fix(bedrock-agentcore-alpha): default Cognito User Pool for AgentCore Gateway is not set up for M2M authentication. #36323

mazyu36 · 2025-12-07T03:04:41Z

Issue # (if applicable)

N/A

Reason for this change

Gateway requires M2M authentication for service-to-service communication. The default Cognito authorizer was missing OAuth 2.0 client credentials flow configuration, making Gateway unusable for its intended purpose.

Description of changes

Updated the default Cognito authorizer configuration to support M2M authentication:

Added Cognito Resource Server with read and write scopes
Enabled OAuth 2.0 client credentials flow in User Pool Client
Created Cognito Domain for OAuth2 token endpoint access
Exposed Cognito resources (userPool, userPoolClient, userPoolDomain, resourceServer) as public properties for Runtime integration

Ref:

Describe any new or updated permissions being added

N/A

Description of how you validated changes

Add unit tests and an integ test.

BREAKING CHANGE: The User Pool Client will be replaced and new Resource Server and Domain resources will be added for existing Gateway stacks using the default Cognito authorizer.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

github-actions · 2025-12-09T10:48:47Z

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	260 ran	260 passed

Test	Result
No test annotations available

View Security Guardian Results

github-actions · 2025-12-09T10:48:49Z

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	260 ran	260 passed

Test	Result
No test annotations available

View Security Guardian Results with resolved templates

alvazjor · 2025-12-16T16:50:58Z

packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/gateway/gateway.ts

+  /**
+   * The Cognito User Pool Domain created for the gateway (if using default Cognito authorizer)
+   */
+  public userPoolDomain?: cognito.UserPoolDomain;


This should be using the interface

Thanks. Fixed.

alvazjor · 2025-12-16T16:51:13Z

packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/gateway/gateway.ts

+  /**
+   * The Cognito Resource Server created for the gateway (if using default Cognito authorizer)
+   */
+  public resourceServer?: cognito.UserPoolResourceServer;


This should be using the interface

alvazjor · 2025-12-16T17:28:34Z

packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/gateway/gateway.ts

+            scopeDescription: 'Read access to gateway tools',
+          }),
+          cognito.OAuthScope.resourceServer(resourceServer, {
+            scopeName: 'write',


By default we give write access? This seems like a potentially risky scenario no?

This follows the AWS documentation configuration. Ref

alvazjor · 2025-12-16T17:32:53Z

I am thinking if instead of having these changes as the default cognito auth, it should be a new type of IGatewayAuthorizerConfig and we find a way to generate the resources needed there within that authorized (the cognito resources I mean). What do you think? What make you select the default auth to include m2m config?

Pull request has been modified.

…fault lifecycleConfiguration values (aws#36379) ### Issue # (if applicable) Closes aws#36376 ### Reason for this change The Runtime construct was incorrectly forcing default lifecycleConfiguration values even when users didn't specify them, causing unwanted lifecycle management settings to be applied and diverging from AWS Bedrock AgentCore API behavior where this configuration is completely optional. ### Description of changes Modified to only set lifecycleConfiguration when explicitly provided by users, instead of forcing default values (idleRuntimeSessionTimeout: 900, maxLifetime: 28800) ### Describe any new or updated permissions being added N/A ### Description of how you validated changes * Updated and verified all existing unit tests pass * Updated integration test snapshots that were affected by the removal of default lifecycle configuration ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) BREAKING CHANGE: Runtime constructs will no longer automatically include lifecycleConfiguration with default values when not explicitly specified by users. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

### Issue # (if applicable) None ### Reason for this change AWS SES now supports for private access via interface VPC endpoint. https://aws.amazon.com/jp/about-aws/whats-new/2025/12/amazon-ses-vpc-api-endpoints/ ### Description of changes Add SES interface VPC endpoints ### Describe any new or updated permissions being added None ### Description of how you validated changes ```console ❯ aws ec2 describe-vpc-endpoint-services --filters Name=service-type,Values=Interface Name=owner,Values=amazon --region us-east-1 --query ServiceNames | grep email "com.amazonaws.us-east-1.email", "com.amazonaws.us-east-1.email-fips", ``` ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

### Issue # (if applicable) Closes #<issue number here>. ### Reason for this change ### Description of changes ### Describe any new or updated permissions being added ### Description of how you validated changes ### Checklist - [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ws#36407) Restrict pull request trigger to specific snapshot files. ### Issue # (if applicable) Closes #<issue number here>. ### Reason for this change ### Description of changes ### Describe any new or updated permissions being added ### Description of how you validated changes ### Checklist - [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

mazyu36 · 2025-12-17T09:24:21Z

@alvazjor
Thank you for your feedback.

AgentCore Gateway is designed for AI agents to connect and invoke tools via MCP endpoints.

https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html

Therefore, M2M authentication is the primary use case for inbound authorization, and the documentation guides users to set up Cognito with M2M authentication. Ref

Use the following procedure to create a Cognito user pool as an inbound identity provider for machine-to-machine authentication with AgentCore Gateway. The following steps will create a user pool, resource server, client credentials, and discovery URL configuration. This setup enables M2M authentication flows for Gateway access.

The current default creates a Cognito User Pool Client for user authentication. While it technically works with AgentCore Gateway, creating a non-primary use case by default could confuse users.

That said, there are several approaches we could take:

Change the default to M2M authentication (current implementation)
Add a property flag to choose between user authentication or M2M authentication
Remove the default Cognito creation entirely

Since this is an alpha module, I thought option 1 would be preferable. However, if we want to minimize impact, option 2 might be better.

What do you think?

alvazjor · 2025-12-23T09:26:16Z

We can go with option 1 for now, being an alpha package, Will review again and add any additional comments if I see something

fix M2M

4375dac

github-actions bot added the p2 label Dec 7, 2025

aws-cdk-automation requested a review from a team December 7, 2025 03:04

github-actions bot added the distinguished-contributor [Pilot] contributed 50+ PRs to the CDK label Dec 7, 2025

mazyu36 changed the title ~~fix(bedrock-agentcore): default Cognito User pool is not set up for M2M authentication.~~ fix(bedrock-agentcore): default Cognito User Pool for AgentCore Gateway is not set up for M2M authentication. Dec 7, 2025

aws-cdk-automation added the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Dec 7, 2025

pahud mentioned this pull request Dec 7, 2025

Failed CodeBuild CI - 32 PR(s) need attention pahud/aws-cdk#17

Open

mazyu36 force-pushed the fix/agentcore-gateway branch 2 times, most recently from f50496f to e7953de Compare December 8, 2025 15:17

update

50a727d

mazyu36 force-pushed the fix/agentcore-gateway branch from e7953de to 50a727d Compare December 9, 2025 08:52

fix

135f748

mazyu36 marked this pull request as ready for review December 9, 2025 10:46

Merge branch 'main' into fix/agentcore-gateway

642efd5

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Dec 9, 2025

alvazjor self-assigned this Dec 9, 2025

alvazjor changed the title ~~fix(bedrock-agentcore): default Cognito User Pool for AgentCore Gateway is not set up for M2M authentication.~~ fix(bedrock-agentcore-alpha): default Cognito User Pool for AgentCore Gateway is not set up for M2M authentication. Dec 9, 2025

kumvprat and others added 2 commits December 9, 2025 14:28

Merge branch 'main' into fix/agentcore-gateway

06716f8

Merge branch 'main' into fix/agentcore-gateway

9fcb0fb

alvazjor previously requested changes Dec 16, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Dec 16, 2025

fix interface

af90846

mazyu36 and others added 4 commits December 17, 2025 17:58

integ update

0f3a1a7

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Dec 17, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(bedrock-agentcore-alpha): default Cognito User Pool for AgentCore Gateway is not set up for M2M authentication. #36323

fix(bedrock-agentcore-alpha): default Cognito User Pool for AgentCore Gateway is not set up for M2M authentication. #36323

mazyu36 commented Dec 7, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Dec 9, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Dec 9, 2025 •

edited

Loading

Uh oh!

alvazjor Dec 16, 2025

Uh oh!

mazyu36 Dec 17, 2025

Uh oh!

alvazjor Dec 16, 2025

Uh oh!

mazyu36 Dec 17, 2025

Uh oh!

alvazjor Dec 16, 2025

Uh oh!

mazyu36 Dec 17, 2025

Uh oh!

alvazjor Dec 23, 2025

Uh oh!

alvazjor commented Dec 16, 2025

Uh oh!

mazyu36 commented Dec 17, 2025

Uh oh!

alvazjor commented Dec 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

fix(bedrock-agentcore-alpha): default Cognito User Pool for AgentCore Gateway is not set up for M2M authentication. #36323

Are you sure you want to change the base?

fix(bedrock-agentcore-alpha): default Cognito User Pool for AgentCore Gateway is not set up for M2M authentication. #36323

Conversation

mazyu36 commented Dec 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

github-actions bot commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alvazjor Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

mazyu36 Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

alvazjor Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

mazyu36 Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

alvazjor Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

mazyu36 Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

alvazjor Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

alvazjor commented Dec 16, 2025

Uh oh!

mazyu36 commented Dec 17, 2025

Uh oh!

alvazjor commented Dec 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

mazyu36 commented Dec 7, 2025 •

edited

Loading

github-actions bot commented Dec 9, 2025 •

edited

Loading

github-actions bot commented Dec 9, 2025 •

edited

Loading