Amazon Bedrock AgentCore Samples - MCP Server

Resource naming inconsistency between code and IAM policy

In 01-tutorials/01-AgentCore-runtime/02-hosting-MCP-server/hosting_mcp_server.ipynb, the tool_name in Step 5: Create IAM Execution Role is specified as **mcp_server_ac**

This adds the resource in the _GetAgentAccessToken_ section of the IAM policy as:
arn:aws:bedrock-agentcore:{region}:{account_id}:workload-identity-directory/default/workload-identity/mcp_server_ac-*

However, the actual resource being accessed at runtime is:
arn:aws:bedrock-agentcore:{region}:{account_id}:workload-identity-directory/default/workload-identity/mcp_server-*

This causes a 403 error when running the MCP server with the message:
"User: arn:aws:sts::ACCOUNT_ID:assumed-role/agentcore-mcp_server_ac-role/... is not authorized to perform: bedrock-agentcore:GetWorkloadAccessTokenForJWT on resource: arn:aws:bedrock-agentcore:us-east-1:ACCOUNT_ID:workload-identity-directory/default/workload-identity/mcp_server-..."

The workaround is to add a policy with a broader resource pattern, but the code should be updated to ensure consistency.