Skip to main content

Aws/bedrockagentcore

@swamp/aws/bedrockagentcorev2026.07.26.1· 1d agoMODELS
01README

AWS BEDROCKAGENTCORE infrastructure models

02Models25
@swamp/aws/bedrockagentcore/api-key-credential-providerv2026.06.15.1api_key_credential_provider.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringThe name of the API key credential provider
ApiKey?stringThe API key to use for authentication
ApiKeySecretConfig?objectConfiguration for a customer-provided secret containing the API key
ApiKeySecretSource?enumThe source of the API key secret. Use MANAGED for service-managed secrets or EXTERNAL for customer-provided secrets.
ApiKeySecretArn?objectThe ARN of the API key secret in AWS Secrets Manager
Tags?arrayTags to assign to the API key credential provider
fn create()
Create a BedrockAgentCore ApiKeyCredentialProvider
fn get(identifier: string)
Get a BedrockAgentCore ApiKeyCredentialProvider
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore ApiKeyCredentialProvider
fn update()
Update a BedrockAgentCore ApiKeyCredentialProvider
fn delete(identifier: string)
Delete a BedrockAgentCore ApiKeyCredentialProvider
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore ApiKeyCredentialProvider
fn sync()
Sync BedrockAgentCore ApiKeyCredentialProvider state from AWS

Resources

state(infinite)— BedrockAgentCore ApiKeyCredentialProvider resource state
@swamp/aws/bedrockagentcore/browserv2026.06.15.1browser.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
fn get(identifier: string)
Get a BedrockAgentCore Browser
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Browser
fn sync()
Sync BedrockAgentCore Browser state from AWS

Resources

state(infinite)— BedrockAgentCore Browser resource state
@swamp/aws/bedrockagentcore/browser-customv2026.06.15.1browser_custom.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringThe name of the browser.
Description?stringThe description of the browser.
NetworkConfigurationobjectNetwork configuration for browser.
RecordingConfig?objectRecording configuration for browser.
BrowserSigning?objectBrowser signing configuration.
Certificates?arrayList of root CA certificates in PEM format.
EnterprisePolicies?arrayA list of enterprise policy files for the browser.
ExecutionRoleArn?stringThe Amazon Resource Name (ARN) of the IAM role that the browser uses to access resources.
Tags?recordA map of tag keys and values
fn create()
Create a BedrockAgentCore BrowserCustom
fn get(identifier: string)
Get a BedrockAgentCore BrowserCustom
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore BrowserCustom
fn update()
Update a BedrockAgentCore BrowserCustom
fn delete(identifier: string)
Delete a BedrockAgentCore BrowserCustom
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore BrowserCustom
fn sync()
Sync BedrockAgentCore BrowserCustom state from AWS

Resources

state(infinite)— BedrockAgentCore BrowserCustom resource state
@swamp/aws/bedrockagentcore/browser-profilev2026.06.15.1browser_profile.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringThe name of the browser profile.
Description?stringThe description of the browser profile.
Tags?recordA map of tag keys and values.
fn create()
Create a BedrockAgentCore BrowserProfile
fn get(identifier: string)
Get a BedrockAgentCore BrowserProfile
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore BrowserProfile
fn update()
Update a BedrockAgentCore BrowserProfile
fn delete(identifier: string)
Delete a BedrockAgentCore BrowserProfile
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore BrowserProfile
fn sync()
Sync BedrockAgentCore BrowserProfile state from AWS

Resources

state(infinite)— BedrockAgentCore BrowserProfile resource state
@swamp/aws/bedrockagentcore/code-interpreterv2026.07.16.1code_interpreter.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
fn get(identifier: string)
Get a BedrockAgentCore CodeInterpreter
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore CodeInterpreter
fn sync()
Sync BedrockAgentCore CodeInterpreter state from AWS

Resources

state(infinite)— BedrockAgentCore CodeInterpreter resource state
@swamp/aws/bedrockagentcore/code-interpreter-customv2026.06.15.1code_interpreter_custom.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringThe name of the code interpreter.
Description?stringThe description of the code interpreter.
ExecutionRoleArn?stringThe ARN of the IAM role that the code interpreter uses to access resources.
NetworkConfigurationobjectNetwork configuration for code interpreter.
Certificates?arrayList of root CA certificates in PEM format.
Tags?recordA map of tag keys and values
fn create()
Create a BedrockAgentCore CodeInterpreterCustom
fn get(identifier: string)
Get a BedrockAgentCore CodeInterpreterCustom
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore CodeInterpreterCustom
fn update()
Update a BedrockAgentCore CodeInterpreterCustom
fn delete(identifier: string)
Delete a BedrockAgentCore CodeInterpreterCustom
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore CodeInterpreterCustom
fn sync()
Sync BedrockAgentCore CodeInterpreterCustom state from AWS

Resources

state(infinite)— BedrockAgentCore CodeInterpreterCustom resource state
@swamp/aws/bedrockagentcore/configuration-bundlev2026.06.18.1configuration_bundle.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
BundleNamestringThe name for the configuration bundle. Names must be unique within your account.
Description?stringThe description for the configuration bundle.
ComponentsrecordA map of component identifiers to their configurations.
BranchName?stringThe branch name for version tracking.
CommitMessage?stringA commit message describing the version of the configuration bundle.
CreatedBy?objectThe source that created a configuration bundle version.
LineageMetadata?objectThe version lineage metadata that tracks parent versions and creation source.
KmsKeyArn?stringThe ARN of the KMS key used to encrypt component configurations.
Tags?arrayTags to assign to the configuration bundle.
fn create()
Create a BedrockAgentCore ConfigurationBundle
fn get(identifier: string)
Get a BedrockAgentCore ConfigurationBundle
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore ConfigurationBundle
fn update()
Update a BedrockAgentCore ConfigurationBundle
fn delete(identifier: string)
Delete a BedrockAgentCore ConfigurationBundle
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore ConfigurationBundle
fn sync()
Sync BedrockAgentCore ConfigurationBundle state from AWS

Resources

state(infinite)— BedrockAgentCore ConfigurationBundle resource state
@swamp/aws/bedrockagentcore/datasetv2026.06.15.1dataset.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
DatasetNamestringHuman-readable name for the dataset. Unique within the account (case-insensitive). Immutable after creation.
Description?stringA description of the dataset.
SchemaTypeenumVersioned schema type governing the structure of examples. Immutable after creation.
Source?objectSource of initial examples. Provide either inline examples or an S3 URI pointing to a JSONL file.
KmsKeyArn?stringOptional AWS KMS key ARN for SSE-KMS on service S3 writes.
Tags?arrayA list of tags to assign to the dataset.
fn create()
Create a BedrockAgentCore Dataset
fn get(identifier: string)
Get a BedrockAgentCore Dataset
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Dataset
fn update()
Update a BedrockAgentCore Dataset
fn delete(identifier: string)
Delete a BedrockAgentCore Dataset
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Dataset
fn sync()
Sync BedrockAgentCore Dataset state from AWS

Resources

state(infinite)— BedrockAgentCore Dataset resource state
@swamp/aws/bedrockagentcore/evaluatorv2026.06.15.1evaluator.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
EvaluatorNamestringThe name of the evaluator. Must be unique within your account.
Description?stringThe description of the evaluator.
EvaluatorConfigobjectThe configuration for the evaluator.
LevelenumThe evaluation level that determines the scope of evaluation.
KmsKeyArn?stringThe ARN of the KMS key used to encrypt evaluator data.
Tags?arrayA list of tags to assign to the evaluator.
fn create()
Create a BedrockAgentCore Evaluator
fn get(identifier: string)
Get a BedrockAgentCore Evaluator
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Evaluator
fn update()
Update a BedrockAgentCore Evaluator
fn delete(identifier: string)
Delete a BedrockAgentCore Evaluator
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Evaluator
fn sync()
Sync BedrockAgentCore Evaluator state from AWS

Resources

state(infinite)— BedrockAgentCore Evaluator resource state
@swamp/aws/bedrockagentcore/gatewayv2026.07.20.1gateway.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AuthorizerConfiguration?object
AuthorizerTypeenum
Description?string
ExceptionLevel?enum
InterceptorConfigurations?array
PolicyEngineConfiguration?objectThe configuration for a policy engine associated with a gateway. A policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with a gateway, the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies.
KmsKeyArn?string
Namestring
ProtocolConfiguration?object
RoleArnstring
Tags?record
WorkloadIdentityDetails?object
fn create()
Create a BedrockAgentCore Gateway
fn get(identifier: string)
Get a BedrockAgentCore Gateway
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Gateway
fn update()
Update a BedrockAgentCore Gateway
fn delete(identifier: string)
Delete a BedrockAgentCore Gateway
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Gateway
fn sync()
Sync BedrockAgentCore Gateway state from AWS

Resources

state(infinite)— BedrockAgentCore Gateway resource state
@swamp/aws/bedrockagentcore/gateway-targetv2026.06.18.1gateway_target.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
CredentialProviderConfigurations?array
Description?string
GatewayIdentifier?string
MetadataConfiguration?object
Name?string
PrivateEndpoint?object
fn create()
Create a BedrockAgentCore GatewayTarget
fn get(identifier: string)
Get a BedrockAgentCore GatewayTarget
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore GatewayTarget
fn update()
Update a BedrockAgentCore GatewayTarget
fn delete(identifier: string)
Delete a BedrockAgentCore GatewayTarget
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore GatewayTarget
fn sync()
Sync BedrockAgentCore GatewayTarget state from AWS

Resources

state(infinite)— BedrockAgentCore GatewayTarget resource state
@swamp/aws/bedrockagentcore/harnessv2026.06.23.1harness.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
HarnessNamestringThe name of the harness.
ExecutionRoleArnstringThe ARN of the IAM role that the harness assumes when running.
Environment?objectThe compute environment configuration for the harness, including underlying runtime information.
EnvironmentArtifact?objectThe environment artifact for the harness, such as a custom container image.
EnvironmentVariables?recordEnvironment variables to set in the harness runtime environment.
AuthorizerConfiguration?objectThe inbound authorization configuration for authenticating incoming requests.
ModelobjectThe model configuration for the harness.
SystemPrompt?arrayThe system prompt that defines the agent's behavior.
Tools?arrayThe tools available to the agent.
Skills?arrayThe skills available to the agent.
AllowedTools?arrayThe tools that the agent is allowed to use.
Memory?objectThe AgentCore Memory configuration for persisting conversation context.
Truncation?objectThe truncation configuration for managing conversation context.
MaxIterations?numberThe maximum number of iterations the agent loop can execute per invocation.
MaxTokens?numberThe maximum number of tokens the agent can generate per iteration.
TimeoutSeconds?numberThe maximum duration in seconds for the agent loop execution per invocation.
Tags?arrayTags to apply to the harness resource.
fn create()
Create a BedrockAgentCore Harness
fn get(identifier: string)
Get a BedrockAgentCore Harness
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Harness
fn update()
Update a BedrockAgentCore Harness
fn delete(identifier: string)
Delete a BedrockAgentCore Harness
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Harness
fn sync()
Sync BedrockAgentCore Harness state from AWS

Resources

state(infinite)— BedrockAgentCore Harness resource state
@swamp/aws/bedrockagentcore/memoryv2026.06.15.1memory.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringName of the Memory resource
Description?stringDescription of the Memory resource
EncryptionKeyArn?stringARN format
MemoryExecutionRoleArn?stringARN format
EventExpiryDurationnumberDuration in days until memory events expire
MemoryStrategies?arrayList of memory strategies attached to this memory
IndexedKeys?arrayList of indexed keys for the memory
StreamDeliveryResources?object
Tags?recordA map of tag keys and values
fn create()
Create a BedrockAgentCore Memory
fn get(identifier: string)
Get a BedrockAgentCore Memory
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Memory
fn update()
Update a BedrockAgentCore Memory
fn delete(identifier: string)
Delete a BedrockAgentCore Memory
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Memory
fn sync()
Sync BedrockAgentCore Memory state from AWS

Resources

state(infinite)— BedrockAgentCore Memory resource state
@swamp/aws/bedrockagentcore/oauth2credential-providerv2026.06.15.1oauth2credential_provider.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringThe name of the OAuth2 credential provider
CredentialProviderVendorenumThe vendor of the OAuth2 credential provider
Oauth2ProviderConfigInput?objectThe configuration settings for the OAuth2 provider
ClientSecretArn?objectThe ARN of the client secret in AWS Secrets Manager
Oauth2ProviderConfigOutput?objectThe output configuration for the OAuth2 provider
Tags?arrayTags to assign to the OAuth2 credential provider
fn create()
Create a BedrockAgentCore OAuth2CredentialProvider
fn get(identifier: string)
Get a BedrockAgentCore OAuth2CredentialProvider
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore OAuth2CredentialProvider
fn update()
Update a BedrockAgentCore OAuth2CredentialProvider
fn delete(identifier: string)
Delete a BedrockAgentCore OAuth2CredentialProvider
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore OAuth2CredentialProvider
fn sync()
Sync BedrockAgentCore OAuth2CredentialProvider state from AWS

Resources

state(infinite)— BedrockAgentCore OAuth2CredentialProvider resource state
@swamp/aws/bedrockagentcore/online-evaluation-configv2026.06.15.2online_evaluation_config.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
OnlineEvaluationConfigNamestringThe name of the online evaluation configuration. Must be unique within your account.
Description?stringThe description of the online evaluation configuration.
DataSourceConfigobjectThe data source configuration that specifies CloudWatch log groups and service names to monitor.
EvaluationExecutionRoleArnstringThe Amazon Resource Name (ARN) of the IAM role that grants permissions for evaluation.
Evaluators?arrayThe list of evaluators to apply during online evaluation.
RuleobjectThe evaluation rule that defines sampling configuration, filters, and session detection settings.
ExecutionStatus?enumThe execution status indicating whether the online evaluation is currently running.
OutputConfig?objectThe configuration that specifies where evaluation results should be written.
Tags?arrayA list of tags to assign to the online evaluation configuration.
Insights?arrayThe list of insights to enable for failure analysis.
ClusteringConfig?objectThe configuration for clustering analysis of evaluation results.
fn create()
Create a BedrockAgentCore OnlineEvaluationConfig
fn get(identifier: string)
Get a BedrockAgentCore OnlineEvaluationConfig
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore OnlineEvaluationConfig
fn update()
Update a BedrockAgentCore OnlineEvaluationConfig
fn delete(identifier: string)
Delete a BedrockAgentCore OnlineEvaluationConfig
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore OnlineEvaluationConfig
fn sync()
Sync BedrockAgentCore OnlineEvaluationConfig state from AWS

Resources

state(infinite)— BedrockAgentCore OnlineEvaluationConfig resource state
@swamp/aws/bedrockagentcore/payment-connectorv2026.06.15.1payment_connector.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
PaymentManagerIdstringThe identifier of the parent payment manager
ConnectorNamestringThe name of the payment connector
Description?stringA description of the payment connector
ConnectorTypeenum
CredentialProviderConfigurationsarrayThe credential provider configurations for the connector
fn create()
Create a BedrockAgentCore PaymentConnector
fn get(identifier: string)
Get a BedrockAgentCore PaymentConnector
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore PaymentConnector
fn update()
Update a BedrockAgentCore PaymentConnector
fn delete(identifier: string)
Delete a BedrockAgentCore PaymentConnector
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore PaymentConnector
fn sync()
Sync BedrockAgentCore PaymentConnector state from AWS

Resources

state(infinite)— BedrockAgentCore PaymentConnector resource state
@swamp/aws/bedrockagentcore/payment-credential-providerv2026.06.15.1payment_credential_provider.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringUnique name for the payment credential provider
CredentialProviderVendorenumSupported vendor types for payment providers
ProviderConfigurationInput?objectProvider configuration input containing secrets for creation/update
ProviderConfigurationOutput?objectProvider configuration output containing secret ARNs (no raw secrets)
Tags?arrayTags for the payment credential provider
fn create()
Create a BedrockAgentCore PaymentCredentialProvider
fn get(identifier: string)
Get a BedrockAgentCore PaymentCredentialProvider
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore PaymentCredentialProvider
fn update()
Update a BedrockAgentCore PaymentCredentialProvider
fn delete(identifier: string)
Delete a BedrockAgentCore PaymentCredentialProvider
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore PaymentCredentialProvider
fn sync()
Sync BedrockAgentCore PaymentCredentialProvider state from AWS

Resources

state(infinite)— BedrockAgentCore PaymentCredentialProvider resource state
@swamp/aws/bedrockagentcore/payment-managerv2026.06.15.1payment_manager.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringThe name of the payment manager
Description?stringA description of the payment manager
AuthorizerTypeenum
AuthorizerConfiguration?object
RoleArnstringThe ARN of the IAM role for the payment manager
WorkloadIdentityDetails?object
Tags?arrayTags to assign to the payment manager
fn create()
Create a BedrockAgentCore PaymentManager
fn get(identifier: string)
Get a BedrockAgentCore PaymentManager
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore PaymentManager
fn update()
Update a BedrockAgentCore PaymentManager
fn delete(identifier: string)
Delete a BedrockAgentCore PaymentManager
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore PaymentManager
fn sync()
Sync BedrockAgentCore PaymentManager state from AWS

Resources

state(infinite)— BedrockAgentCore PaymentManager resource state
@swamp/aws/bedrockagentcore/policyv2026.06.18.1policy.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
PolicyEngineIdstringThe identifier of the policy engine which contains this policy.
NamestringThe customer-assigned immutable name for the policy. Must be unique within the policy engine.
DefinitionobjectThe definition structure for policies. Encapsulates different policy formats.
Description?stringA human-readable description of the policy's purpose and functionality.
ValidationMode?enumThe validation mode for the policy. Determines how Cedar analyzer validation results are handled.
EnforcementMode?enumWhether the policy contributes to the enforce decision returned to Gateway. LOG_ONLY policies are still evaluated but their decisions are observed only, allowing customers to validate a policy against real traffic before promoting it.
fn create()
Create a BedrockAgentCore Policy
fn get(identifier: string)
Get a BedrockAgentCore Policy
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Policy
fn update()
Update a BedrockAgentCore Policy
fn delete(identifier: string)
Delete a BedrockAgentCore Policy
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Policy
fn sync()
Sync BedrockAgentCore Policy state from AWS

Resources

state(infinite)— BedrockAgentCore Policy resource state
@swamp/aws/bedrockagentcore/policy-enginev2026.06.15.1policy_engine.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringThe customer-assigned immutable name for the policy engine
Description?stringA human-readable description of the policy engine's purpose and scope
EncryptionKeyArn?stringThe ARN of the KMS key used to encrypt the policy engine data
Tags?arrayA list of tags to assign to the policy engine.
fn create()
Create a BedrockAgentCore PolicyEngine
fn get(identifier: string)
Get a BedrockAgentCore PolicyEngine
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore PolicyEngine
fn update()
Update a BedrockAgentCore PolicyEngine
fn delete(identifier: string)
Delete a BedrockAgentCore PolicyEngine
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore PolicyEngine
fn sync()
Sync BedrockAgentCore PolicyEngine state from AWS

Resources

state(infinite)— BedrockAgentCore PolicyEngine resource state
@swamp/aws/bedrockagentcore/resource-policyv2026.06.15.1resource_policy.ts

Global Arguments

ArgumentTypeDescription
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ResourceArnstringThe Amazon Resource Name (ARN) of the resource for which to create or update the resource policy.
PolicystringThe resource policy to create or update.
fn create()
Create a BedrockAgentCore ResourcePolicy
fn get(identifier: string)
Get a BedrockAgentCore ResourcePolicy
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore ResourcePolicy
fn update()
Update a BedrockAgentCore ResourcePolicy
fn delete(identifier: string)
Delete a BedrockAgentCore ResourcePolicy
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore ResourcePolicy
fn sync()
Sync BedrockAgentCore ResourcePolicy state from AWS

Resources

state(infinite)— BedrockAgentCore ResourcePolicy resource state
@swamp/aws/bedrockagentcore/runtimev2026.07.24.1runtime.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AgentRuntimeNamestringName for a resource
Description?stringDescription of the resource
AgentRuntimeArtifactobjectThe artifact of the agent
RoleArnstringAmazon Resource Name (ARN) of an IAM role
NetworkConfigurationobjectNetwork access configuration for the Agent
ProtocolConfiguration?enumProtocol configuration for the agent runtime
EnvironmentVariables?recordEnvironment variables for the agent runtime
AuthorizerConfiguration?objectAuthorizer configuration for the agent runtime
LifecycleConfiguration?objectLifecycle configuration for managing runtime sessions
RequestHeaderConfiguration?objectConfiguration for HTTP request headers
FilesystemConfigurations?arrayFilesystem configurations for the agent runtime
WorkloadIdentityDetails?objectWorkload identity details for the agent
Tags?recordA map of tag keys and values
fn create()
Create a BedrockAgentCore Runtime
fn get(identifier: string)
Get a BedrockAgentCore Runtime
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Runtime
fn update()
Update a BedrockAgentCore Runtime
fn delete(identifier: string)
Delete a BedrockAgentCore Runtime
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore Runtime
fn sync()
Sync BedrockAgentCore Runtime state from AWS

Resources

state(infinite)— BedrockAgentCore Runtime resource state
@swamp/aws/bedrockagentcore/runtime-endpointv2026.06.15.1runtime_endpoint.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AgentRuntimeIdstringThe ID of the parent Agent Runtime (required for creation)
NamestringThe name of the Agent Runtime Endpoint
AgentRuntimeVersion?stringThe version of the AgentCore Runtime to use for the endpoint.
Description?stringThe description of the AgentCore Runtime endpoint.
Tags?recordA map of tag keys and values
fn create()
Create a BedrockAgentCore RuntimeEndpoint
fn get(identifier: string)
Get a BedrockAgentCore RuntimeEndpoint
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore RuntimeEndpoint
fn update()
Update a BedrockAgentCore RuntimeEndpoint
fn delete(identifier: string)
Delete a BedrockAgentCore RuntimeEndpoint
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore RuntimeEndpoint
fn sync()
Sync BedrockAgentCore RuntimeEndpoint state from AWS

Resources

state(infinite)— BedrockAgentCore RuntimeEndpoint resource state
@swamp/aws/bedrockagentcore/token-vaultv2026.07.17.1token_vault.ts

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
KmsConfiguration?objectThe KMS configuration for the token vault.
fn get(identifier: string)
Get a BedrockAgentCore TokenVault
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore TokenVault
fn sync()
Sync BedrockAgentCore TokenVault state from AWS

Resources

state(infinite)— BedrockAgentCore TokenVault resource state
@swamp/aws/bedrockagentcore/workload-identityv2026.06.15.1workload_identity.ts

Global Arguments

ArgumentTypeDescription
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
NamestringThe name of the workload identity. The name must be unique within your account.
AllowedResourceOauth2ReturnUrls?arrayThe list of allowed OAuth2 return URLs for resources associated with this workload identity.
Tags?arrayAn array of key-value pairs to apply to this resource.
fn create()
Create a BedrockAgentCore WorkloadIdentity
fn get(identifier: string)
Get a BedrockAgentCore WorkloadIdentity
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore WorkloadIdentity
fn update()
Update a BedrockAgentCore WorkloadIdentity
fn delete(identifier: string)
Delete a BedrockAgentCore WorkloadIdentity
ArgumentTypeDescription
identifierstringThe primary identifier of the BedrockAgentCore WorkloadIdentity
fn sync()
Sync BedrockAgentCore WorkloadIdentity state from AWS

Resources

state(infinite)— BedrockAgentCore WorkloadIdentity resource state
03Previous Versions19
2026.07.25.1
2026.07.24.1
  • Updated: runtime
2026.07.20.1
  • Updated: gateway
2026.07.18.3
2026.07.18.2
2026.07.17.1
  • Added: token_vault

Added 1 models

2026.07.16.1
  • Added: code_interpreter

Added 1 models

2026.06.23.1
  • Updated: harness
2026.06.18.1
  • Updated: configuration_bundle, gateway_target, policy
2026.06.17.1
  • Updated: harness
2026.06.15.2
  • Updated: api_key_credential_provider, browser, browser_custom, browser_profile, code_interpreter_custom, configuration_bundle, dataset, evaluator, gateway, gateway_target, harness, memory, oauth2credential_provider, online_evaluation_config, payment_connector, payment_credential_provider, payment_manager, policy, policy_engine, resource_policy, runtime, runtime_endpoint, workload_identity
2026.06.15.1
  • Added: configuration_bundle
  • Updated: online_evaluation_config

Added 1 models

2026.06.09.1
  • Updated: gateway
2026.06.08.2
  • Updated: api_key_credential_provider, browser, browser_custom, browser_profile, code_interpreter_custom, dataset, evaluator, gateway, gateway_target, harness, memory, oauth2credential_provider, online_evaluation_config, payment_connector, payment_credential_provider, payment_manager, policy, policy_engine, resource_policy, runtime, runtime_endpoint, workload_identity
2026.06.06.1
  • Updated: api_key_credential_provider, browser, browser_custom, browser_profile, code_interpreter_custom, dataset, evaluator, gateway, gateway_target, harness, memory, oauth2credential_provider, online_evaluation_config, payment_connector, payment_credential_provider, payment_manager, policy, policy_engine, resource_policy, runtime, runtime_endpoint, workload_identity
2026.06.05.1
  • Added: payment_manager, resource_policy
  • Updated: oauth2credential_provider

Added 2 models

2026.06.04.1
  • Updated: api_key_credential_provider, gateway_target, oauth2credential_provider
2026.06.03.1
  • Added: payment_connector
  • Updated: gateway, gateway_target, payment_credential_provider

Added 1 models

2026.05.27.1
  • Updated: dataset, evaluator, harness
04Stats
A
100 / 100
Downloads
12
Archive size
5.6 MB
Verified by Swamp
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License declared1/1earned
  • Verified public repository2/2earned
05Platforms
06Labels