Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. AWS
  4. API Docs
  5. bedrock
  6. AgentcoreApiKeyCredentialProvider
Viewing docs for AWS v7.52.1
published on Wednesday, Oct 28, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

aws.bedrock.AgentcoreApiKeyCredentialProvider

aws logo aws logo
Viewing docs for AWS v7.52.1
published on Wednesday, Oct 28, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

    Manages an AWS Bedrock AgentCore API Key Credential Provider. API Key credential providers enable secure authentication with external services that use API key-based authentication for agent runtimes.

    Note: Write-Only argument apiKeyWo is available to use in place of apiKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    Example Usage

    Basic Usage

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.bedrock.AgentcoreApiKeyCredentialProvider("example", {
    name: "example-api-key-provider",
    apiKey: "your-api-key-here",
});

    import pulumi
import pulumi_aws as aws

example = aws.bedrock.AgentcoreApiKeyCredentialProvider("example",
    name="example-api-key-provider",
    api_key="your-api-key-here")

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/bedrock"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bedrock.NewAgentcoreApiKeyCredentialProvider(ctx, "example", &bedrock.AgentcoreApiKeyCredentialProviderArgs{
			Name:   pulumi.String("example-api-key-provider"),
			ApiKey: pulumi.String("your-api-key-here"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Bedrock.AgentcoreApiKeyCredentialProvider("example", new()
    {
        Name = "example-api-key-provider",
        ApiKey = "your-api-key-here",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.bedrock.AgentcoreApiKeyCredentialProvider;
import com.pulumi.aws.bedrock.AgentcoreApiKeyCredentialProviderArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new AgentcoreApiKeyCredentialProvider("example", AgentcoreApiKeyCredentialProviderArgs.builder()
            .name("example-api-key-provider")
            .apiKey("your-api-key-here")
            .build());

    }
}

    resources:
  example:
    type: aws:bedrock:AgentcoreApiKeyCredentialProvider
    properties:
      name: example-api-key-provider
      apiKey: your-api-key-here

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_bedrock_agentcore_api_key_credential_provider" "example" {
  lifecycle {
    create_before_destroy = true
  }
  name    = "example-api-key-provider"
  api_key = "your-api-key-here"
}

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.bedrock.AgentcoreApiKeyCredentialProvider("example", {
    name: "example-api-key-provider",
    apiKeyWo: "your-api-key-here",
    apiKeyWoVersion: 1,
});

    import pulumi
import pulumi_aws as aws

example = aws.bedrock.AgentcoreApiKeyCredentialProvider("example",
    name="example-api-key-provider",
    api_key_wo="your-api-key-here",
    api_key_wo_version=1)

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/bedrock"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bedrock.NewAgentcoreApiKeyCredentialProvider(ctx, "example", &bedrock.AgentcoreApiKeyCredentialProviderArgs{
			Name:            pulumi.String("example-api-key-provider"),
			ApiKeyWo:        pulumi.String("your-api-key-here"),
			ApiKeyWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Bedrock.AgentcoreApiKeyCredentialProvider("example", new()
    {
        Name = "example-api-key-provider",
        ApiKeyWo = "your-api-key-here",
        ApiKeyWoVersion = 1,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.bedrock.AgentcoreApiKeyCredentialProvider;
import com.pulumi.aws.bedrock.AgentcoreApiKeyCredentialProviderArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new AgentcoreApiKeyCredentialProvider("example", AgentcoreApiKeyCredentialProviderArgs.builder()
            .name("example-api-key-provider")
            .apiKeyWo("your-api-key-here")
            .apiKeyWoVersion(1)
            .build());

    }
}

    resources:
  example:
    type: aws:bedrock:AgentcoreApiKeyCredentialProvider
    properties:
      name: example-api-key-provider
      apiKeyWo: your-api-key-here
      apiKeyWoVersion: 1

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_bedrock_agentcore_api_key_credential_provider" "example" {
  lifecycle {
    create_before_destroy = true
  }
  name               = "example-api-key-provider"
  api_key_wo         = "your-api-key-here"
  api_key_wo_version = 1
}

    Customer-Managed Secret

    Reference an API key already stored in a customer-managed AWS Secrets Manager secret instead of having AgentCore create and manage one.

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.bedrock.AgentcoreApiKeyCredentialProvider("example", {
    apiKeySecretConfig: {
        secretId: exampleAwsSecretsmanagerSecret.id,
        jsonKey: "apiKey",
    },
    name: "example-api-key-provider",
    apiKeySecretSource: "EXTERNAL",
});

    import pulumi
import pulumi_aws as aws

example = aws.bedrock.AgentcoreApiKeyCredentialProvider("example",
    api_key_secret_config={
        "secret_id": example_aws_secretsmanager_secret["id"],
        "json_key": "apiKey",
    },
    name="example-api-key-provider",
    api_key_secret_source="EXTERNAL")

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/bedrock"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bedrock.NewAgentcoreApiKeyCredentialProvider(ctx, "example", &bedrock.AgentcoreApiKeyCredentialProviderArgs{
			ApiKeySecretConfig: &bedrock.AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs{
				SecretId: pulumi.Any(exampleAwsSecretsmanagerSecret.Id),
				JsonKey:  pulumi.String("apiKey"),
			},
			Name:               pulumi.String("example-api-key-provider"),
			ApiKeySecretSource: pulumi.String("EXTERNAL"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Bedrock.AgentcoreApiKeyCredentialProvider("example", new()
    {
        ApiKeySecretConfig = new Aws.Bedrock.Inputs.AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs
        {
            SecretId = exampleAwsSecretsmanagerSecret.Id,
            JsonKey = "apiKey",
        },
        Name = "example-api-key-provider",
        ApiKeySecretSource = "EXTERNAL",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.bedrock.AgentcoreApiKeyCredentialProvider;
import com.pulumi.aws.bedrock.AgentcoreApiKeyCredentialProviderArgs;
import com.pulumi.aws.bedrock.inputs.AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new AgentcoreApiKeyCredentialProvider("example", AgentcoreApiKeyCredentialProviderArgs.builder()
            .apiKeySecretConfig(AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs.builder()
                .secretId(exampleAwsSecretsmanagerSecret.get("id"))
                .jsonKey("apiKey")
                .build())
            .name("example-api-key-provider")
            .apiKeySecretSource("EXTERNAL")
            .build());

    }
}

    resources:
  example:
    type: aws:bedrock:AgentcoreApiKeyCredentialProvider
    properties:
      apiKeySecretConfig:
        secretId: ${exampleAwsSecretsmanagerSecret.id}
        jsonKey: apiKey
      name: example-api-key-provider
      apiKeySecretSource: EXTERNAL

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_bedrock_agentcore_api_key_credential_provider" "example" {
  lifecycle {
    create_before_destroy = true
  }
  api_key_secret_config = {
    secret_id = exampleAwsSecretsmanagerSecret.id
    json_key  = "apiKey"
  }
  name                  = "example-api-key-provider"
  api_key_secret_source = "EXTERNAL"
}

    Create AgentcoreApiKeyCredentialProvider Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AgentcoreApiKeyCredentialProvider(name: string, args?: AgentcoreApiKeyCredentialProviderArgs, opts?: CustomResourceOptions);
    @overload
def AgentcoreApiKeyCredentialProvider(resource_name: str,
                                      args: Optional[AgentcoreApiKeyCredentialProviderArgs] = None,
                                      opts: Optional[ResourceOptions] = None)

@overload
def AgentcoreApiKeyCredentialProvider(resource_name: str,
                                      opts: Optional[ResourceOptions] = None,
                                      api_key: Optional[str] = None,
                                      api_key_secret_config: Optional[AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs] = None,
                                      api_key_secret_source: Optional[str] = None,
                                      api_key_wo: Optional[str] = None,
                                      api_key_wo_version: Optional[int] = None,
                                      name: Optional[str] = None,
                                      region: Optional[str] = None,
                                      tags: Optional[Mapping[str, str]] = None)
    func NewAgentcoreApiKeyCredentialProvider(ctx *Context, name string, args *AgentcoreApiKeyCredentialProviderArgs, opts ...ResourceOption) (*AgentcoreApiKeyCredentialProvider, error)
    public AgentcoreApiKeyCredentialProvider(string name, AgentcoreApiKeyCredentialProviderArgs? args = null, CustomResourceOptions? opts = null)
    public AgentcoreApiKeyCredentialProvider(String name, AgentcoreApiKeyCredentialProviderArgs args)
public AgentcoreApiKeyCredentialProvider(String name, AgentcoreApiKeyCredentialProviderArgs args, CustomResourceOptions options)

    type: aws:bedrock:AgentcoreApiKeyCredentialProvider
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "aws_bedrock_agentcore_api_key_credential_provider" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args AgentcoreApiKeyCredentialProviderArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AgentcoreApiKeyCredentialProviderArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AgentcoreApiKeyCredentialProviderArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AgentcoreApiKeyCredentialProviderArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AgentcoreApiKeyCredentialProviderArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var agentcoreApiKeyCredentialProviderResource = new Aws.Bedrock.AgentcoreApiKeyCredentialProvider("agentcoreApiKeyCredentialProviderResource", new()
{
    ApiKey = "string",
    ApiKeySecretConfig = new Aws.Bedrock.Inputs.AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs
    {
        JsonKey = "string",
        SecretId = "string",
    },
    ApiKeySecretSource = "string",
    ApiKeyWo = "string",
    ApiKeyWoVersion = 0,
    Name = "string",
    Region = "string",
    Tags = 
    {
        { "string", "string" },
    },
});

    example, err := bedrock.NewAgentcoreApiKeyCredentialProvider(ctx, "agentcoreApiKeyCredentialProviderResource", &bedrock.AgentcoreApiKeyCredentialProviderArgs{
	ApiKey: pulumi.String("string"),
	ApiKeySecretConfig: &bedrock.AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs{
		JsonKey:  pulumi.String("string"),
		SecretId: pulumi.String("string"),
	},
	ApiKeySecretSource: pulumi.String("string"),
	ApiKeyWo:           pulumi.String("string"),
	ApiKeyWoVersion:    pulumi.Int(0),
	Name:               pulumi.String("string"),
	Region:             pulumi.String("string"),
	Tags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
})

    resource "aws_bedrock_agentcore_api_key_credential_provider" "agentcoreApiKeyCredentialProviderResource" {
  lifecycle {
    create_before_destroy = true
  }
  api_key = "string"
  api_key_secret_config = {
    json_key  = "string"
    secret_id = "string"
  }
  api_key_secret_source = "string"
  api_key_wo            = "string"
  api_key_wo_version    = 0
  name                  = "string"
  region                = "string"
  tags = {
    "string" = "string"
  }
}

    var agentcoreApiKeyCredentialProviderResource = new AgentcoreApiKeyCredentialProvider("agentcoreApiKeyCredentialProviderResource", AgentcoreApiKeyCredentialProviderArgs.builder()
    .apiKey("string")
    .apiKeySecretConfig(AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs.builder()
        .jsonKey("string")
        .secretId("string")
        .build())
    .apiKeySecretSource("string")
    .apiKeyWo("string")
    .apiKeyWoVersion(0)
    .name("string")
    .region("string")
    .tags(Map.of("string", "string"))
    .build());

    agentcore_api_key_credential_provider_resource = aws.bedrock.AgentcoreApiKeyCredentialProvider("agentcoreApiKeyCredentialProviderResource",
    api_key="string",
    api_key_secret_config={
        "json_key": "string",
        "secret_id": "string",
    },
    api_key_secret_source="string",
    api_key_wo="string",
    api_key_wo_version=0,
    name="string",
    region="string",
    tags={
        "string": "string",
    })

    const agentcoreApiKeyCredentialProviderResource = new aws.bedrock.AgentcoreApiKeyCredentialProvider("agentcoreApiKeyCredentialProviderResource", {
    apiKey: "string",
    apiKeySecretConfig: {
        jsonKey: "string",
        secretId: "string",
    },
    apiKeySecretSource: "string",
    apiKeyWo: "string",
    apiKeyWoVersion: 0,
    name: "string",
    region: "string",
    tags: {
        string: "string",
    },
});

    type: aws:bedrock:AgentcoreApiKeyCredentialProvider
properties:
    apiKey: string
    apiKeySecretConfig:
        jsonKey: string
        secretId: string
    apiKeySecretSource: string
    apiKeyWo: string
    apiKeyWoVersion: 0
    name: string
    region: string
    tags:
        string: string

    AgentcoreApiKeyCredentialProvider Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AgentcoreApiKeyCredentialProvider resource accepts the following input properties:

    ApiKey string
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    ApiKeySecretConfig AgentcoreApiKeyCredentialProviderApiKeySecretConfig
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    ApiKeySecretSource string
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    ApiKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    ApiKeyWoVersion int
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    Name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Tags Dictionary<string, string>
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    ApiKey string
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    ApiKeySecretConfig AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    ApiKeySecretSource string
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    ApiKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    ApiKeyWoVersion int
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    Name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Tags map[string]string
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    api_key string
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    api_key_secret_config object
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    api_key_secret_source string
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    api_key_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    api_key_wo_version number
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags map(string)
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    apiKey String
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    apiKeySecretConfig AgentcoreApiKeyCredentialProviderApiKeySecretConfig
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    apiKeySecretSource String
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    apiKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    apiKeyWoVersion Integer
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    name String

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Map<String,String>
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    apiKey string
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    apiKeySecretConfig AgentcoreApiKeyCredentialProviderApiKeySecretConfig
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    apiKeySecretSource string
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    apiKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    apiKeyWoVersion number
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags {[key: string]: string}
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    api_key str
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    api_key_secret_config AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    api_key_secret_source str
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    api_key_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    api_key_wo_version int
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    name str

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Mapping[str, str]
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    apiKey String
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    apiKeySecretConfig Property Map
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    apiKeySecretSource String
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    apiKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    apiKeyWoVersion Number
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    name String

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Map<String>
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AgentcoreApiKeyCredentialProvider resource produces the following output properties:

    ApiKeySecretArns List<AgentcoreApiKeyCredentialProviderApiKeySecretArn>
    ARN of the AWS Secrets Manager secret containing the API key.
    CredentialProviderArn string
    ARN of the API Key credential provider.
    Id string
    The provider-assigned unique ID for this managed resource.
    TagsAll Dictionary<string, string>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    ApiKeySecretArns []AgentcoreApiKeyCredentialProviderApiKeySecretArn
    ARN of the AWS Secrets Manager secret containing the API key.
    CredentialProviderArn string
    ARN of the API Key credential provider.
    Id string
    The provider-assigned unique ID for this managed resource.
    TagsAll map[string]string
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    api_key_secret_arns list(object)
    ARN of the AWS Secrets Manager secret containing the API key.
    credential_provider_arn string
    ARN of the API Key credential provider.
    id string
    The provider-assigned unique ID for this managed resource.
    tags_all map(string)
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    apiKeySecretArns List<AgentcoreApiKeyCredentialProviderApiKeySecretArn>
    ARN of the AWS Secrets Manager secret containing the API key.
    credentialProviderArn String
    ARN of the API Key credential provider.
    id String
    The provider-assigned unique ID for this managed resource.
    tagsAll Map<String,String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    apiKeySecretArns AgentcoreApiKeyCredentialProviderApiKeySecretArn[]
    ARN of the AWS Secrets Manager secret containing the API key.
    credentialProviderArn string
    ARN of the API Key credential provider.
    id string
    The provider-assigned unique ID for this managed resource.
    tagsAll {[key: string]: string}
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    api_key_secret_arns Sequence[AgentcoreApiKeyCredentialProviderApiKeySecretArn]
    ARN of the AWS Secrets Manager secret containing the API key.
    credential_provider_arn str
    ARN of the API Key credential provider.
    id str
    The provider-assigned unique ID for this managed resource.
    tags_all Mapping[str, str]
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    apiKeySecretArns List<Property Map>
    ARN of the AWS Secrets Manager secret containing the API key.
    credentialProviderArn String
    ARN of the API Key credential provider.
    id String
    The provider-assigned unique ID for this managed resource.
    tagsAll Map<String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.

    Look up Existing AgentcoreApiKeyCredentialProvider Resource

    Get an existing AgentcoreApiKeyCredentialProvider resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AgentcoreApiKeyCredentialProviderState, opts?: CustomResourceOptions): AgentcoreApiKeyCredentialProvider
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        api_key: Optional[str] = None,
        api_key_secret_arns: Optional[Sequence[AgentcoreApiKeyCredentialProviderApiKeySecretArnArgs]] = None,
        api_key_secret_config: Optional[AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs] = None,
        api_key_secret_source: Optional[str] = None,
        api_key_wo: Optional[str] = None,
        api_key_wo_version: Optional[int] = None,
        credential_provider_arn: Optional[str] = None,
        name: Optional[str] = None,
        region: Optional[str] = None,
        tags: Optional[Mapping[str, str]] = None,
        tags_all: Optional[Mapping[str, str]] = None) -> AgentcoreApiKeyCredentialProvider
    func GetAgentcoreApiKeyCredentialProvider(ctx *Context, name string, id IDInput, state *AgentcoreApiKeyCredentialProviderState, opts ...ResourceOption) (*AgentcoreApiKeyCredentialProvider, error)
    public static AgentcoreApiKeyCredentialProvider Get(string name, Input<string> id, AgentcoreApiKeyCredentialProviderState? state, CustomResourceOptions? opts = null)
    public static AgentcoreApiKeyCredentialProvider get(String name, Output<String> id, AgentcoreApiKeyCredentialProviderState state, CustomResourceOptions options)
    resources:  _:    type: aws:bedrock:AgentcoreApiKeyCredentialProvider    get:      id: ${id}
    import {
  to = aws_bedrock_agentcore_api_key_credential_provider.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ApiKey string
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    ApiKeySecretArns List<AgentcoreApiKeyCredentialProviderApiKeySecretArn>
    ARN of the AWS Secrets Manager secret containing the API key.
    ApiKeySecretConfig AgentcoreApiKeyCredentialProviderApiKeySecretConfig
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    ApiKeySecretSource string
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    ApiKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    ApiKeyWoVersion int
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    CredentialProviderArn string
    ARN of the API Key credential provider.
    Name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Tags Dictionary<string, string>
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    TagsAll Dictionary<string, string>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    ApiKey string
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    ApiKeySecretArns []AgentcoreApiKeyCredentialProviderApiKeySecretArnArgs
    ARN of the AWS Secrets Manager secret containing the API key.
    ApiKeySecretConfig AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    ApiKeySecretSource string
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    ApiKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    ApiKeyWoVersion int
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    CredentialProviderArn string
    ARN of the API Key credential provider.
    Name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Tags map[string]string
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    TagsAll map[string]string
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    api_key string
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    api_key_secret_arns list(object)
    ARN of the AWS Secrets Manager secret containing the API key.
    api_key_secret_config object
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    api_key_secret_source string
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    api_key_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    api_key_wo_version number
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    credential_provider_arn string
    ARN of the API Key credential provider.
    name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags map(string)
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tags_all map(string)
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    apiKey String
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    apiKeySecretArns List<AgentcoreApiKeyCredentialProviderApiKeySecretArn>
    ARN of the AWS Secrets Manager secret containing the API key.
    apiKeySecretConfig AgentcoreApiKeyCredentialProviderApiKeySecretConfig
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    apiKeySecretSource String
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    apiKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    apiKeyWoVersion Integer
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    credentialProviderArn String
    ARN of the API Key credential provider.
    name String

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Map<String,String>
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll Map<String,String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    apiKey string
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    apiKeySecretArns AgentcoreApiKeyCredentialProviderApiKeySecretArn[]
    ARN of the AWS Secrets Manager secret containing the API key.
    apiKeySecretConfig AgentcoreApiKeyCredentialProviderApiKeySecretConfig
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    apiKeySecretSource string
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    apiKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    apiKeyWoVersion number
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    credentialProviderArn string
    ARN of the API Key credential provider.
    name string

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags {[key: string]: string}
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll {[key: string]: string}
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    api_key str
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    api_key_secret_arns Sequence[AgentcoreApiKeyCredentialProviderApiKeySecretArnArgs]
    ARN of the AWS Secrets Manager secret containing the API key.
    api_key_secret_config AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    api_key_secret_source str
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    api_key_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    api_key_wo_version int
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    credential_provider_arn str
    ARN of the API Key credential provider.
    name str

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Mapping[str, str]
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tags_all Mapping[str, str]
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    apiKey String
    API key value. Exactly one of apiKey, apiKeySecretConfig, or apiKeyWo must be set. This value is stored in plain text in the Terraform state; use apiKeyWo to avoid this.
    apiKeySecretArns List<Property Map>
    ARN of the AWS Secrets Manager secret containing the API key.
    apiKeySecretConfig Property Map
    Reference to a customer-managed AWS Secrets Manager secret that stores the API key. Requires apiKeySecretSource = "EXTERNAL". See below.
    apiKeySecretSource String
    Source of the secret backing the credential provider. Valid values are MANAGED (AgentCore creates and manages the secret from the supplied apiKey) and EXTERNAL (the provider references a customer-managed AWS Secrets Manager secret via apiKeySecretConfig). Changing between MANAGED and EXTERNAL forces replacement of the resource.
    apiKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Write-only API key value. Conflicts with apiKey and apiKeySecretConfig. If set, requires apiKeyWoVersion to be set.
    apiKeyWoVersion Number
    Version used together with the write-only API key. Required when apiKeyWo is set. Changing this value triggers an update to apiKeyWo.
    credentialProviderArn String
    ARN of the API Key credential provider.
    name String

    Name of the API Key credential provider. Forces replacement when changed.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    tags Map<String>
    Key-value map of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll Map<String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.

    Supporting Types

    AgentcoreApiKeyCredentialProviderApiKeySecretArn, AgentcoreApiKeyCredentialProviderApiKeySecretArnArgs

    SecretArn string
    ARN of the secret in AWS Secrets Manager.
    SecretArn string
    ARN of the secret in AWS Secrets Manager.
    secret_arn string
    ARN of the secret in AWS Secrets Manager.
    secretArn String
    ARN of the secret in AWS Secrets Manager.
    secretArn string
    ARN of the secret in AWS Secrets Manager.
    secret_arn str
    ARN of the secret in AWS Secrets Manager.
    secretArn String
    ARN of the secret in AWS Secrets Manager.

    AgentcoreApiKeyCredentialProviderApiKeySecretConfig, AgentcoreApiKeyCredentialProviderApiKeySecretConfigArgs

    JsonKey string
    JSON key used to extract the secret value from the AWS Secrets Manager secret.
    SecretId string
    ID of the AWS Secrets Manager secret that stores the secret value.
    JsonKey string
    JSON key used to extract the secret value from the AWS Secrets Manager secret.
    SecretId string
    ID of the AWS Secrets Manager secret that stores the secret value.
    json_key string
    JSON key used to extract the secret value from the AWS Secrets Manager secret.
    secret_id string
    ID of the AWS Secrets Manager secret that stores the secret value.
    jsonKey String
    JSON key used to extract the secret value from the AWS Secrets Manager secret.
    secretId String
    ID of the AWS Secrets Manager secret that stores the secret value.
    jsonKey string
    JSON key used to extract the secret value from the AWS Secrets Manager secret.
    secretId string
    ID of the AWS Secrets Manager secret that stores the secret value.
    json_key str
    JSON key used to extract the secret value from the AWS Secrets Manager secret.
    secret_id str
    ID of the AWS Secrets Manager secret that stores the secret value.
    jsonKey String
    JSON key used to extract the secret value from the AWS Secrets Manager secret.
    secretId String
    ID of the AWS Secrets Manager secret that stores the secret value.

    Import

    Identity Schema

    Required

    • name (String) API key credential provider name.

    Optional

    • accountId (String) AWS Account where this resource is managed.
    • region (String) Region where this resource is managed.

    Using pulumi import, import Bedrock AgentCore API Key Credential Provider using the provider name. For example:

    $ pulumi import aws:bedrock/agentcoreApiKeyCredentialProvider:AgentcoreApiKeyCredentialProvider example example-api-key-provider

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo aws logo
    Viewing docs for AWS v7.52.1
    published on Wednesday, Oct 28, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-aws

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial