AWS Bedrock Core Gateway - Lambda Interceptor for custom headers

When working with AWS Bedrock AgentCore Gateway interceptors for custom authentication, there are a few key considerations to understand.

Gateway interceptors provide a way to implement custom authentication logic through Lambda functions. For your use case of passing custom authentication headers to targets, you can use a request interceptor to transform the request before it reaches the target.

To pass request headers to your interceptor Lambda function, you need to explicitly enable this by setting the passRequestHeaders parameter to true in your gateway configuration. This allows your interceptor to access the original request headers, including authentication tokens.

Here's how you can implement a solution:

1. Configure your gateway with a request interceptor that has passRequestHeaders set to true.
2. In your Lambda interceptor, extract the authentication information from the incoming request.
3. Transform the request to include your custom authentication header in the format required by your target.

For example, your Lambda interceptor could look something like this:

def lambda_handler(event, context):
# Extract the gateway request
mcp_data = event.get('mcp', {})
gateway_request = mcp_data.get('gatewayRequest', {})
headers = gateway_request.get('headers', {})
body = gateway_request.get('body', {})

# Extract auth header or generate custom auth token
auth_header = headers.get('authorization', '') or headers.get('Authorization', '')

# Return transformed request with custom auth header
response = {
"interceptorOutputVersion": "1.0",
"mcp": {
"transformedGatewayRequest": {
"headers": {
"Accept": "application/json",
"auth": auth_header,  # Your custom auth header
"Content-Type": "application/json"
},
"body": body
}
}
}
return response

When implementing this approach, be aware of security best practices:

• Be careful with handling sensitive information in headers
• Ensure your gateway execution role has only the necessary permissions
• Implement idempotent Lambda functions for your interceptors

While AgentCore Gateway does require configuring outbound auth methods like OAuth or API Key for targets, the interceptor approach allows you to dynamically modify the authentication information before it reaches the target, giving you more flexibility than the static configurations alone.
Sources
Apply fine-grained access control with Bedrock AgentCore Gateway interceptors | Artificial Intelligence
Configuration - Amazon Bedrock AgentCore
Using interceptors with Gateway - Amazon Bedrock AgentCore