" : {
      "type" : "string",
      "description" : "Subnet id",
      "pattern" : "^subnet-[0-9a-zA-Z]{8,17}$"
    },
    "ProtocolConfiguration" : {
      "type" : "string",
      "enum" : [ "MCP", "HTTP", "A2A", "AGUI" ]
    },
    "AuthorizerConfiguration" : {
      "type" : "object",
      "description" : "Configuration for the authorizer",
      "properties" : {
        "CustomJWTAuthorizer" : {
          "$ref" : "#/definitions/CustomJWTAuthorizerConfiguration"
        }
      },
      "additionalProperties" : false
    },
    "CustomJWTAuthorizerConfiguration" : {
      "type" : "object",
      "description" : "Configuration for custom JWT authorizer",
      "properties" : {
        "DiscoveryUrl" : {
          "$ref" : "#/definitions/DiscoveryUrl"
        },
        "AllowedAudience" : {
          "$ref" : "#/definitions/AllowedAudienceList"
        },
        "AllowedClients" : {
          "$ref" : "#/definitions/AllowedClientsList"
        },
        "AllowedScopes" : {
          "$ref" : "#/definitions/AllowedScopesList"
        },
        "CustomClaims" : {
          "$ref" : "#/definitions/CustomClaimsList"
        }
      },
      "required" : [ "DiscoveryUrl" ],
      "additionalProperties" : false
    },
    "DiscoveryUrl" : {
      "type" : "string",
      "pattern" : "^.+/\\.well-known/openid-configuration$",
      "description" : "OpenID Connect discovery URL"
    },
    "AllowedAudienceList" : {
      "type" : "array",
      "description" : "List of allowed audiences",
      "minItems" : 1,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/AllowedAudience"
      }
    },
    "AllowedAudience" : {
      "type" : "string",
      "description" : "Allowed audience value"
    },
    "AllowedClientsList" : {
      "type" : "array",
      "description" : "List of allowed clients",
      "minItems" : 1,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/AllowedClient"
      }
    },
    "AllowedClient" : {
      "type" : "string",
      "description" : "Allowed client value"
    },
    "AllowedScopesList" : {
      "type" : "array",
      "description" : "List of allowed scopes",
      "minItems" : 1,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/AllowedScope"
      }
    },
    "AllowedScope" : {
      "type" : "string",
      "pattern" : "[\\x21\\x23-\\x5B\\x5D-\\x7E]+",
      "description" : "Allowed scope value"
    },
    "CustomClaimsList" : {
      "type" : "array",
      "description" : "List of required custom claims",
      "minItems" : 1,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/CustomClaimValidationType"
      }
    },
    "CustomClaimValidationType" : {
      "type" : "object",
      "description" : "Required custom claim",
      "properties" : {
        "AuthorizingClaimMatchValue" : {
          "$ref" : "#/definitions/AuthorizingClaimMatchValueType"
        },
        "InboundTokenClaimName" : {
          "$ref" : "#/definitions/InboundTokenClaimName"
        },
        "InboundTokenClaimValueType" : {
          "$ref" : "#/definitions/InboundTokenClaimValueType"
        }
      },
      "required" : [ "AuthorizingClaimMatchValue", "InboundTokenClaimName", "InboundTokenClaimValueType" ],
      "additionalProperties" : false
    },
    "InboundTokenClaimName" : {
      "type" : "string",
      "pattern" : "[A-Za-z0-9_.-:]+",
      "description" : "The name of the custom claim to validate"
    },
    "InboundTokenClaimValueType" : {
      "type" : "string",
      "description" : "Token claim data type",
      "enum" : [ "STRING", "STRING_ARRAY" ]
    },
    "AuthorizingClaimMatchValueType" : {
      "type" : "object",
      "description" : "The value or values in the custom claim to match and relationship of match",
      "properties" : {
        "ClaimMatchOperator" : {
          "$ref" : "#/definitions/ClaimMatchOperator"
        },
        "ClaimMatchValue" : {
          "$ref" : "#/definitions/ClaimMatchValueType"
        }
      },
      "required" : [ "ClaimMatchOperator", "ClaimMatchValue" ],
      "additionalProperties" : false
    },
    "ClaimMatchOperator" : {
      "type" : "string",
      "description" : "The relationship between the claim field value and the value or values being matched",
      "enum" : [ "EQUALS", "CONTAINS", "CONTAINS_ANY" ]
    },
    "ClaimMatchValueType" : {
      "type" : "object",
      "description" : "The value or values in the custom claim to match for",
      "properties" : {
        "MatchValueString" : {
          "$ref" : "#/definitions/MatchValueString"
        },
        "MatchValueStringList" : {
          "$ref" : "#/definitions/MatchValueStringList"
        }
      },
      "additionalProperties" : false
    },
    "MatchValueString" : {
      "type" : "string",
      "pattern" : "[A-Za-z0-9_.-]+",
      "description" : "The string value to match for"
    },
    "MatchValueStringList" : {
      "type" : "array",
      "description" : "The list of strings to check for a match",
      "minItems" : 1,
      "maxItems" : 255,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/MatchValueString"
      }
    },
    "WorkloadIdentityDetails" : {
      "type" : "object",
      "description" : "Configuration for workload identity",
      "properties" : {
        "WorkloadIdentityArn" : {
          "$ref" : "#/definitions/WorkloadIdentityArn"
        }
      },
      "required" : [ "WorkloadIdentityArn" ],
      "additionalProperties" : false
    },
    "WorkloadIdentityArn" : {
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 1024,
      "description" : "ARN of the workload identity"
    },
    "AgentRuntimeArtifact" : {
      "type" : "object",
      "properties" : {
        "ContainerConfiguration" : {
          "$ref" : "#/definitions/ContainerConfiguration"
        },
        "CodeConfiguration" : {
          "$ref" : "#/definitions/CodeConfiguration"
        }
      },
      "additionalProperties" : false
    },
    "CodeConfiguration" : {
      "type" : "object",
      "description" : "Representation of a code configuration",
      "properties" : {
        "Code" : {
          "$ref" : "#/definitions/Code"
        },
        "Runtime" : {
          "$ref" : "#/definitions/AgentManagedRuntimeType"
        },
        "EntryPoint" : {
          "$ref" : "#/definitions/EntryPoints"
        }
      },
      "required" : [ "Code", "Runtime", "EntryPoint" ],
      "additionalProperties" : false
    },
    "Code" : {
      "type" : "object",
      "description" : "Object represents source code from zip file",
      "properties" : {
        "S3" : {
          "$ref" : "#/definitions/S3Location"
        }
      },
      "additionalProperties" : false
    },
    "S3Location" : {
      "type" : "object",
      "description" : "S3 Location Configuration",
      "properties" : {
        "Bucket" : {
          "type" : "string",
          "pattern" : "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$",
          "description" : "S3 bucket name"
        },
        "Prefix" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 1024,
          "description" : "S3 object key prefix"
        },
        "VersionId" : {
          "type" : "string",
          "minLength" : 3,
          "maxLength" : 1024,
          "description" : "S3 object version ID"
        }
      },
      "required" : [ "Bucket", "Prefix" ],
      "additionalProperties" : false
    },
    "AgentManagedRuntimeType" : {
      "type" : "string",
      "description" : "Managed runtime types",
      "enum" : [ "PYTHON_3_10", "PYTHON_3_11", "PYTHON_3_12", "PYTHON_3_13", "PYTHON_3_14", "NODE_22" ]
    },
    "EntryPoints" : {
      "type" : "array",
      "description" : "List of entry points",
      "minItems" : 1,
      "maxItems" : 2,
      "insertionOrder" : true,
      "items" : {
        "type" : "string",
        "description" : "Entry point"
      }
    },
    "ContainerConfiguration" : {
      "type" : "object",
      "properties" : {
        "ContainerUri" : {
          "$ref" : "#/definitions/RuntimeContainerUri"
        }
      },
      "required" : [ "ContainerUri" ],
      "additionalProperties" : false
    },
    "RuntimeContainerUri" : {
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 1024,
      "pattern" : "^\\d{12}\\.dkr\\.ecr\\.([a-z0-9-]+)\\.amazonaws\\.com/((?:[a-z0-9]+(?:[._-][a-z0-9]+)*/)*[a-z0-9]+(?:[._-][a-z0-9]+)*)([:@]\\S+)$",
      "description" : "The ECR URI of the container"
    },
    "RoleArn" : {
      "type" : "string",
      "pattern" : "arn:aws(-[^:]+)?:iam::([0-9]{12})?:role/.+"
    },
    "EnvironmentVariableKey" : {
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 128,
      "pattern" : "^[a-zA-Z_][a-zA-Z0-9_]*$",
      "description" : "Environment variable key"
    },
    "EnvironmentVariableValue" : {
      "type" : "string",
      "maxLength" : 2048,
      "description" : "Environment variable value"
    },
    "EnvironmentVariablesMap" : {
      "type" : "object",
      "description" : "Environment variable attributes",
      "maxProperties" : 50,
      "patternProperties" : {
        "^[a-zA-Z_][a-zA-Z0-9_]*$" : {
          "type" : "string",
          "maxLength" : 2048,
          "description" : "Environment variable value"
        }
      },
      "additionalProperties" : false
    },
    "TagsMap" : {
      "type" : "object",
      "description" : "A map of tag keys and values",
      "patternProperties" : {
        "^[a-zA-Z0-9\\s._:/=+@-]*$" : {
          "type" : "string",
          "maxLength" : 256,
          "minLength" : 0,
          "pattern" : "^[a-zA-Z0-9\\s._:/=+@-]*$",
          "description" : "Value of a tag"
        }
      },
      "additionalProperties" : false
    },
    "LifecycleConfiguration" : {
      "type" : "object",
      "description" : "Configuration for managing the lifecycle of runtime sessions and resources",
      "properties" : {
        "IdleRuntimeSessionTimeout" : {
          "type" : "integer",
          "minimum" : 60,
          "maximum" : 28800,
          "description" : "Timeout in seconds for idle runtime sessions"
        },
        "MaxLifetime" : {
          "type" : "integer",
          "minimum" : 60,
          "maximum" : 28800,
          "description" : "Maximum lifetime in seconds for runtime sessions"
        }
      },
      "additionalProperties" : false
    },
    "RequestHeaderConfiguration" : {
      "type" : "object",
      "description" : "Configuration for HTTP request headers",
      "properties" : {
        "RequestHeaderAllowlist" : {
          "$ref" : "#/definitions/RequestHeaderAllowlist"
        }
      },
      "additionalProperties" : false
    },
    "RequestHeaderAllowlist" : {
      "type" : "array",
      "description" : "List of allowed HTTP headers for agent runtime requests",
      "minItems" : 1,
      "maxItems" : 20,
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/HeaderName"
      }
    },
    "HeaderName" : {
      "type" : "string",
      "description" : "HTTP header name",
      "minLength" : 1,
      "maxLength" : 256,
      "pattern" : "^[A-Za-z][A-Za-z0-9_-]{0,255}$"
    },
    "MountPath" : {
      "type" : "string",
      "description" : "Mount path for filesystem configuration",
      "minLength" : 6,
      "maxLength" : 200,
      "pattern" : "^/mnt/[a-zA-Z0-9._-]+/?$"
    },
    "EfsAccessPointArn" : {
      "type" : "string",
      "description" : "ARN of the EFS access point",
      "maxLength" : 128,
      "pattern" : "^arn:aws[-a-z]*:elasticfilesystem:[0-9a-z-:]+:access-point/fsap-[0-9a-f]{8,40}$"
    },
    "S3FilesAccessPointArn" : {
      "type" : "string",
      "description" : "ARN of the S3 Files access point",
      "maxLength" : 256,
      "pattern" : "^arn:aws[-a-z]*:s3files:[0-9a-z-:]+:file-system/fs-[0-9a-f]{17,40}/access-point/fsap-[0-9a-f]{17,40}$"
    },
    "SessionStorageConfiguration" : {
      "type" : "object",
      "description" : "Configuration for session storage",
      "properties" : {
        "MountPath" : {
          "$ref" : "#/definitions/MountPath"
        }
      },
      "required" : [ "MountPath" ],
      "additionalProperties" : false
    },
    "EfsAccessPointConfiguration" : {
      "type" : "object",
      "description" : "Configuration for EFS access point filesystem",
      "properties" : {
        "AccessPointArn" : {
          "$ref" : "#/definitions/EfsAccessPointArn"
        },
        "MountPath" : {
          "$ref" : "#/definitions/MountPath"
        }
      },
      "required" : [ "AccessPointArn", "MountPath" ],
      "additionalProperties" : false
    },
    "S3FilesAccessPointConfiguration" : {
      "type" : "object",
      "description" : "Configuration for S3 Files access point filesystem",
      "properties" : {
        "AccessPointArn" : {
          "$ref" : "#/definitions/S3FilesAccessPointArn"
        },
        "MountPath" : {
          "$ref" : "#/definitions/MountPath"
        }
      },
      "required" : [ "AccessPointArn", "MountPath" ],
      "additionalProperties" : false
    },
    "FilesystemConfiguration" : {
      "type" : "object",
      "description" : "Filesystem configuration for the runtime",
      "properties" : {
        "SessionStorage" : {
          "$ref" : "#/definitions/SessionStorageConfiguration"
        },
        "EfsAccessPoint" : {
          "$ref" : "#/definitions/EfsAccessPointConfiguration"
        },
        "S3FilesAccessPoint" : {
          "$ref" : "#/definitions/S3FilesAccessPointConfiguration"
        }
      },
      "additionalProperties" : false
    },
    "FilesystemConfigurations" : {
      "type" : "array",
      "description" : "List of filesystem configurations",
      "items" : {
        "$ref" : "#/definitions/FilesystemConfiguration"
      },
      "minItems" : 0,
      "maxItems" : 5,
      "insertionOrder" : false
    }
  },
  "properties" : {
    "AgentRuntimeArn" : {
      "$ref" : "#/definitions/AgentRuntimeArn",
      "description" : "The Amazon Resource Name(ARN) that uniquely identifies the Agent"
    },
    "AgentRuntimeId" : {
      "$ref" : "#/definitions/AgentRuntimeId",
      "description" : "Identifier for a resource"
    },
    "AgentRuntimeName" : {
      "$ref" : "#/definitions/AgentRuntimeName",
      "description" : "Name for a resource"
    },
    "Description" : {
      "$ref" : "#/definitions/Description",
      "description" : "Description of the resource"
    },
    "AgentRuntimeArtifact" : {
      "$ref" : "#/definitions/AgentRuntimeArtifact",
      "description" : "The artifact of the agent"
    },
    "RoleArn" : {
      "$ref" : "#/definitions/RoleArn",
      "description" : "Amazon Resource Name (ARN) of an IAM role"
    },
    "NetworkConfiguration" : {
      "$ref" : "#/definitions/NetworkConfiguration",
      "description" : "Network access configuration for the Agent"
    },
    "ProtocolConfiguration" : {
      "$ref" : "#/definitions/ProtocolConfiguration",
      "description" : "Protocol configuration for the agent runtime"
    },
    "EnvironmentVariables" : {
      "$ref" : "#/definitions/EnvironmentVariablesMap",
      "description" : "Environment variables for the agent runtime"
    },
    "AuthorizerConfiguration" : {
      "$ref" : "#/definitions/AuthorizerConfiguration",
      "description" : "Authorizer configuration for the agent runtime"
    },
    "LifecycleConfiguration" : {
      "$ref" : "#/definitions/LifecycleConfiguration",
      "description" : "Lifecycle configuration for managing runtime sessions"
    },
    "RequestHeaderConfiguration" : {
      "$ref" : "#/definitions/RequestHeaderConfiguration",
      "description" : "Configuration for HTTP request headers"
    },
    "FilesystemConfigurations" : {
      "$ref" : "#/definitions/FilesystemConfigurations",
      "description" : "Filesystem configurations for the agent runtime"
    },
    "AgentRuntimeVersion" : {
      "$ref" : "#/definitions/AgentRuntimeVersion",
      "description" : "Version of the Agent"
    },
    "WorkloadIdentityDetails" : {
      "$ref" : "#/definitions/WorkloadIdentityDetails",
      "description" : "Workload identity details for the agent"
    },
    "CreatedAt" : {
      "$ref" : "#/definitions/CreatedAt",
      "description" : "Timestamp when the Agent was created"
    },
    "LastUpdatedAt" : {
      "$ref" : "#/definitions/LastUpdatedAt",
      "description" : "When resource was last updated"
    },
    "Status" : {
      "$ref" : "#/definitions/AgentStatus",
      "description" : "Current status of the agent"
    },
    "Tags" : {
      "$ref" : "#/definitions/TagsMap"
    },
    "FailureReason" : {
      "type" : "string",
      "description" : "The reason for failure if the agent is in a failed state."
    }
  },
  "primaryIdentifier" : [ "/properties/AgentRuntimeId" ],
  "required" : [ "AgentRuntimeName", "AgentRuntimeArtifact", "RoleArn", "NetworkConfiguration" ],
  "createOnlyProperties" : [ "/properties/AgentRuntimeName" ],
  "readOnlyProperties" : [ "/properties/AgentRuntimeArn", "/properties/AgentRuntimeId", "/properties/AgentRuntimeVersion", "/properties/Status", "/properties/CreatedAt", "/properties/LastUpdatedAt", "/properties/WorkloadIdentityDetails", "/properties/FailureReason" ],
  "replacementStrategy" : "create_then_delete",
  "handlers" : {
    "create" : {
      "permissions" : [ "bedrock-agentcore:CreateAgentRuntime", "bedrock-agentcore:CreateAgentRuntimeEndpoint", "bedrock-agentcore:GetAgentRuntime", "bedrock-agentcore:GetAgentRuntimeEndpoint", "bedrock-agentcore:CreateWorkloadIdentity", "bedrock-agentcore:TagResource", "bedrock-agentcore:ListTagsForResource", "iam:CreateServiceLinkedRole", "iam:PassRole", "s3:GetObject", "s3:GetObjectVersion", "kms:Decrypt" ]
    },
    "read" : {
      "permissions" : [ "bedrock-agentcore:GetAgentRuntime", "bedrock-agentcore:GetAgentRuntimeEndpoint", "bedrock-agentcore:ListTagsForResource" ]
    },
    "update" : {
      "permissions" : [ "bedrock-agentcore:UpdateAgentRuntime", "bedrock-agentcore:UpdateAgentRuntimeEndpoint", "bedrock-agentcore:GetAgentRuntime", "bedrock-agentcore:GetAgentRuntimeEndpoint", "bedrock-agentcore:TagResource", "bedrock-agentcore:UntagResource", "bedrock-agentcore:ListTagsForResource", "iam:CreateServiceLinkedRole", "iam:PassRole", "s3:GetObject", "s3:GetObjectVersion", "kms:Decrypt" ]
    },
    "delete" : {
      "permissions" : [ "bedrock-agentcore:DeleteAgentRuntime", "bedrock-agentcore:DeleteAgentRuntimeEndpoint", "bedrock-agentcore:DeleteWorkloadIdentity", "bedrock-agentcore:GetAgentRuntime", "bedrock-agentcore:GetAgentRuntimeEndpoint" ]
    },
    "list" : {
      "permissions" : [ "bedrock-agentcore:ListAgentRuntimes", "bedrock-agentcore:ListAgentRuntimeEndpoints" ]
    }
  },
  "tagging" : {
    "cloudFormationSystemTags" : false,
    "tagOnCreate" : true,
    "tagProperty" : "/properties/Tags",
    "tagUpdatable" : true,
    "taggable" : true,
    "permissions" : [ "bedrock-agentcore:TagResource", "bedrock-agentcore:UntagResource", "bedrock-agentcore:ListTagsForResource" ]
  }
}