1. Packages
  2. AWS
  3. API Docs
  4. bedrock
  5. AgentcoreApiKeyCredentialProvider
Viewing docs for AWS v7.24.0
published on Tuesday, Mar 31, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

aws.bedrock.AgentcoreApiKeyCredentialProvider

aws logo
Viewing docs for AWS v7.24.0
published on Tuesday, Mar 31, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

    Manages an AWS Bedrock AgentCore API Key Credential Provider. API Key credential providers enable secure authentication with external services that use API key-based authentication for agent runtimes.

    Note: Write-Only argument apiKeyWo is available to use in place of apiKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    Example Usage

    Basic Usage

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.bedrock.AgentcoreApiKeyCredentialProvider("example", {
    name: "example-api-key-provider",
    apiKey: "your-api-key-here",
});

    import pulumi
import pulumi_aws as aws

example = aws.bedrock.AgentcoreApiKeyCredentialProvider("example",
    name="example-api-key-provider",
    api_key="your-api-key-here")

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/bedrock"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bedrock.NewAgentcoreApiKeyCredentialProvider(ctx, "example", &bedrock.AgentcoreApiKeyCredentialProviderArgs{
			Name:   pulumi.String("example-api-key-provider"),
			ApiKey: pulumi.String("your-api-key-here"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Bedrock.AgentcoreApiKeyCredentialProvider("example", new()
    {
        Name = "example-api-key-provider",
        ApiKey = "your-api-key-here",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.bedrock.AgentcoreApiKeyCredentialProvider;
import com.pulumi.aws.bedrock.AgentcoreApiKeyCredentialProviderArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new AgentcoreApiKeyCredentialProvider("example", AgentcoreApiKeyCredentialProviderArgs.builder()
            .name("example-api-key-provider")
            .apiKey("your-api-key-here")
            .build());

    }
}

    resources:
  example:
    type: aws:bedrock:AgentcoreApiKeyCredentialProvider
    properties:
      name: example-api-key-provider
      apiKey: your-api-key-here

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.bedrock.AgentcoreApiKeyCredentialProvider("example", {
    name: "example-api-key-provider",
    apiKeyWo: "your-api-key-here",
    apiKeyWoVersion: 1,
});

    import pulumi
import pulumi_aws as aws

example = aws.bedrock.AgentcoreApiKeyCredentialProvider("example",
    name="example-api-key-provider",
    api_key_wo="your-api-key-here",
    api_key_wo_version=1)

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/bedrock"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bedrock.NewAgentcoreApiKeyCredentialProvider(ctx, "example", &bedrock.AgentcoreApiKeyCredentialProviderArgs{
			Name:            pulumi.String("example-api-key-provider"),
			ApiKeyWo:        pulumi.String("your-api-key-here"),
			ApiKeyWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Bedrock.AgentcoreApiKeyCredentialProvider("example", new()
    {
        Name = "example-api-key-provider",
        ApiKeyWo = "your-api-key-here",
        ApiKeyWoVersion = 1,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.bedrock.AgentcoreApiKeyCredentialProvider;
import com.pulumi.aws.bedrock.AgentcoreApiKeyCredentialProviderArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new AgentcoreApiKeyCredentialProvider("example", AgentcoreApiKeyCredentialProviderArgs.builder()
            .name("example-api-key-provider")
            .apiKeyWo("your-api-key-here")
            .apiKeyWoVersion(1)
            .build());

    }
}

    resources:
  example:
    type: aws:bedrock:AgentcoreApiKeyCredentialProvider
    properties:
      name: example-api-key-provider
      apiKeyWo: your-api-key-here
      apiKeyWoVersion: 1

    Create AgentcoreApiKeyCredentialProvider Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AgentcoreApiKeyCredentialProvider(name: string, args?: AgentcoreApiKeyCredentialProviderArgs, opts?: CustomResourceOptions);
    @overload
def AgentcoreApiKeyCredentialProvider(resource_name: str,
                                      args: Optional[AgentcoreApiKeyCredentialProviderArgs] = None,
                                      opts: Optional[ResourceOptions] = None)

@overload
def AgentcoreApiKeyCredentialProvider(resource_name: str,
                                      opts: Optional[ResourceOptions] = None,
                                      api_key: Optional[str] = None,
                                      api_key_wo: Optional[str] = None,
                                      api_key_wo_version: Optional[int] = None,
                                      name: Optional[str] = None,
                                      region: Optional[str] = None,
                                      tags: Optional[Mapping[str, str]] = None)
    func NewAgentcoreApiKeyCredentialProvider(ctx *Context, name string, args *AgentcoreApiKeyCredentialProviderArgs, opts ...ResourceOption) (*AgentcoreApiKeyCredentialProvider, error)
    public AgentcoreApiKeyCredentialProvider(string name, AgentcoreApiKeyCredentialProviderArgs? args = null, CustomResourceOptions? opts = null)
    public AgentcoreApiKeyCredentialProvider(String name, AgentcoreApiKeyCredentialProviderArgs args)
public AgentcoreApiKeyCredentialProvider(String name, AgentcoreApiKeyCredentialProviderArgs args, CustomResourceOptions options)

    type: aws:bedrock:AgentcoreApiKeyCredentialProvider
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args AgentcoreApiKeyCredentialProviderArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AgentcoreApiKeyCredentialProviderArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AgentcoreApiKeyCredentialProviderArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AgentcoreApiKeyCredentialProviderArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AgentcoreApiKeyCredentialProviderArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var agentcoreApiKeyCredentialProviderResource = new Aws.Bedrock.AgentcoreApiKeyCredentialProvider("agentcoreApiKeyCredentialProviderResource", new()
{
    ApiKey = "string",
    ApiKeyWo = "string",
    ApiKeyWoVersion = 0,
    Name = "string",
    Region = "string",
    Tags = 
    {
        { "string", "string" },
    },
});

    example, err := bedrock.NewAgentcoreApiKeyCredentialProvider(ctx, "agentcoreApiKeyCredentialProviderResource", &bedrock.AgentcoreApiKeyCredentialProviderArgs{
	ApiKey:          pulumi.String("string"),
	ApiKeyWo:        pulumi.String("string"),
	ApiKeyWoVersion: pulumi.Int(0),
	Name:            pulumi.String("string"),
	Region:          pulumi.String("string"),
	Tags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
})

    var agentcoreApiKeyCredentialProviderResource = new AgentcoreApiKeyCredentialProvider("agentcoreApiKeyCredentialProviderResource", AgentcoreApiKeyCredentialProviderArgs.builder()
    .apiKey("string")
    .apiKeyWo("string")
    .apiKeyWoVersion(0)
    .name("string")
    .region("string")
    .tags(Map.of("string", "string"))
    .build());

    agentcore_api_key_credential_provider_resource = aws.bedrock.AgentcoreApiKeyCredentialProvider("agentcoreApiKeyCredentialProviderResource",
    api_key="string",
    api_key_wo="string",
    api_key_wo_version=0,
    name="string",
    region="string",
    tags={
        "string": "string",
    })

    const agentcoreApiKeyCredentialProviderResource = new aws.bedrock.AgentcoreApiKeyCredentialProvider("agentcoreApiKeyCredentialProviderResource", {
    apiKey: "string",
    apiKeyWo: "string",
    apiKeyWoVersion: 0,
    name: "string",
    region: "string",
    tags: {
        string: "string",
    },
});

    type: aws:bedrock:AgentcoreApiKeyCredentialProvider
properties:
    apiKey: string
    apiKeyWo: string
    apiKeyWoVersion: 0
    name: string
    region: string
    tags:
        string: string

    AgentcoreApiKeyCredentialProvider Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AgentcoreApiKeyCredentialProvider resource accepts the following input properties:

    ApiKey string

    API key value. Cannot be used with apiKeyWo. This value will be visible in pulumi preview outputs and logs.

    Write-Only API Key (choose one approach):

    ApiKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Cannot be used with apiKey. Must be used together with apiKeyWoVersion.
    ApiKeyWoVersion int
    Used together with apiKeyWo to trigger an update. Increment this value when an update to apiKeyWo is required.
    Name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Tags Dictionary<string, string>

    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Standard API Key (choose one approach):

    ApiKey string

    API key value. Cannot be used with apiKeyWo. This value will be visible in pulumi preview outputs and logs.

    Write-Only API Key (choose one approach):

    ApiKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Cannot be used with apiKey. Must be used together with apiKeyWoVersion.
    ApiKeyWoVersion int
    Used together with apiKeyWo to trigger an update. Increment this value when an update to apiKeyWo is required.
    Name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Tags map[string]string

    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Standard API Key (choose one approach):

    apiKey String

    API key value. Cannot be used with apiKeyWo. This value will be visible in pulumi preview outputs and logs.

    Write-Only API Key (choose one approach):

    apiKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Cannot be used with apiKey. Must be used together with apiKeyWoVersion.
    apiKeyWoVersion Integer
    Used together with apiKeyWo to trigger an update. Increment this value when an update to apiKeyWo is required.
    name String

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Map<String,String>

    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Standard API Key (choose one approach):

    apiKey string

    API key value. Cannot be used with apiKeyWo. This value will be visible in pulumi preview outputs and logs.

    Write-Only API Key (choose one approach):

    apiKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Cannot be used with apiKey. Must be used together with apiKeyWoVersion.
    apiKeyWoVersion number
    Used together with apiKeyWo to trigger an update. Increment this value when an update to apiKeyWo is required.
    name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags {[key: string]: string}

    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Standard API Key (choose one approach):

    api_key str

    API key value. Cannot be used with apiKeyWo. This value will be visible in pulumi preview outputs and logs.

    Write-Only API Key (choose one approach):

    api_key_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Cannot be used with apiKey. Must be used together with apiKeyWoVersion.
    api_key_wo_version int
    Used together with apiKeyWo to trigger an update. Increment this value when an update to apiKeyWo is required.
    name str

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Mapping[str, str]

    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Standard API Key (choose one approach):

    apiKey String

    API key value. Cannot be used with apiKeyWo. This value will be visible in pulumi preview outputs and logs.

    Write-Only API Key (choose one approach):

    apiKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Cannot be used with apiKey. Must be used together with apiKeyWoVersion.
    apiKeyWoVersion Number
    Used together with apiKeyWo to trigger an update. Increment this value when an update to apiKeyWo is required.
    name String

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Map<String>

    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Standard API Key (choose one approach):

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AgentcoreApiKeyCredentialProvider resource produces the following output properties:

    ApiKeySecretArns List<AgentcoreApiKeyCredentialProviderApiKeySecretArn>
    ARN of the AWS Secrets Manager secret containing the API key.
    CredentialProviderArn string
    ARN of the API Key credential provider.
    Id string
    The provider-assigned unique ID for this managed resource.
    TagsAll Dictionary<string, string>
    A map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    ApiKeySecretArns []AgentcoreApiKeyCredentialProviderApiKeySecretArn
    ARN of the AWS Secrets Manager secret containing the API key.
    CredentialProviderArn string
    ARN of the API Key credential provider.
    Id string
    The provider-assigned unique ID for this managed resource.
    TagsAll map[string]string
    A map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    apiKeySecretArns List<AgentcoreApiKeyCredentialProviderApiKeySecretArn>
    ARN of the AWS Secrets Manager secret containing the API key.
    credentialProviderArn String
    ARN of the API Key credential provider.
    id String
    The provider-assigned unique ID for this managed resource.
    tagsAll Map<String,String>
    A map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    apiKeySecretArns AgentcoreApiKeyCredentialProviderApiKeySecretArn[]
    ARN of the AWS Secrets Manager secret containing the API key.
    credentialProviderArn string
    ARN of the API Key credential provider.
    id string
    The provider-assigned unique ID for this managed resource.
    tagsAll {[key: string]: string}
    A map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    api_key_secret_arns Sequence[AgentcoreApiKeyCredentialProviderApiKeySecretArn]
    ARN of the AWS Secrets Manager secret containing the API key.
    credential_provider_arn str
    ARN of the API Key credential provider.
    id str
    The provider-assigned unique ID for this managed resource.
    tags_all Mapping[str, str]
    A map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    apiKeySecretArns List<Property Map>
    ARN of the AWS Secrets Manager secret containing the API key.
    credentialProviderArn String
    ARN of the API Key credential provider.
    id String
    The provider-assigned unique ID for this managed resource.
    tagsAll Map<String>
    A map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.

    Look up Existing AgentcoreApiKeyCredentialProvider Resource

    Get an existing AgentcoreApiKeyCredentialProvider resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AgentcoreApiKeyCredentialProviderState, opts?: CustomResourceOptions): AgentcoreApiKeyCredentialProvider
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        api_key: Optional[str] = None,
        api_key_secret_arns: Optional[Sequence[AgentcoreApiKeyCredentialProviderApiKeySecretArnArgs]] = None,
        api_key_wo: Optional[str] = None,
        api_key_wo_version: Optional[int] = None,
        credential_provider_arn: Optional[str] = None,
        name: Optional[str] = None,
        region: Optional[str] = None,
        tags: Optional[Mapping[str, str]] = None,
        tags_all: Optional[Mapping[str, str]] = None) -> AgentcoreApiKeyCredentialProvider
    func GetAgentcoreApiKeyCredentialProvider(ctx *Context, name string, id IDInput, state *AgentcoreApiKeyCredentialProviderState, opts ...ResourceOption) (*AgentcoreApiKeyCredentialProvider, error)
    public static AgentcoreApiKeyCredentialProvider Get(string name, Input<string> id, AgentcoreApiKeyCredentialProviderState? state, CustomResourceOptions? opts = null)
    public static AgentcoreApiKeyCredentialProvider get(String name, Output<String> id, AgentcoreApiKeyCredentialProviderState state, CustomResourceOptions options)
    resources:  _:    type: aws:bedrock:AgentcoreApiKeyCredentialProvider    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ApiKey string

    API key value. Cannot be used with apiKeyWo. This value will be visible in pulumi preview outputs and logs.

    Write-Only API Key (choose one approach):

    ApiKeySecretArns List<AgentcoreApiKeyCredentialProviderApiKeySecretArn>
    ARN of the AWS Secrets Manager secret containing the API key.
    ApiKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Cannot be used with apiKey. Must be used together with apiKeyWoVersion.
    ApiKeyWoVersion int
    Used together with apiKeyWo to trigger an update. Increment this value when an update to apiKeyWo is required.
    CredentialProviderArn string
    ARN of the API Key credential provider.
    Name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Tags Dictionary<string, string>

    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Standard API Key (choose one approach):

    TagsAll Dictionary<string, string>
    A map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    ApiKey string

    API key value. Cannot be used with apiKeyWo. This value will be visible in pulumi preview outputs and logs.

    Write-Only API Key (choose one approach):

    ApiKeySecretArns []AgentcoreApiKeyCredentialProviderApiKeySecretArnArgs
    ARN of the AWS Secrets Manager secret containing the API key.
    ApiKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Cannot be used with apiKey. Must be used together with apiKeyWoVersion.
    ApiKeyWoVersion int
    Used together with apiKeyWo to trigger an update. Increment this value when an update to apiKeyWo is required.
    CredentialProviderArn string
    ARN of the API Key credential provider.
    Name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Tags map[string]string

    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Standard API Key (choose one approach):

    TagsAll map[string]string
    A map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    apiKey String

    API key value. Cannot be used with apiKeyWo. This value will be visible in pulumi preview outputs and logs.

    Write-Only API Key (choose one approach):

    apiKeySecretArns List<AgentcoreApiKeyCredentialProviderApiKeySecretArn>
    ARN of the AWS Secrets Manager secret containing the API key.
    apiKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Cannot be used with apiKey. Must be used together with apiKeyWoVersion.
    apiKeyWoVersion Integer
    Used together with apiKeyWo to trigger an update. Increment this value when an update to apiKeyWo is required.
    credentialProviderArn String
    ARN of the API Key credential provider.
    name String

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Map<String,String>

    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Standard API Key (choose one approach):

    tagsAll Map<String,String>
    A map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    apiKey string

    API key value. Cannot be used with apiKeyWo. This value will be visible in pulumi preview outputs and logs.

    Write-Only API Key (choose one approach):

    apiKeySecretArns AgentcoreApiKeyCredentialProviderApiKeySecretArn[]
    ARN of the AWS Secrets Manager secret containing the API key.
    apiKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Cannot be used with apiKey. Must be used together with apiKeyWoVersion.
    apiKeyWoVersion number
    Used together with apiKeyWo to trigger an update. Increment this value when an update to apiKeyWo is required.
    credentialProviderArn string
    ARN of the API Key credential provider.
    name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags {[key: string]: string}

    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Standard API Key (choose one approach):

    tagsAll {[key: string]: string}
    A map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    api_key str

    API key value. Cannot be used with apiKeyWo. This value will be visible in pulumi preview outputs and logs.

    Write-Only API Key (choose one approach):

    api_key_secret_arns Sequence[AgentcoreApiKeyCredentialProviderApiKeySecretArnArgs]
    ARN of the AWS Secrets Manager secret containing the API key.
    api_key_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Cannot be used with apiKey. Must be used together with apiKeyWoVersion.
    api_key_wo_version int
    Used together with apiKeyWo to trigger an update. Increment this value when an update to apiKeyWo is required.
    credential_provider_arn str
    ARN of the API Key credential provider.
    name str

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Mapping[str, str]

    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Standard API Key (choose one approach):

    tags_all Mapping[str, str]
    A map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    apiKey String

    API key value. Cannot be used with apiKeyWo. This value will be visible in pulumi preview outputs and logs.

    Write-Only API Key (choose one approach):

    apiKeySecretArns List<Property Map>
    ARN of the AWS Secrets Manager secret containing the API key.
    apiKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Cannot be used with apiKey. Must be used together with apiKeyWoVersion.
    apiKeyWoVersion Number
    Used together with apiKeyWo to trigger an update. Increment this value when an update to apiKeyWo is required.
    credentialProviderArn String
    ARN of the API Key credential provider.
    name String

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Map<String>

    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Standard API Key (choose one approach):

    tagsAll Map<String>
    A map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.

    Supporting Types

    AgentcoreApiKeyCredentialProviderApiKeySecretArn, AgentcoreApiKeyCredentialProviderApiKeySecretArnArgs

    SecretArn string
    ARN of the secret in AWS Secrets Manager.
    SecretArn string
    ARN of the secret in AWS Secrets Manager.
    secretArn String
    ARN of the secret in AWS Secrets Manager.
    secretArn string
    ARN of the secret in AWS Secrets Manager.
    secret_arn str
    ARN of the secret in AWS Secrets Manager.
    secretArn String
    ARN of the secret in AWS Secrets Manager.

    Import

    Using pulumi import, import Bedrock AgentCore API Key Credential Provider using the provider name. For example:

    $ pulumi import aws:bedrock/agentcoreApiKeyCredentialProvider:AgentcoreApiKeyCredentialProvider example example-api-key-provider

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo
    Viewing docs for AWS v7.24.0
    published on Tuesday, Mar 31, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-aws
      Try Pulumi Cloud free. Your team will thank you.