aws_bedrockagentcore: Support creation of HTTP Gateway Target (AgentCore Runtime) with JWT_PASSTHROUGH via CDK

[dvs001-ifs]

Describe the feature

We want to deploy this pattern via CDK:

Consumer → Gateway (CUSTOM_JWT, Cognito OIDC) → HTTP Target → AgentCore Runtime

The boto3 API supports this (confirmed working, botocore 1.43+):

control.create_gateway_target(
    gatewayIdentifier=gateway_id,
    name="my-agent",
    targetConfiguration={
        "http": {"agentcoreRuntime": {"arn": "<runtime-arn>", "qualifier": "DEFAULT"}}
    },
    credentialProviderConfigurations=[
        {"credentialProviderType": "JWT_PASSTHROUGH"}
    ],
)

We cannot find a way to achieve this with the CDK L2 (aws_cdk.aws_bedrockagentcore):

1. No add_http_target() / GatewayTarget.for_http()

   • Only Lambda, MCP Server, OpenAPI, Smithy, API Gateway targets exist

2. No GatewayCredentialProvider.from_jwt_passthrough()

   • Only from_iam_role(), from_oauth_identity(), from_api_key_identity() exist

3. Gateway L2 always emits ProtocolType: MCP, which causes:
   "HTTP target configuration is not supported for gateways with MCP protocol type"

   • Per docs (gateway-create-api.html): "If you omit this field, the gateway
     can have both MCP and HTTP targets"

Similarly the CloudFormation L1 (AWS::BedrockAgentCore::GatewayTarget) rejects:

• "Http" in TargetConfigurationProperty (only "Mcp" accepted)
• "JWT_PASSTHROUGH" in CredentialProviderType enum

Is there a supported CDK/CloudFormation path for this use case that we're
missing? If not, please consider adding:

1. gateway.add_http_target() for targetConfiguration.http.agentcoreRuntime
2. GatewayCredentialProvider.from_jwt_passthrough()
3. Option to omit ProtocolType (so gateway accepts both MCP + HTTP targets)
4. CFN schema update: Http target type, JWT_PASSTHROUGH enum value

Use Case

To support IaC via CDK.
The AWS Console and botocre library supports this features.
Attaching a spike test script that shows how we can achieve this using botocre sdk.

spike_gateway_jwt_redacted.py

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS CDK Library version (aws-cdk-lib)

2.257.0

AWS CDK CLI version

2.1115.0

Environment details (OS name and version, etc.)

Mac

[matheuscanela]

+1