Gateway

Source: src/AWS/BedrockAgentCore/Gateway.ts

An Amazon Bedrock AgentCore Gateway — a managed MCP endpoint that turns APIs and Lambda functions into agent-callable tools.

A gateway fronts one or more targets (OpenAPI specs, Smithy models, Lambda functions) behind a single MCP URL with centralized authorization (SigV4 or JWT).

Creating Gateways

IAM-Authorized MCP Gateway

import * as AgentCore from "alchemy/AWS/BedrockAgentCore";
import * as IAM from "alchemy/AWS/IAM";

const role = yield* IAM.Role("GatewayRole", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { Service: "bedrock-agentcore.amazonaws.com" },
        Action: ["sts:AssumeRole"],
      },
    ],
  },
});

const gateway = yield* AgentCore.Gateway("ToolGateway", {
  roleArn: role.roleArn,
  authorizerType: "AWS_IAM",
});

JWT-Authorized Gateway

const gateway = yield* AgentCore.Gateway("JwtGateway", {
  roleArn: role.roleArn,
  authorizerType: "CUSTOM_JWT",
  authorizerConfiguration: {
    customJWTAuthorizer: {
      discoveryUrl: `https://cognito-idp.us-west-2.amazonaws.com/${userPool.userPoolId}/.well-known/openid-configuration`,
      allowedClients: [client.clientId],
    },
  },
});