Aws/bedrockagentcore

@swamp/aws/bedrockagentcorev2026.10.25.1· AGPL-3.0-or-later· 1d agoBEHAVIORS

01README

AWS BEDROCKAGENTCORE infrastructure models

02Release Notes

Updated: evaluator, gateway, gateway_target, harness, oauth2credential_provider

03Behaviors27

@swamp/aws/bedrockagentcore/api-key-credential-providerv2026.10.23.1api_key_credential_provider.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	The name of the API key credential provider
ApiKey?	string	no	The API key to use for authentication
ApiKeySecretConfig?	object	no	Configuration for a customer-provided secret containing the API key
ApiKeySecretSource?	enum	no	The source of the API key secret. Use MANAGED for service-managed secrets or EXTERNAL for customer-provided secrets.
ApiKeySecretArn?	object	no	The ARN of the API key secret in AWS Secrets Manager
Tags?	array	no	Tags to assign to the API key credential provider

fn create()

Create a BedrockAgentCore ApiKeyCredentialProvider

fn get(identifier: string)

Get a BedrockAgentCore ApiKeyCredentialProvider

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore ApiKeyCredentialProvider

fn update()

Update a BedrockAgentCore ApiKeyCredentialProvider

fn delete(identifier: string)

Delete a BedrockAgentCore ApiKeyCredentialProvider

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore ApiKeyCredentialProvider

fn sync()

Sync BedrockAgentCore ApiKeyCredentialProvider state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore ApiKeyCredentialProvider resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore ApiKeyCredentialProvider resource state

@swamp/aws/bedrockagentcore/browser-customv2026.10.23.1browser_custom.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	The name of the browser.
Description?	string	no	The description of the browser.
NetworkConfiguration	object	yes	Network configuration for browser.
RecordingConfig?	object	no	Recording configuration for browser.
BrowserSigning?	object	no	Browser signing configuration.
Certificates?	array	no	List of root CA certificates in PEM format.
EnterprisePolicies?	array	no	A list of enterprise policy files for the browser.
ExecutionRoleArn?	string	no	The Amazon Resource Name (ARN) of the IAM role that the browser uses to access resources.
Tags?	record	no	A map of tag keys and values

fn create()

Create a BedrockAgentCore BrowserCustom

fn get(identifier: string)

Get a BedrockAgentCore BrowserCustom

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore BrowserCustom

fn update()

Update a BedrockAgentCore BrowserCustom

fn delete(identifier: string)

Delete a BedrockAgentCore BrowserCustom

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore BrowserCustom

fn sync()

Sync BedrockAgentCore BrowserCustom state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore BrowserCustom resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore BrowserCustom resource state

@swamp/aws/bedrockagentcore/browser-profilev2026.10.23.1browser_profile.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	The name of the browser profile.
Description?	string	no	The description of the browser profile.
Tags?	record	no	A map of tag keys and values.

fn create()

Create a BedrockAgentCore BrowserProfile

fn get(identifier: string)

Get a BedrockAgentCore BrowserProfile

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore BrowserProfile

fn update()

Update a BedrockAgentCore BrowserProfile

fn delete(identifier: string)

Delete a BedrockAgentCore BrowserProfile

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore BrowserProfile

fn sync()

Sync BedrockAgentCore BrowserProfile state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore BrowserProfile resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore BrowserProfile resource state

@swamp/aws/bedrockagentcore/capacity-providerv2026.10.23.1capacity_provider.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	The name of the capacity provider.
Description?	string	no	An optional description of the capacity provider.
PermissionsConfiguration	object	yes	Configuration for permissions associated with a capacity provider.
ComputeConfiguration	object	yes	The capacity configuration for the capacity provider. Defines the compute resources for this capacity provider.
Tags?	array	no	An array of key-value pairs to apply to the capacity provider.

fn create()

Create a BedrockAgentCore CapacityProvider

fn get(identifier: string)

Get a BedrockAgentCore CapacityProvider

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore CapacityProvider

fn update()

Update a BedrockAgentCore CapacityProvider

fn delete(identifier: string)

Delete a BedrockAgentCore CapacityProvider

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore CapacityProvider

fn sync()

Sync BedrockAgentCore CapacityProvider state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore CapacityProvider resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore CapacityProvider resource state

@swamp/aws/bedrockagentcore/code-interpreter-customv2026.10.23.1code_interpreter_custom.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	The name of the code interpreter.
Description?	string	no	The description of the code interpreter.
ExecutionRoleArn?	string	no	The ARN of the IAM role that the code interpreter uses to access resources.
NetworkConfiguration	object	yes	Network configuration for code interpreter.
Certificates?	array	no	List of root CA certificates in PEM format.
Tags?	record	no	A map of tag keys and values

fn create()

Create a BedrockAgentCore CodeInterpreterCustom

fn get(identifier: string)

Get a BedrockAgentCore CodeInterpreterCustom

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore CodeInterpreterCustom

fn update()

Update a BedrockAgentCore CodeInterpreterCustom

fn delete(identifier: string)

Delete a BedrockAgentCore CodeInterpreterCustom

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore CodeInterpreterCustom

fn sync()

Sync BedrockAgentCore CodeInterpreterCustom state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore CodeInterpreterCustom resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore CodeInterpreterCustom resource state

@swamp/aws/bedrockagentcore/configuration-bundlev2026.10.23.1configuration_bundle.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
BundleName	string	yes	The name for the configuration bundle. Names must be unique within your account.
Description?	string	no	The description for the configuration bundle.
Components	record	yes	A map of component identifiers to their configurations.
BranchName?	string	no	The branch name for version tracking.
CommitMessage?	string	no	A commit message describing the version of the configuration bundle.
CreatedBy?	object	no	The source that created a configuration bundle version.
LineageMetadata?	object	no	The version lineage metadata that tracks parent versions and creation source.
KmsKeyArn?	string	no	The ARN of the KMS key used to encrypt component configurations.
Tags?	array	no	Tags to assign to the configuration bundle.

fn create()

Create a BedrockAgentCore ConfigurationBundle

fn get(identifier: string)

Get a BedrockAgentCore ConfigurationBundle

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore ConfigurationBundle

fn update()

Update a BedrockAgentCore ConfigurationBundle

fn delete(identifier: string)

Delete a BedrockAgentCore ConfigurationBundle

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore ConfigurationBundle

fn sync()

Sync BedrockAgentCore ConfigurationBundle state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore ConfigurationBundle resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore ConfigurationBundle resource state

@swamp/aws/bedrockagentcore/consent-portalv2026.10.23.1consent_portal.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ExecutionRoleArn	string	yes
IdpConfig	object	yes
Name	string	yes
Sources	array	yes
Description?	string	no
Tags?	array	no	Tags to assign to the consent portal

fn create()

Create a BedrockAgentCore ConsentPortal

fn get(identifier: string)

Get a BedrockAgentCore ConsentPortal

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore ConsentPortal

fn update()

Update a BedrockAgentCore ConsentPortal

fn delete(identifier: string)

Delete a BedrockAgentCore ConsentPortal

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore ConsentPortal

fn sync()

Sync BedrockAgentCore ConsentPortal state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore ConsentPortal resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore ConsentPortal resource state

@swamp/aws/bedrockagentcore/datasetv2026.10.23.1dataset.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
DatasetName	string	yes	Human-readable name for the dataset. Unique within the account (case-insensitive). Immutable after creation.
Description?	string	no	A description of the dataset.
SchemaType	enum	yes	Versioned schema type governing the structure of examples. Immutable after creation.
Source?	object	no	Source of initial examples. Provide either inline examples or an S3 URI pointing to a JSONL file.
KmsKeyArn?	string	no	Optional AWS KMS key ARN for SSE-KMS on service S3 writes.
Tags?	array	no	A list of tags to assign to the dataset.

fn create()

Create a BedrockAgentCore Dataset

fn get(identifier: string)

Get a BedrockAgentCore Dataset

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Dataset

fn update()

Update a BedrockAgentCore Dataset

fn delete(identifier: string)

Delete a BedrockAgentCore Dataset

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Dataset

fn sync()

Sync BedrockAgentCore Dataset state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore Dataset resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore Dataset resource state

@swamp/aws/bedrockagentcore/evaluatorv2026.10.25.1evaluator.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
EvaluatorName	string	yes	The name of the evaluator. Must be unique within your account.
Description?	string	no	The description of the evaluator.
EvaluatorConfig	object	yes	The configuration for the evaluator, including LLM-as-a-Judge, code-based, or derived settings.
Level	enum	yes	The evaluation level that determines the scope of evaluation. Required for all evaluator configuration types. For Derived evaluators it must match the level of the base evaluator identified by BaseEvaluatorId.
KmsKeyArn?	string	no	The ARN of the KMS key used to encrypt evaluator data.
Tags?	array	no	A list of tags to assign to the evaluator.

fn create()

Create a BedrockAgentCore Evaluator

fn get(identifier: string)

Get a BedrockAgentCore Evaluator

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Evaluator

fn update()

Update a BedrockAgentCore Evaluator

fn delete(identifier: string)

Delete a BedrockAgentCore Evaluator

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Evaluator

fn sync()

Sync BedrockAgentCore Evaluator state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore Evaluator resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore Evaluator resource state

@swamp/aws/bedrockagentcore/gatewayv2026.10.25.1gateway.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AuthorizerConfiguration?	object	no
AuthorizerType	enum	yes
Description?	string	no
ExceptionLevel?	enum	no
InterceptorConfigurations?	array	no
KmsKeyArn?	string	no
Name	string	yes
PolicyEngineConfiguration?	object	no
ProtocolConfiguration?	object	no
ProtocolType?	enum	no
RoleArn	string	yes
Tags?	record	no
WafConfiguration?	object	no
WorkloadIdentityDetails?	object	no

fn create()

Create a BedrockAgentCore Gateway

fn get(identifier: string)

Get a BedrockAgentCore Gateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Gateway

fn update()

Update a BedrockAgentCore Gateway

fn delete(identifier: string)

Delete a BedrockAgentCore Gateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Gateway

fn sync()

Sync BedrockAgentCore Gateway state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore Gateway resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore Gateway resource state

@swamp/aws/bedrockagentcore/gateway-rate-limitv2026.10.23.1gateway_rate_limit.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Description?	string	no	Optional human-readable description for this limit.
DimensionKeys	array	yes	Ordered list of dimension names defining the scope of this limit. Unique per gateway — no two limits can share the same dimensionKeys.
Entries	array	yes	Rule entries mapping dimension values to rate configurations.
GatewayIdentifier?	string	no
RateLimitId?	string	no	Limit identifier. Optional on Create (system-generates if not provided by customer). Always present in responses.

fn create()

Create a BedrockAgentCore GatewayRateLimit

fn get(identifier: string)

Get a BedrockAgentCore GatewayRateLimit

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore GatewayRateLimit

fn update()

Update a BedrockAgentCore GatewayRateLimit

fn delete(identifier: string)

Delete a BedrockAgentCore GatewayRateLimit

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore GatewayRateLimit

fn sync()

Sync BedrockAgentCore GatewayRateLimit state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore GatewayRateLimit resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore GatewayRateLimit resource state

@swamp/aws/bedrockagentcore/gateway-rulev2026.10.23.1gateway_rule.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Actions	array	yes
Conditions?	array	no
Description?	string	no
GatewayIdentifier?	string	no
Priority	number	yes
System?	object	no

fn create()

Create a BedrockAgentCore GatewayRule

fn get(identifier: string)

Get a BedrockAgentCore GatewayRule

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore GatewayRule

fn update()

Update a BedrockAgentCore GatewayRule

fn delete(identifier: string)

Delete a BedrockAgentCore GatewayRule

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore GatewayRule

fn sync()

Sync BedrockAgentCore GatewayRule state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore GatewayRule resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore GatewayRule resource state

@swamp/aws/bedrockagentcore/gateway-targetv2026.10.25.1gateway_target.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
CredentialProviderConfigurations?	array	no
Description?	string	no
GatewayIdentifier?	string	no
MetadataConfiguration?	object	no
Name?	string	no
PrivateEndpoint?	object	no
TargetConfiguration	object	yes

fn create()

Create a BedrockAgentCore GatewayTarget

fn get(identifier: string)

Get a BedrockAgentCore GatewayTarget

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore GatewayTarget

fn update()

Update a BedrockAgentCore GatewayTarget

fn delete(identifier: string)

Delete a BedrockAgentCore GatewayTarget

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore GatewayTarget

fn sync()

Sync BedrockAgentCore GatewayTarget state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore GatewayTarget resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore GatewayTarget resource state

@swamp/aws/bedrockagentcore/harnessv2026.10.25.1harness.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
HarnessName	string	yes	The name of the harness.
ExecutionRoleArn	string	yes	The ARN of the IAM role that the harness assumes when running.
Environment?	object	no	The compute environment configuration for the harness, including underlying runtime information.
EnvironmentArtifact?	object	no	The environment artifact for the harness, such as a custom container image.
EnvironmentVariables?	record	no	Environment variables to set in the harness runtime environment.
AuthorizerConfiguration?	object	no	The inbound authorization configuration for authenticating incoming requests.
Model	object	yes	The model configuration for the harness.
SystemPrompt?	array	no	The system prompt that defines the agent's behavior.
Tools?	array	no	The tools available to the agent.
Skills?	array	no	The skills available to the agent.
AllowedTools?	array	no	The tools that the agent is allowed to use.
Hooks?	array	no	Lifecycle hooks that fire at well-defined points in the agent loop for policy enforcement, audit, and governance.
Memory?	object	no	The AgentCore Memory configuration for persisting conversation context.
Truncation?	object	no	The truncation configuration for managing conversation context.
MaxIterations?	number	no	The maximum number of iterations the agent loop can execute per invocation.
MaxTokens?	number	no	The maximum number of tokens the agent can generate per iteration.
TimeoutSeconds?	number	no	The maximum duration in seconds for the agent loop execution per invocation.
Tags?	array	no	Tags to apply to the harness resource.

fn create()

Create a BedrockAgentCore Harness

fn get(identifier: string)

Get a BedrockAgentCore Harness

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Harness

fn update()

Update a BedrockAgentCore Harness

fn delete(identifier: string)

Delete a BedrockAgentCore Harness

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Harness

fn sync()

Sync BedrockAgentCore Harness state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore Harness resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore Harness resource state

@swamp/aws/bedrockagentcore/harness-endpointv2026.10.23.1harness_endpoint.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
HarnessId	string	yes	The ID of the harness that the endpoint belongs to.
EndpointName	string	yes	The name of the endpoint. Must start with a letter and contain only alphanumeric characters and underscores.
TargetVersion?	string	no	The harness version that the endpoint points to and serves invocations from.
Description?	string	no	The description of the endpoint.
Tags?	array	no	Tags to apply to the harness endpoint resource.

fn create()

Create a BedrockAgentCore HarnessEndpoint

fn get(identifier: string)

Get a BedrockAgentCore HarnessEndpoint

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore HarnessEndpoint

fn update()

Update a BedrockAgentCore HarnessEndpoint

fn delete(identifier: string)

Delete a BedrockAgentCore HarnessEndpoint

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore HarnessEndpoint

fn sync()

Sync BedrockAgentCore HarnessEndpoint state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore HarnessEndpoint resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore HarnessEndpoint resource state

@swamp/aws/bedrockagentcore/memoryv2026.10.23.1memory.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	Name of the Memory resource
Description?	string	no	Description of the Memory resource
EncryptionKeyArn?	string	no	ARN format
MemoryExecutionRoleArn?	string	no	ARN format
EventExpiryDuration	number	yes	Duration in days until memory events expire
MemoryStrategies?	array	no	List of memory strategies attached to this memory
IndexedKeys?	array	no	List of indexed keys for the memory
NamespaceKeys?	array	no	List of namespace variable key definitions for a memory resource
StreamDeliveryResources?	object	no
Tags?	record	no	A map of tag keys and values

fn create()

Create a BedrockAgentCore Memory

fn get(identifier: string)

Get a BedrockAgentCore Memory

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Memory

fn update()

Update a BedrockAgentCore Memory

fn delete(identifier: string)

Delete a BedrockAgentCore Memory

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Memory

fn sync()

Sync BedrockAgentCore Memory state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore Memory resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore Memory resource state

@swamp/aws/bedrockagentcore/oauth2credential-providerv2026.10.25.1oauth2credential_provider.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	The name of the OAuth2 credential provider
CredentialProviderVendor	enum	yes	The vendor of the OAuth2 credential provider
Oauth2ProviderConfigInput?	object	no	The configuration settings for the OAuth2 provider
ClientSecretArn?	object	no	The ARN of the client secret in AWS Secrets Manager
Oauth2ProviderConfigOutput?	object	no	The output configuration for the OAuth2 provider
Tags?	array	no	Tags to assign to the OAuth2 credential provider

fn create()

Create a BedrockAgentCore OAuth2CredentialProvider

fn get(identifier: string)

Get a BedrockAgentCore OAuth2CredentialProvider

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore OAuth2CredentialProvider

fn update()

Update a BedrockAgentCore OAuth2CredentialProvider

fn delete(identifier: string)

Delete a BedrockAgentCore OAuth2CredentialProvider

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore OAuth2CredentialProvider

fn sync()

Sync BedrockAgentCore OAuth2CredentialProvider state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore OAuth2CredentialProvider resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore OAuth2CredentialProvider resource state

@swamp/aws/bedrockagentcore/online-evaluation-configv2026.10.23.1online_evaluation_config.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
OnlineEvaluationConfigName	string	yes	The name of the online evaluation configuration. Must be unique within your account.
Description?	string	no	The description of the online evaluation configuration.
DataSourceConfig	object	yes	The data source configuration that specifies CloudWatch log groups and service names to monitor.
EvaluationExecutionRoleArn	string	yes	The Amazon Resource Name (ARN) of the IAM role that grants permissions for evaluation.
Evaluators?	array	no	The list of evaluators to apply during online evaluation.
Rule	object	yes	The evaluation rule that defines sampling configuration, filters, and session detection settings.
ExecutionStatus?	enum	no	The execution status indicating whether the online evaluation is currently running.
OutputConfig?	object	no	The configuration that specifies where evaluation results should be written.
Tags?	array	no	A list of tags to assign to the online evaluation configuration.
Insights?	array	no	The list of insights to enable for failure analysis.
ClusteringConfig?	object	no	The configuration for clustering analysis of evaluation results.

fn create()

Create a BedrockAgentCore OnlineEvaluationConfig

fn get(identifier: string)

Get a BedrockAgentCore OnlineEvaluationConfig

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore OnlineEvaluationConfig

fn update()

Update a BedrockAgentCore OnlineEvaluationConfig

fn delete(identifier: string)

Delete a BedrockAgentCore OnlineEvaluationConfig

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore OnlineEvaluationConfig

fn sync()

Sync BedrockAgentCore OnlineEvaluationConfig state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore OnlineEvaluationConfig resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore OnlineEvaluationConfig resource state

@swamp/aws/bedrockagentcore/payment-connectorv2026.10.23.1payment_connector.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
PaymentManagerId	string	yes	The identifier of the parent payment manager
ConnectorName	string	yes	The name of the payment connector
Description?	string	no	A description of the payment connector
ConnectorType	enum	yes
ProvisionMode?	enum	no	The provision mode for creating the connector. MANUAL requires CredentialProviderConfigurations; QUICK_CREATE orchestrates OAuth consent and credential provisioning.
CredentialProviderConfigurations?	array	no	The credential provider configurations for the connector. Required when ProvisionMode is MANUAL or not specified. Empty for QUICK_CREATE until provisioning completes.

fn create()

Create a BedrockAgentCore PaymentConnector

fn get(identifier: string)

Get a BedrockAgentCore PaymentConnector

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore PaymentConnector

fn update()

Update a BedrockAgentCore PaymentConnector

fn delete(identifier: string)

Delete a BedrockAgentCore PaymentConnector

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore PaymentConnector

fn sync()

Sync BedrockAgentCore PaymentConnector state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore PaymentConnector resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore PaymentConnector resource state

@swamp/aws/bedrockagentcore/payment-credential-providerv2026.10.23.1payment_credential_provider.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	Unique name for the payment credential provider
CredentialProviderVendor	enum	yes	Supported vendor types for payment providers
ProviderConfigurationInput?	object	no	Provider configuration input containing secrets for creation/update
ProviderConfigurationOutput?	object	no	Provider configuration output containing secret ARNs (no raw secrets)
Tags?	array	no	Tags for the payment credential provider

fn create()

Create a BedrockAgentCore PaymentCredentialProvider

fn get(identifier: string)

Get a BedrockAgentCore PaymentCredentialProvider

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore PaymentCredentialProvider

fn update()

Update a BedrockAgentCore PaymentCredentialProvider

fn delete(identifier: string)

Delete a BedrockAgentCore PaymentCredentialProvider

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore PaymentCredentialProvider

fn sync()

Sync BedrockAgentCore PaymentCredentialProvider state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore PaymentCredentialProvider resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore PaymentCredentialProvider resource state

@swamp/aws/bedrockagentcore/payment-managerv2026.10.23.1payment_manager.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	The name of the payment manager
Description?	string	no	A description of the payment manager
AuthorizerType	enum	yes	The type of authorizer for the payment manager
AuthorizerConfiguration?	object	no	The authorizer configuration for the payment manager
RoleArn	string	yes	The ARN of the IAM role for the payment manager
WorkloadIdentityDetails?	object	no	The workload identity details for the payment manager
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a BedrockAgentCore PaymentManager

fn get(identifier: string)

Get a BedrockAgentCore PaymentManager

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore PaymentManager

fn update()

Update a BedrockAgentCore PaymentManager

fn delete(identifier: string)

Delete a BedrockAgentCore PaymentManager

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore PaymentManager

fn sync()

Sync BedrockAgentCore PaymentManager state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore PaymentManager resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore PaymentManager resource state

@swamp/aws/bedrockagentcore/policyv2026.10.23.1policy.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
PolicyEngineId	string	yes	The identifier of the policy engine which contains this policy.
Name	string	yes	The customer-assigned immutable name for the policy. Must be unique within the policy engine.
Definition	object	yes	The definition structure for policies. Encapsulates different policy formats.
Description?	string	no	A human-readable description of the policy's purpose and functionality.
ValidationMode?	enum	no	The validation mode for the policy. Determines how Cedar analyzer validation results are handled.
EnforcementMode?	enum	no	Whether the policy contributes to the enforce decision returned to Gateway. LOG_ONLY policies are still evaluated but their decisions are observed only, allowing customers to validate a policy against real traffic before promoting it.

fn create()

Create a BedrockAgentCore Policy

fn get(identifier: string)

Get a BedrockAgentCore Policy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Policy

fn update()

Update a BedrockAgentCore Policy

fn delete(identifier: string)

Delete a BedrockAgentCore Policy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Policy

fn sync()

Sync BedrockAgentCore Policy state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore Policy resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore Policy resource state

@swamp/aws/bedrockagentcore/policy-enginev2026.10.23.1policy_engine.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	The customer-assigned immutable name for the policy engine
Description?	string	no	A human-readable description of the policy engine's purpose and scope
EncryptionKeyArn?	string	no	The ARN of the KMS key used to encrypt the policy engine data
Tags?	array	no	A list of tags to assign to the policy engine.

fn create()

Create a BedrockAgentCore PolicyEngine

fn get(identifier: string)

Get a BedrockAgentCore PolicyEngine

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore PolicyEngine

fn update()

Update a BedrockAgentCore PolicyEngine

fn delete(identifier: string)

Delete a BedrockAgentCore PolicyEngine

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore PolicyEngine

fn sync()

Sync BedrockAgentCore PolicyEngine state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore PolicyEngine resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore PolicyEngine resource state

@swamp/aws/bedrockagentcore/resource-policyv2026.10.23.1resource_policy.ts

Global Arguments

Argument	Type	Required	Description
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ResourceArn	string	yes	The Amazon Resource Name (ARN) of the resource for which to create or update the resource policy.
Policy	string	yes	The resource policy to create or update.

fn create()

Create a BedrockAgentCore ResourcePolicy

fn get(identifier: string)

Get a BedrockAgentCore ResourcePolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore ResourcePolicy

fn update()

Update a BedrockAgentCore ResourcePolicy

fn delete(identifier: string)

Delete a BedrockAgentCore ResourcePolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore ResourcePolicy

fn sync()

Sync BedrockAgentCore ResourcePolicy state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore ResourcePolicy resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore ResourcePolicy resource state

@swamp/aws/bedrockagentcore/runtimev2026.10.23.1runtime.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AgentRuntimeName	string	yes	Name for a resource
Description?	string	no	Description of the resource
AgentRuntimeArtifact	object	yes	The artifact of the agent
RoleArn	string	yes	Amazon Resource Name (ARN) of an IAM role
NetworkConfiguration?	object	no	Network access configuration for the Agent
ProtocolConfiguration?	enum	no	Protocol configuration for the agent runtime
PlatformVersion?	string	no	The version of the runtime platform
EnvironmentVariables?	record	no	Environment variables for the agent runtime
AuthorizerConfiguration?	object	no	Authorizer configuration for the agent runtime
LifecycleConfiguration?	object	no	Lifecycle configuration for managing runtime sessions
RequestHeaderConfiguration?	object	no	Configuration for HTTP request headers
FilesystemConfigurations?	array	no	Filesystem configurations for the agent runtime
CapacityProviderConfiguration?	object	no	Capacity provider configuration for the agent runtime
WorkloadIdentityDetails?	object	no	Workload identity details for the agent
Tags?	record	no	A map of tag keys and values

fn create()

Create a BedrockAgentCore Runtime

fn get(identifier: string)

Get a BedrockAgentCore Runtime

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Runtime

fn update()

Update a BedrockAgentCore Runtime

fn delete(identifier: string)

Delete a BedrockAgentCore Runtime

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore Runtime

fn sync()

Sync BedrockAgentCore Runtime state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore Runtime resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore Runtime resource state

@swamp/aws/bedrockagentcore/runtime-endpointv2026.10.23.1runtime_endpoint.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AgentRuntimeId	string	yes	The ID of the parent Agent Runtime (required for creation)
Name	string	yes	The name of the Agent Runtime Endpoint
AgentRuntimeVersion?	string	no	The version of the AgentCore Runtime to use for the endpoint.
Description?	string	no	The description of the AgentCore Runtime endpoint.
Tags?	record	no	A map of tag keys and values

fn create()

Create a BedrockAgentCore RuntimeEndpoint

fn get(identifier: string)

Get a BedrockAgentCore RuntimeEndpoint

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore RuntimeEndpoint

fn update()

Update a BedrockAgentCore RuntimeEndpoint

fn delete(identifier: string)

Delete a BedrockAgentCore RuntimeEndpoint

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore RuntimeEndpoint

fn sync()

Sync BedrockAgentCore RuntimeEndpoint state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore RuntimeEndpoint resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore RuntimeEndpoint resource state

@swamp/aws/bedrockagentcore/workload-identityv2026.10.23.1workload_identity.ts

Global Arguments

Argument	Type	Required	Description
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	The name of the workload identity. The name must be unique within your account.
AllowedResourceOauth2ReturnUrls?	array	no	The list of allowed OAuth2 return URLs for resources associated with this workload identity.
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a BedrockAgentCore WorkloadIdentity

fn get(identifier: string)

Get a BedrockAgentCore WorkloadIdentity

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore WorkloadIdentity

fn update()

Update a BedrockAgentCore WorkloadIdentity

fn delete(identifier: string)

Delete a BedrockAgentCore WorkloadIdentity

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the BedrockAgentCore WorkloadIdentity

fn sync()

Sync BedrockAgentCore WorkloadIdentity state from AWS

fn list(maxPages?: number, resourceModel?: string)

List BedrockAgentCore WorkloadIdentity resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— BedrockAgentCore WorkloadIdentity resource state

04Previous Versions19

2026.10.24.1AGPL-3.0-or-laterOct 24, 2026

2026.10.23.2AGPL-3.0-or-laterOct 24, 2026

Updated: api_key_credential_provider, browser_custom, browser_profile, capacity_provider, code_interpreter_custom, configuration_bundle, consent_portal, dataset, evaluator, gateway, gateway_rate_limit, gateway_rule, gateway_target, harness, harness_endpoint, memory, oauth2credential_provider, online_evaluation_config, payment_connector, payment_credential_provider, payment_manager, policy, policy_engine, resource_policy, runtime, runtime_endpoint, workload_identity

2026.10.23.1AGPL-3.0-or-laterOct 23, 2026

Updated: gateway

2026.10.22.1AGPL-3.0-or-laterOct 22, 2026

Updated: gateway

2026.10.21.1AGPL-3.0-or-laterOct 21, 2026

Updated: payment_manager

2026.10.20.1AGPL-3.0-or-laterOct 20, 2026

Updated: memory

2026.10.17.1AGPL-3.0-or-laterOct 17, 2026

Updated: dataset

2026.10.16.1AGPL-3.0-or-laterOct 16, 2026

Updated: evaluator

2026.10.15.1AGPL-3.0-or-later(was none)Oct 15, 2026

Updated: online_evaluation_config

2026.10.13.1Oct 13, 2026

Updated: api_key_credential_provider, browser_custom, browser_profile, capacity_provider, code_interpreter_custom, configuration_bundle, consent_portal, dataset, evaluator, gateway, gateway_rate_limit, gateway_rule, gateway_target, harness, harness_endpoint, memory, oauth2credential_provider, online_evaluation_config, payment_connector, payment_credential_provider, payment_manager, policy, policy_engine, resource_policy, runtime, runtime_endpoint, workload_identity

Added 1 behaviors

2026.10.09.1Oct 10, 2026

Updated: harness, online_evaluation_config

2026.10.08.2Oct 8, 2026

2026.10.08.1Oct 8, 2026

Updated: evaluator

2026.10.06.1Oct 6, 2026

2026.10.04.1Oct 4, 2026

Updated: harness

2026.10.03.1Oct 3, 2026

2026.10.02.1Oct 2, 2026

Updated: harness

2026.10.01.1Oct 1, 2026

2026.09.30.1Sep 30, 2026

Updated: online_evaluation_config

05Stats

100 / 100

Downloads

Archive size

5.4 MB

Verified by Swamp

Has README or module doc2/2earned
README has a code example1/1earned
README is substantive1/1earned
Most symbols documented1/1earned
No slow types (deprecated)1/1earned
Dependencies pass trust audit2/2earned
Docs keep secrets in a vault1/1earned
Has description1/1earned
Platform support declared (or universal)2/2earned
License2/2earned
Verified public repository2/2earned

Repository

https://github.com/swamp-club/swamp-extensions

06Platforms

linux · x86_64 linux · aarch64 macOS · x86_64 macOS · aarch64 windows · x86_64

07Labels

#aws #bedrockagentcore #cloud #infrastructure