awslabs / awslabs/agentcore-samples
04-infrastructure-as-code - [Add CDK Example for AgentCore Gateway with OAuth Authentication]
- Dominant language
- Python
- Stars
- 3.4k
- Forks
- 1.3k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 30
Description
## Problem Statement
Currently, the bedrock-agentcore-examples repository lacks CDK examples demonstrating:
- AgentCore Gateway deployment with OAuth authentication
- Integration with Cognito User Pools for OAuth 2.0 client credentials flow
- Dual authentication modes (IAM + OAuth) in a single Gateway
## Proposed Solution
I would like to contribute a CDK example demonstrating AgentCore Gateway with dual authentication:
- **OAuth Authentication**: Cognito User Pool with OAuth 2.0 client credentials flow, integrated via AgentCore Identity
- **IAM Authentication**: Gateway IAM role for direct Lambda invocations
- **Agent Runtime**: Strands-based agent with SigV4 MCP transport and Memory integration
- **Supporting Infrastructure**: API Gateway, Lambda functions, and proper IAM configurations
This would enable developers to integrate both internal tools and external OAuth-protected APIs in a single Gateway.
## Use Case & Workflow
My current implementation demonstrates a real-world IT operations scenario with:
- **IAM-authenticated operations**: Direct Lambda invocations for internal tools (e.g., CRUD operations on DynamoDB)
- **OAuth-authenticated operations**: API Gateway with Cognito authorization for long-running workflows (e.g., Step Functions orchestration)
- **Session continuity**: AgentCore Memory maintains context across multiple interactions
- **Multi-user support**: Proper access control and user separation
This demonstrates the practical application of dual authentication patterns in a production-ready architecture.
## What I Have
I have a working implementation that includes:
- Complete CDK stack with Gateway, Runtime, Memory, and authentication components
- OAuth provider automation and API Gateway integration
- Tested end-to-end with multiple user scenarios
## What I Need Guidance On
Before submitting a PR, I'd like feedback on:
1. **Contribution Scope**: I have a working implementation that could serve two purposes:
- Simplified CDK example for `04-infrastructure-as-code/` (focus on authentication patterns)
- Complete end-to-end use case for `02-use-cases/` (real-world IT operations)
Would contributing both be valuable, or should I focus on one? Happy to adapt based on community needs.
2. **Level of Simplification**: For `04-infrastructure-as-code/`, should Lambda functions be simple "echo" examples (pure infrastructure focus) or include minimal CRUD operations (real workflow)?
3. **Documentation Standards**: Are there specific documentation guidelines or preferred README formats I should follow for infrastructure examples?
## Benefits to Community
This example would help developers:
- Understand Gateway authentication patterns
- Integrate with OAuth-protected external services
- Fully automated CDK deployment of end-to-end AgentCore services
## Environment
- AWS CDK: v2.x
- Python: 3.13
I'm ready to prepare and submit a PR once I get confirmation and guidance on the approach.
Contributor guide
Research direction
Start by reviewing the existing examples under 04-infrastructure-as-code/ and 02-use-cases/ to compare their scope and README conventions. Confirm whether the contribution should target one directory or both, and whether the functions should be echo examples or CRUD workflows. Done means an agreed scope and a tested CDK example covering the selected authentication workflow.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- authentication, cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100