Alain Krok

feat(agentcore): add identity L2 constructs (#37610) ### Issue # (if applicable) Add L2 CDK constructs for: - https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-bedrockagentcore-oauth2credentialprovider.html - https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-bedrockagentcore-apikeycredentialprovider.html - https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-bedrockagentcore-workloadidentity.html to the agentcore package. Update also the gateway construct to support the credentials providers when configuring outbound auth for a target ### Reason for this change Feature gap ### Description of changes - Updated the existing gateway construct - Added a new folder with the new L2 constructs for identity - BREAKING CHANGE: ICredentialProviderConfig.grantNeededPermissionsToRole parameter renamed from role (IRole) to gateway (IGateway) so the implementation can derive scoped resource ARNs (e.g. workload identity wildcards keyed on gateway name) and attach policies to the gateway's execution role in a single call, rather than requiring callers to pass both separately. ### Describe any new or updated permissions being added Exposed the permissions specific to the identity providers ### Description of how you validated changes - added unit tests - added integration tests - deployed couple of examples: Examples: 1) Created a cdk stack linking against the custom package With: ``` const apiKeyProvider = new agentcore.ApiKeyCredentialProvider(this, 'ApiKeyIdentityTestScoped', { apiKeyCredentialProviderName: 'test-scoped-api-key-provider', apiKey: cdk.SecretValue.unsafePlainText('integ-placeholder-api-key'), tags: { integ: 'gateway-identity-outbound' }, }); const oauthProvider = agentcore.OAuth2CredentialProvider.usingGithub(this, 'OAuthIdentityTestScoped', { oAuth2CredentialProviderName: 'test-scoped-oauth-provider', clientId: 'integ-github-client-id', clientSecret: cdk.SecretValue.unsafePlainText('integ-github-client-secret'), tags: { integ: 'gateway-identity-outbound' }, }); const workloadIdentity = new agentcore.WorkloadIdentity(this, 'WorkloadIdentityTestScoped', { workloadIdentityName: 'test-scoped-workload-identity', tags: { integ: 'workload-identity-outbound' }, }); ``` The following resources are deployed: <img width="1478" height="244" alt="image" src="https://github.com/user-attachments/assets/86dac3a8-2a9b-43c9-8902-53f3f563e6aa" /> 2) Creating a workload identity ``` new agentcore.WorkloadIdentity(this, 'WorkloadIdentity', { workloadIdentityName: 'integ-workload-identity-outbound', tags: { integ: 'workload-identity-outbound' }, }); ``` <img width="1124" height="109" alt="image" src="https://github.com/user-attachments/assets/2ef8b1f7-cf53-4318-ae90-c898f90a7429" /> 3) Deploying a gateway with target ``` const gateway = new agentcore.Gateway(this, 'Gateway', { gatewayName: 'integ-gateway-identity-outbound', description: 'Gateway with OpenAPI targets wired to Token Vault L2 identities', // Inbound IAM avoids default Cognito domain (global uniqueness); this integ focuses on outbound Token Vault auth. authorizerConfiguration: agentcore.GatewayAuthorizer.usingAwsIam(), }); const openApiSchema = agentcore.ApiSchema.fromInline( JSON.stringify({ openapi: '3.0.0', info: { title: 'GatewayIdentityOutboundInteg', version: '1.0.0' }, servers: [{ url: 'https://example.com' }], paths: { '/ping': { get: { operationId: 'ping', responses: { 200: { description: 'ok' } }, }, }, }, }), ); const apiKeyProvider = new agentcore.ApiKeyCredentialProvider(this, 'ApiKeyIdentity', { apiKeyCredentialProviderName: 'integ-gw-outbound-apikey', apiKey: cdk.SecretValue.unsafePlainText('integ-placeholder-api-key'), tags: { integ: 'gateway-identity-outbound' }, }); gateway.addOpenApiTarget('OpenApiApiKeyTarget', { gatewayTargetName: 'integ-openapi-api-key', description: 'OpenAPI target with API key Token Vault identity', apiSchema: openApiSchema, credentialProviderConfigurations: [agentcore.GatewayCredentialProvider.fromApiKeyIdentity(apiKeyProvider)], }); ``` Deploys correctly <img width="995" height="311" alt="image" src="https://github.com/user-attachments/assets/25775657-8ba1-4fe5-84ee-e7497668ca47" /> <img width="1476" height="212" alt="image" src="https://github.com/user-attachments/assets/a5370df9-a446-4db2-b82f-64796478f513" /> <img width="1484" height="178" alt="image" src="https://github.com/user-attachments/assets/a8214ca7-db71-4e4f-80f5-f4d7d727f889" /> ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

feat(agentcore): add agentcore L2 constructs for 1p tools (#35577) ### Issue # (if applicable) Related to https://github.com/aws/aws-cdk-rfcs/issues/785 ### Reason for this change Adding a new alpha package for Amazon Bedrock AgentCore and add support for 1p tools (Browser, Code Interpreter). ### Description of changes - Create a new alpha package - Add L2 constructs for browser, code interpreter - Add documentation - Add tests ### Describe any new or updated permissions being added Using permissions for agent core defined in https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrockagentcore.html ### Description of how you validated changes Unit tests, integration tests, manual tests ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

chore(cdk server): add unit tests (#150) * chore(tests): start adding tests to cdk server * chore(tests): pre-commit * chore(script): remove auto generated file * chore(script): test resources * chore(script): pre-commit * chore(cdk): add server tests * chore(cdk): add tests * chore(cdk): add tests * chore(cdk): add tests * chore(cdk): add tests * chore(cdk): fix check --------- Co-authored-by: Scott Schreckengaust <scottschreckengaust@users.noreply.github.com>

feat(memory): add agentcore memory l2 construct (#35757) ### Issue # (if applicable) Related to https://github.com/aws/aws-cdk-rfcs/pull/825 ### Reason for this change Adding a new alpha package for Amazon Bedrock AgentCore and add support for memory. ### Description of changes - Create a new alpha package - Add L2 constructs for memory - Add documentation - Add tests ### Describe any new or updated permissions being added Using permissions for agent core defined in https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrockagentcore.html ### Description of how you validated changes Unit tests, integration tests, manual tests ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

feat(integ): add basic structure for integ tests (#1138) * feat(integ): add basic structure for integ tests * chore(mcp): precommit * chore(mcp): pyright * chore(mcp): update gitingore * chore(mcp): precommit * chore(tests): move as per new convention * chore(config): move config directly to pyproject * chore(doc): update doc * chore(config): update config * chore(doc): update doc * chore(doc): pr comments * chore(config): simplify toml file --------- Co-authored-by: Laith Al-Saadoon <9553966+theagenticguy@users.noreply.github.com>

feat(agentcore): add new properties for runtime, browser (#36003) ### Issue # (if applicable) Add support for new properties in agentcore alpha package: - Runtime: - [Code Configuration](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrockagentcore-runtime-codeconfiguration.html) (Direct code deployment) - [Lifecycle configuration](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrockagentcore-runtime-lifecycleconfiguration.html) - [Request header configuration](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrockagentcore-runtime-requestheaderconfiguration.html) - Browser: - [Browser signing](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrockagentcore-browsercustom-browsersigning.html) Also fix a warning (@param userPoolClients) in JSDoc due to wrong param name (missing 's') ### Reason for this change Supporting new features ### Description of changes Adding support for new properties, not changing existing implementation ### Describe any new or updated permissions being added Granting permissions on bucket when using code configuration as a runtime artifact ### Description of how you validated changes unit tests, integration tests, manual tests Example: - Deploying a runtime from a zip available in S3: ```ts const agentArtifact = AgentRuntimeArtifact.fromS3({ bucketName: 'XXXXXXXXXX', objectKey: 'deployment_package.zip', }, AgentCoreRuntime.PYTHON_3_13, ['main.py']); const runtime1 = new Runtime(this, 'MinimalRuntime', { runtimeName: 'minimal_runtime', agentRuntimeArtifact: agentArtifact, requestHeaderConfiguration: { allowList: ['X-Amzn-Bedrock-AgentCore-Runtime-Custom-H1'] }, lifecycleConfiguration: { idleRuntimeSessionTimeout: Duration.minutes(10), maxLifetime: Duration.hours(4), }, }); // Grant permission to invoke Bedrock models ... ``` <img width="1062" height="79" alt="image" src="https://github.com/user-attachments/assets/5af7a392-5d31-4e5a-b2c0-b3a2e7fd57b6" /> - Deploying a browser with signing enabled ```ts new BrowserCustom(this, 'Browser', { browserCustomName: 'my-browser', description: 'Strands browser', browserSigning: BrowserSigning.ENABLED, }); ``` <img width="1232" height="339" alt="Screenshot 2025-11-19 at 4 53 22 PM" src="https://github.com/user-attachments/assets/f9906ddb-ed37-4170-8cf9-6d8b08c92a2e" /> ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

feat(bedrock-agentcore-alpha): add support for custom claims and scopes to runtime/gateway authorizers (#36810) ### Issue # (if applicable) Add support for allowed audience to runtime and gateway JWT authorizers see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/inbound-jwt-authorizer.html, as well as https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrockagentcore-runtime-customjwtauthorizerconfiguration.html and https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrockagentcore-gateway-customjwtauthorizerconfiguration.html ### Reason for this change Coverage of missing features ### Description of changes Add missing properties to existing code ### Describe any new or updated permissions being added No changes in perms ### Description of how you validated changes Added unit tests Updated an integ test ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

feat(tools): add a check to verify package name in readme (#1572) * feat(tools): add a check to verify package name in readme * chore(tools): fix false positives * chore(build): pre-commit * chore(readme): update readme * chore(tools): pr comments * chore(build): revert some code and fix bandit * chore(scripts): address pr comments * chore(scripts): update github workflow * chore(scripts): update logic to catch pip issues * chore(scripts): fix false positives * chore(scripts): ignore dependencies * chore(scripts): precommit * chore(scripts): pr commet --------- Co-authored-by: Laith Al-Saadoon <9553966+theagenticguy@users.noreply.github.com>

chore(mcp): update implementation for git-repo and bda mcp servers (#2610) * chore(bda): update implementation * chore(mcp): update git repo implementation * chore(mcp): update git repo implementation * chore(mcp): update git repo implementation * chore(mcp): update git repo implementation

fix(bedrock-agentcore-alpha): empty submodule accidentally exposed and runtime validation fix (#36148) ### Issue # (if applicable) - Remove namespace from gateway perms causing the release of an empty submodule - Add validation logic to ensure no error when unresolved token for duration in runtime - Move files under lib and remove the /agentcore folder ### Reason for this change ### Description of changes ### Describe any new or updated permissions being added ### Description of how you validated changes ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*