@aws/nx-plugin 1.0.0-rc.59 → 1.0.0-rc.60

package/migrations.json

@@ -7,11 +7,26 @@
       "description": "Add agent runtime target support to the vended AgentCoreGateway construct and an agentName member to vended agent constructs",
       "implementation": "./src/migrations/latest/gateway-agent-targets/migration"
     },
+    "latest-gateway-cognito-passthrough": {
+      "version": "1.0.0-rc.60",
+      "description": "Front Cognito agents with an AgentCore Gateway via JWT passthrough: addAgent picks the target credential from the agent's auth, agent constructs gain an auth member, and Cognito runtimes allowlist the Authorization header",
+      "implementation": "./src/migrations/latest/gateway-cognito-passthrough/migration"
+    },
     "latest-smithy-ssdk-bundle-pins": {
       "version": "1.0.0-rc.58",
       "description": "Bump the rolldown and dts plugin pins in the Smithy build.Dockerfile so the bundled SSDK type declaration resolves",
       "implementation": "./src/migrations/latest/smithy-ssdk-bundle-pins/migration"
     },
+    "latest-strip-pip-from-python-images": {
+      "version": "1.0.0-rc.60",
+      "description": "Remove pip from vended Python agent / MCP server images so its vulnerable vendored packages are not present at runtime",
+      "implementation": "./src/migrations/latest/strip-pip-from-python-images/migration"
+    },
+    "latest-waf-log-group-removal": {
+      "version": "1.0.0-rc.60",
+      "description": "Set RemovalPolicy.DESTROY on WAF log groups in the vended AgentCoreGateway and REST API constructs so a rolled-back deploy does not orphan them",
+      "implementation": "./src/migrations/latest/waf-log-group-removal/migration"
+    },
     "v1.0.0-rc.50-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -53,14 +68,14 @@
       "implementation": "./src/migrations/v1.0.0-rc.57/ts-agent-session-management-support/migration"
     },
     "sync-vended-versions": {
-      "version": "1.0.0-rc.59",
+      "version": "1.0.0-rc.60",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }
   },
   "packageJsonUpdates": {
     "nx-23.1.1-nx-packages": {
-      "version": "1.0.0-rc.59",
+      "version": "1.0.0-rc.60",
       "packages": {
         "nx": {
           "version": "23.1.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.59",
+  "version": "1.0.0-rc.60",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/agentcore-gateway/agent-connection/generator.js

@@ -55,8 +55,13 @@ export const AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO = getGeneratorInf
     if (!supportedProtocols.includes(agentProtocol)) {
         throw new Error(`Agent '${agentComponent.name}' uses protocol='${agentProtocol}', which cannot be fronted by a gateway` + (agentGenerator === 'ts#agent' && agentProtocol === 'http' ? ` — a TypeScript HTTP agent serves tRPC over WebSocket, and AgentCore Gateway does not support WebSocket streaming. Consider the ag-ui protocol instead.` : `. Supported protocols: ${supportedProtocols.join(', ')}.`));
     }
-    if (agentComponent.auth && agentComponent.auth !== 'iam') {
-        throw new Error(`Agent '${agentComponent.name}' uses auth='${agentComponent.auth}'. Gateway->agent connections currently require the agent to use IAM authentication.`);
+    // Both IAM and Cognito agents can be fronted. An IAM agent is invoked with
+    // the gateway's own role (GATEWAY_IAM_ROLE); a Cognito agent has the caller's
+    // JWT forwarded to it (JWT_PASSTHROUGH) so it authorizes on the token. The
+    // vended `addAgent` picks the credential from the agent's `auth`.
+    const agentAuth = agentComponent.auth ?? 'iam';
+    if (agentAuth !== 'iam' && agentAuth !== 'cognito') {
+        throw new Error(`Agent '${agentComponent.name}' uses auth='${agentAuth}', which a gateway cannot front. Supported: iam, cognito.`);
     }
     // The target name must match what the deployed Gateway uses (`agentName` on
     // the agent construct, derived from the project's class name) so the

package/src/agentcore-gateway/agent-connection/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/agentcore-gateway/agent-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { GeneratorCallback, Tree } from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport {\n  addComponentGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { attachAgentToLocalGateway } from '../attach-upstream';\nimport { readAgentCoreGatewayMetadata } from '../generator';\nimport type { AgentcoreGatewayAgentConnectionGeneratorSchema } from './schema';\n\nexport const AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * The agent protocols an http gateway can front, by agent language. The\n * gateway proxies plain HTTP request/response and SSE streams:\n *\n * - `ag-ui` (ts + py) and `http` (py) serve POST /invocations with streamed\n *   responses, which proxy cleanly.\n * - `a2a` (ts + py) is JSON-RPC over POST, which AgentCore applies a default\n *   schema for.\n * - `http` (ts) is tRPC over WebSocket, and the gateway does not support\n *   WebSocket / bidirectional streaming, so it cannot sit behind one.\n */\nconst SUPPORTED_AGENT_PROTOCOLS: Record<string, string[]> = {\n  'ts#agent': ['ag-ui', 'a2a'],\n  'py#agent': ['ag-ui', 'http', 'a2a'],\n};\n\n/**\n * Connect an AgentCore Gateway to an agent, so the agent is added as a\n * gateway target and served under `<gatewayUrl>/<targetName>/invocations`.\n *\n * Chains the gateway's dev target to the agent's dev target, and registers\n * the agent in the gateway's local-dev.ts so the local gateway proxies to it.\n * Users must still call `gateway.addAgent(...)` in their application stack to\n * create the actual CDK/Terraform resource.\n */\nexport const agentcoreGatewayAgentConnectionGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayAgentConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const gateway = readAgentCoreGatewayMetadata(sourceProject);\n  const agentComponent = options.targetComponent;\n\n  if (!agentComponent) {\n    throw new Error(\n      `Target project '${options.targetProject}' has no agent component metadata. Did you run the 'ts#agent' or 'py#agent' generator?`,\n    );\n  }\n\n  if (gateway.protocol !== 'http') {\n    throw new Error(\n      `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Agent targets can only be attached to http-protocol gateways — generate one with the 'agentcore-gateway' generator and --protocol=http.`,\n    );\n  }\n\n  const agentGenerator = agentComponent.generator ?? 'ts#agent';\n  const agentProtocol = (\n    (agentComponent.protocol as string | undefined) ?? 'http'\n  ).toLowerCase();\n  const supportedProtocols = SUPPORTED_AGENT_PROTOCOLS[agentGenerator] ?? [];\n  if (!supportedProtocols.includes(agentProtocol)) {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses protocol='${agentProtocol}', which cannot be fronted by a gateway` +\n        (agentGenerator === 'ts#agent' && agentProtocol === 'http'\n          ? ` — a TypeScript HTTP agent serves tRPC over WebSocket, and AgentCore Gateway does not support WebSocket streaming. Consider the ag-ui protocol instead.`\n          : `. Supported protocols: ${supportedProtocols.join(', ')}.`),\n    );\n  }\n  if (agentComponent.auth && agentComponent.auth !== 'iam') {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses auth='${agentComponent.auth}'. Gateway->agent connections currently require the agent to use IAM authentication.`,\n    );\n  }\n\n  // The target name must match what the deployed Gateway uses (`agentName` on\n  // the agent construct, derived from the project's class name) so the\n  // `/<target>/invocations` path resolves identically locally and deployed.\n  const agentComponentName = agentComponent.name ?? 'agent';\n  const agentTargetName = kebabCase(\n    (agentComponent.rc as string | undefined) ??\n      toClassName(agentComponentName),\n  );\n\n  await attachAgentToLocalGateway(tree, sourceProject, 'dev', {\n    targetName: agentTargetName,\n    port: (agentComponent.port as number | undefined) ?? 8081,\n    upstreamProjectName: targetProject.name,\n    upstreamDevTargetName: `${agentComponentName}-dev`,\n    // The deployed gateway maps an A2A target's `/invocations/...` paths onto\n    // the agent container's root; HTTP and AG-UI agents serve /invocations\n    // themselves.\n    stripInvocations: agentProtocol === 'a2a',\n  });\n\n  // Recorded so the version sync can identify this connection.\n  addComponentGeneratorMetadata(\n    tree,\n    sourceProject.name,\n    AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO,\n    targetProject.root,\n    agentTargetName,\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default agentcoreGatewayAgentConnectionGenerator;\n"],"names":["formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","addComponentGeneratorMetadata","getGeneratorInfo","readProjectConfigurationUnqualified","attachAgentToLocalGateway","readAgentCoreGatewayMetadata","AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO","filename","SUPPORTED_AGENT_PROTOCOLS","agentcoreGatewayAgentConnectionGenerator","tree","options","sourceProject","targetProject","gateway","agentComponent","targetComponent","Error","protocol","name","agentGenerator","generator","agentProtocol","toLowerCase","supportedProtocols","includes","join","auth","agentComponentName","agentTargetName","rc","targetName","port","upstreamProjectName","upstreamDevTargetName","stripInvocations","root","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GAED,SAASA,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SACEC,6BAA6B,EAC7BC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,yBAAyB,QAAQ,wBAAqB;AAC/D,SAASC,4BAA4B,QAAQ,kBAAe;AAG5D,OAAO,MAAMC,oDACXJ,iBAAiB,YAAYK,QAAQ,EAAE;AAEzC;;;;;;;;;;CAUC,GACD,MAAMC,4BAAsD;IAC1D,YAAY;QAAC;QAAS;KAAM;IAC5B,YAAY;QAAC;QAAS;QAAQ;KAAM;AACtC;AAEA;;;;;;;;CAQC,GACD,OAAO,MAAMC,2CAA2C,OACtDC,MACAC;IAEA,MAAMC,gBAAgBT,oCACpBO,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBV,oCACpBO,MACAC,QAAQE,aAAa;IAGvB,MAAMC,UAAUT,6BAA6BO;IAC7C,MAAMG,iBAAiBJ,QAAQK,eAAe;IAE9C,IAAI,CAACD,gBAAgB;QACnB,MAAM,IAAIE,MACR,CAAC,gBAAgB,EAAEN,QAAQE,aAAa,CAAC,sFAAsF,CAAC;IAEpI;IAEA,IAAIC,QAAQI,QAAQ,KAAK,QAAQ;QAC/B,MAAM,IAAID,MACR,CAAC,SAAS,EAAEH,QAAQK,IAAI,CAAC,gBAAgB,EAAEL,QAAQI,QAAQ,CAAC,0IAA0I,CAAC;IAE3M;IAEA,MAAME,iBAAiBL,eAAeM,SAAS,IAAI;IACnD,MAAMC,gBAAgB,AACpB,CAAA,AAACP,eAAeG,QAAQ,IAA2B,MAAK,EACxDK,WAAW;IACb,MAAMC,qBAAqBhB,yBAAyB,CAACY,eAAe,IAAI,EAAE;IAC1E,IAAI,CAACI,mBAAmBC,QAAQ,CAACH,gBAAgB;QAC/C,MAAM,IAAIL,MACR,CAAC,OAAO,EAAEF,eAAeI,IAAI,CAAC,iBAAiB,EAAEG,cAAc,uCAAuC,CAAC,GACpGF,CAAAA,mBAAmB,cAAcE,kBAAkB,SAChD,CAAC,uJAAuJ,CAAC,GACzJ,CAAC,uBAAuB,EAAEE,mBAAmBE,IAAI,CAAC,MAAM,CAAC,CAAC,AAAD;IAEnE;IACA,IAAIX,eAAeY,IAAI,IAAIZ,eAAeY,IAAI,KAAK,OAAO;QACxD,MAAM,IAAIV,MACR,CAAC,OAAO,EAAEF,eAAeI,IAAI,CAAC,aAAa,EAAEJ,eAAeY,IAAI,CAAC,oFAAoF,CAAC;IAE1J;IAEA,4EAA4E;IAC5E,qEAAqE;IACrE,0EAA0E;IAC1E,MAAMC,qBAAqBb,eAAeI,IAAI,IAAI;IAClD,MAAMU,kBAAkB9B,UACtB,AAACgB,eAAee,EAAE,IAChB9B,YAAY4B;IAGhB,MAAMxB,0BAA0BM,MAAME,eAAe,OAAO;QAC1DmB,YAAYF;QACZG,MAAM,AAACjB,eAAeiB,IAAI,IAA2B;QACrDC,qBAAqBpB,cAAcM,IAAI;QACvCe,uBAAuB,GAAGN,mBAAmB,IAAI,CAAC;QAClD,0EAA0E;QAC1E,uEAAuE;QACvE,cAAc;QACdO,kBAAkBb,kBAAkB;IACtC;IAEA,6DAA6D;IAC7DrB,8BACES,MACAE,cAAcO,IAAI,EAClBb,mDACAO,cAAcuB,IAAI,EAClBP;IAGF,MAAM/B,gCAAgCY,MAAM;QAC1CJ;KACD;IAED,MAAMV,qBAAqBc;IAE3B,OAAO,IACLb,oBAAoBa,MAAMC,QAAQ0B,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe7B,yCAAyC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/agentcore-gateway/agent-connection/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { GeneratorCallback, Tree } from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { kebabCase, toClassName } from '../../utils/names';\nimport {\n  addComponentGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx';\nimport { attachAgentToLocalGateway } from '../attach-upstream';\nimport { readAgentCoreGatewayMetadata } from '../generator';\nimport type { AgentcoreGatewayAgentConnectionGeneratorSchema } from './schema';\n\nexport const AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO: NxGeneratorInfo =\n  getGeneratorInfo(import.meta.filename);\n\n/**\n * The agent protocols an http gateway can front, by agent language. The\n * gateway proxies plain HTTP request/response and SSE streams:\n *\n * - `ag-ui` (ts + py) and `http` (py) serve POST /invocations with streamed\n *   responses, which proxy cleanly.\n * - `a2a` (ts + py) is JSON-RPC over POST, which AgentCore applies a default\n *   schema for.\n * - `http` (ts) is tRPC over WebSocket, and the gateway does not support\n *   WebSocket / bidirectional streaming, so it cannot sit behind one.\n */\nconst SUPPORTED_AGENT_PROTOCOLS: Record<string, string[]> = {\n  'ts#agent': ['ag-ui', 'a2a'],\n  'py#agent': ['ag-ui', 'http', 'a2a'],\n};\n\n/**\n * Connect an AgentCore Gateway to an agent, so the agent is added as a\n * gateway target and served under `<gatewayUrl>/<targetName>/invocations`.\n *\n * Chains the gateway's dev target to the agent's dev target, and registers\n * the agent in the gateway's local-dev.ts so the local gateway proxies to it.\n * Users must still call `gateway.addAgent(...)` in their application stack to\n * create the actual CDK/Terraform resource.\n */\nexport const agentcoreGatewayAgentConnectionGenerator = async (\n  tree: Tree,\n  options: AgentcoreGatewayAgentConnectionGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const sourceProject = readProjectConfigurationUnqualified(\n    tree,\n    options.sourceProject,\n  );\n  const targetProject = readProjectConfigurationUnqualified(\n    tree,\n    options.targetProject,\n  );\n\n  const gateway = readAgentCoreGatewayMetadata(sourceProject);\n  const agentComponent = options.targetComponent;\n\n  if (!agentComponent) {\n    throw new Error(\n      `Target project '${options.targetProject}' has no agent component metadata. Did you run the 'ts#agent' or 'py#agent' generator?`,\n    );\n  }\n\n  if (gateway.protocol !== 'http') {\n    throw new Error(\n      `Gateway '${gateway.name}' has protocol='${gateway.protocol}'. Agent targets can only be attached to http-protocol gateways — generate one with the 'agentcore-gateway' generator and --protocol=http.`,\n    );\n  }\n\n  const agentGenerator = agentComponent.generator ?? 'ts#agent';\n  const agentProtocol = (\n    (agentComponent.protocol as string | undefined) ?? 'http'\n  ).toLowerCase();\n  const supportedProtocols = SUPPORTED_AGENT_PROTOCOLS[agentGenerator] ?? [];\n  if (!supportedProtocols.includes(agentProtocol)) {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses protocol='${agentProtocol}', which cannot be fronted by a gateway` +\n        (agentGenerator === 'ts#agent' && agentProtocol === 'http'\n          ? ` — a TypeScript HTTP agent serves tRPC over WebSocket, and AgentCore Gateway does not support WebSocket streaming. Consider the ag-ui protocol instead.`\n          : `. Supported protocols: ${supportedProtocols.join(', ')}.`),\n    );\n  }\n  // Both IAM and Cognito agents can be fronted. An IAM agent is invoked with\n  // the gateway's own role (GATEWAY_IAM_ROLE); a Cognito agent has the caller's\n  // JWT forwarded to it (JWT_PASSTHROUGH) so it authorizes on the token. The\n  // vended `addAgent` picks the credential from the agent's `auth`.\n  const agentAuth = (agentComponent.auth as string | undefined) ?? 'iam';\n  if (agentAuth !== 'iam' && agentAuth !== 'cognito') {\n    throw new Error(\n      `Agent '${agentComponent.name}' uses auth='${agentAuth}', which a gateway cannot front. Supported: iam, cognito.`,\n    );\n  }\n\n  // The target name must match what the deployed Gateway uses (`agentName` on\n  // the agent construct, derived from the project's class name) so the\n  // `/<target>/invocations` path resolves identically locally and deployed.\n  const agentComponentName = agentComponent.name ?? 'agent';\n  const agentTargetName = kebabCase(\n    (agentComponent.rc as string | undefined) ??\n      toClassName(agentComponentName),\n  );\n\n  await attachAgentToLocalGateway(tree, sourceProject, 'dev', {\n    targetName: agentTargetName,\n    port: (agentComponent.port as number | undefined) ?? 8081,\n    upstreamProjectName: targetProject.name,\n    upstreamDevTargetName: `${agentComponentName}-dev`,\n    // The deployed gateway maps an A2A target's `/invocations/...` paths onto\n    // the agent container's root; HTTP and AG-UI agents serve /invocations\n    // themselves.\n    stripInvocations: agentProtocol === 'a2a',\n  });\n\n  // Recorded so the version sync can identify this connection.\n  addComponentGeneratorMetadata(\n    tree,\n    sourceProject.name,\n    AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO,\n    targetProject.root,\n    agentTargetName,\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [\n    AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO,\n  ]);\n\n  await formatFilesInSubtree(tree);\n\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default agentcoreGatewayAgentConnectionGenerator;\n"],"names":["formatFilesInSubtree","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","toClassName","addComponentGeneratorMetadata","getGeneratorInfo","readProjectConfigurationUnqualified","attachAgentToLocalGateway","readAgentCoreGatewayMetadata","AGENTCORE_GATEWAY_AGENT_CONNECTION_GENERATOR_INFO","filename","SUPPORTED_AGENT_PROTOCOLS","agentcoreGatewayAgentConnectionGenerator","tree","options","sourceProject","targetProject","gateway","agentComponent","targetComponent","Error","protocol","name","agentGenerator","generator","agentProtocol","toLowerCase","supportedProtocols","includes","join","agentAuth","auth","agentComponentName","agentTargetName","rc","targetName","port","upstreamProjectName","upstreamDevTargetName","stripInvocations","root","preferInstallDependencies","languages"],"mappings":"AAAA;;;CAGC,GAED,SAASA,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AAC3D,SACEC,6BAA6B,EAC7BC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAiB;AACxB,SAASC,yBAAyB,QAAQ,wBAAqB;AAC/D,SAASC,4BAA4B,QAAQ,kBAAe;AAG5D,OAAO,MAAMC,oDACXJ,iBAAiB,YAAYK,QAAQ,EAAE;AAEzC;;;;;;;;;;CAUC,GACD,MAAMC,4BAAsD;IAC1D,YAAY;QAAC;QAAS;KAAM;IAC5B,YAAY;QAAC;QAAS;QAAQ;KAAM;AACtC;AAEA;;;;;;;;CAQC,GACD,OAAO,MAAMC,2CAA2C,OACtDC,MACAC;IAEA,MAAMC,gBAAgBT,oCACpBO,MACAC,QAAQC,aAAa;IAEvB,MAAMC,gBAAgBV,oCACpBO,MACAC,QAAQE,aAAa;IAGvB,MAAMC,UAAUT,6BAA6BO;IAC7C,MAAMG,iBAAiBJ,QAAQK,eAAe;IAE9C,IAAI,CAACD,gBAAgB;QACnB,MAAM,IAAIE,MACR,CAAC,gBAAgB,EAAEN,QAAQE,aAAa,CAAC,sFAAsF,CAAC;IAEpI;IAEA,IAAIC,QAAQI,QAAQ,KAAK,QAAQ;QAC/B,MAAM,IAAID,MACR,CAAC,SAAS,EAAEH,QAAQK,IAAI,CAAC,gBAAgB,EAAEL,QAAQI,QAAQ,CAAC,0IAA0I,CAAC;IAE3M;IAEA,MAAME,iBAAiBL,eAAeM,SAAS,IAAI;IACnD,MAAMC,gBAAgB,AACpB,CAAA,AAACP,eAAeG,QAAQ,IAA2B,MAAK,EACxDK,WAAW;IACb,MAAMC,qBAAqBhB,yBAAyB,CAACY,eAAe,IAAI,EAAE;IAC1E,IAAI,CAACI,mBAAmBC,QAAQ,CAACH,gBAAgB;QAC/C,MAAM,IAAIL,MACR,CAAC,OAAO,EAAEF,eAAeI,IAAI,CAAC,iBAAiB,EAAEG,cAAc,uCAAuC,CAAC,GACpGF,CAAAA,mBAAmB,cAAcE,kBAAkB,SAChD,CAAC,uJAAuJ,CAAC,GACzJ,CAAC,uBAAuB,EAAEE,mBAAmBE,IAAI,CAAC,MAAM,CAAC,CAAC,AAAD;IAEnE;IACA,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,kEAAkE;IAClE,MAAMC,YAAY,AAACZ,eAAea,IAAI,IAA2B;IACjE,IAAID,cAAc,SAASA,cAAc,WAAW;QAClD,MAAM,IAAIV,MACR,CAAC,OAAO,EAAEF,eAAeI,IAAI,CAAC,aAAa,EAAEQ,UAAU,yDAAyD,CAAC;IAErH;IAEA,4EAA4E;IAC5E,qEAAqE;IACrE,0EAA0E;IAC1E,MAAME,qBAAqBd,eAAeI,IAAI,IAAI;IAClD,MAAMW,kBAAkB/B,UACtB,AAACgB,eAAegB,EAAE,IAChB/B,YAAY6B;IAGhB,MAAMzB,0BAA0BM,MAAME,eAAe,OAAO;QAC1DoB,YAAYF;QACZG,MAAM,AAAClB,eAAekB,IAAI,IAA2B;QACrDC,qBAAqBrB,cAAcM,IAAI;QACvCgB,uBAAuB,GAAGN,mBAAmB,IAAI,CAAC;QAClD,0EAA0E;QAC1E,uEAAuE;QACvE,cAAc;QACdO,kBAAkBd,kBAAkB;IACtC;IAEA,6DAA6D;IAC7DrB,8BACES,MACAE,cAAcO,IAAI,EAClBb,mDACAO,cAAcwB,IAAI,EAClBP;IAGF,MAAMhC,gCAAgCY,MAAM;QAC1CJ;KACD;IAED,MAAMV,qBAAqBc;IAE3B,OAAO,IACLb,oBAAoBa,MAAMC,QAAQ2B,yBAAyB,EAAE;YAC3DC,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe9B,yCAAyC"}

package/src/migrations/latest/gateway-cognito-passthrough/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,149 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`gateway-cognito-passthrough migration > adds auth=cognito and the Authorization allowlist to a Cognito agent 1`] = `
+"import {
+  Runtime,
+  RuntimeAuthorizerConfiguration,
+} from 'aws-cdk-lib/aws-bedrockagentcore';
+import { Construct } from 'constructs';
+
+export class MyCognitoAgent extends Construct {
+  public readonly agentCoreRuntime: Runtime;
+  /** Default Gateway target name for this agent. */
+  public readonly agentName = 'my-cognito-agent';
+  /** Inbound auth — a fronting Gateway uses this to pick its outbound credential. */
+  public readonly auth = 'cognito';
+
+  constructor(scope: Construct, id: string, props: MyCognitoAgentProps) {
+    super(scope, id);
+    const { identity } = props;
+    this.agentCoreRuntime = new Runtime(this, 'MyCognitoAgent', {
+      authorizerConfiguration: RuntimeAuthorizerConfiguration.usingCognito(
+        identity.userPool,
+        [identity.userPoolClient],
+      ),
+      // Receive the caller's Authorization header (validated by the authorizer).
+      requestHeaderConfiguration: {
+        allowlistedHeaders: ['Authorization'],
+      },
+    });
+  }
+}
+"
+`;
+
+exports[`gateway-cognito-passthrough migration > adds the request_header_configuration block to the terraform runtime 1`] = `
+"resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
+  agent_runtime_name = "test"
+
+  dynamic "authorizer_configuration" {
+    for_each = var.authorizer_configuration != null && try(var.authorizer_configuration.custom_jwt_authorizer, null) != null ? [var.authorizer_configuration.custom_jwt_authorizer] : []
+    content {
+      custom_jwt_authorizer {
+        discovery_url    = authorizer_configuration.value.discovery_url
+        allowed_audience = authorizer_configuration.value.allowed_audience
+        allowed_clients  = authorizer_configuration.value.allowed_clients
+      }
+    }
+  }
+
+  # Receive the caller's Authorization header (validated by the JWT authorizer).
+  dynamic "request_header_configuration" {
+    for_each = var.authorizer_configuration != null && try(var.authorizer_configuration.custom_jwt_authorizer, null) != null ? [1] : []
+    content {
+      request_header_allowlist = ["Authorization"]
+    }
+  }
+
+  network_configuration {
+    network_mode = "PUBLIC"
+  }
+}
+"
+`;
+
+exports[`gateway-cognito-passthrough migration > makes the gateway pick the target credential from the agent auth 1`] = `
+"import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import { Construct } from 'constructs';
+
+export class AgentCoreGateway extends Construct implements iam.IGrantable {
+  public addAgent(
+    agent: Construct & {
+      readonly agentCoreRuntime: agentcore.Runtime;
+      readonly agentName: string;
+      readonly auth?: 'iam' | 'cognito';
+    },
+    props?: {
+      gatewayTargetName?: string;
+    },
+  ): agentcore.CfnGatewayTarget {
+    return this.addAgentTarget({
+      gatewayTargetName: props?.gatewayTargetName ?? agent.agentName,
+      agentRuntimeArn: agent.agentCoreRuntime.agentRuntimeArn,
+      credentials: agent.auth === 'cognito' ? 'jwt-passthrough' : 'gateway-iam',
+    });
+  }
+
+  public addAgentTarget(props: {
+    gatewayTargetName: string;
+    agentRuntimeArn: string;
+    credentials?: 'gateway-iam' | 'jwt-passthrough';
+  }): agentcore.CfnGatewayTarget {
+    const target = new agentcore.CfnGatewayTarget(
+      this,
+      \`Target-\${props.gatewayTargetName}\`,
+      {
+        gatewayIdentifier: this.gateway.gatewayId,
+        name: props.gatewayTargetName,
+        targetConfiguration: {
+          http: {
+            agentcoreRuntime: {
+              arn: props.agentRuntimeArn,
+              qualifier: 'DEFAULT',
+            },
+          },
+        },
+        // The bare gateway IAM role credential: runtime targets reject the
+        // iamCredentialProvider detail MCP targets carry.
+        credentialProviderConfigurations: [
+          {
+            credentialProviderType:
+              props.credentials === 'jwt-passthrough'
+                ? 'JWT_PASSTHROUGH'
+                : 'GATEWAY_IAM_ROLE',
+          },
+        ],
+      },
+    );
+    return target;
+  }
+
+  public addMcpServerTarget(props: {
+    gatewayTargetName: string;
+    mcpServerRuntimeArn: string;
+  }): agentcore.CfnGatewayTarget {
+    const target = new agentcore.CfnGatewayTarget(
+      this,
+      \`Target-\${props.gatewayTargetName}\`,
+      {
+        gatewayIdentifier: this.gateway.gatewayId,
+        name: props.gatewayTargetName,
+        targetConfiguration: {
+          mcp: { openApiSchema: { inlinePayload: 'x' } },
+        },
+        credentialProviderConfigurations: [
+          {
+            credentialProviderType: 'GATEWAY_IAM_ROLE',
+            credentialProvider: {
+              iamCredentialProvider: { service: 'bedrock-agentcore' },
+            },
+          },
+        ],
+      },
+    );
+    return target;
+  }
+}
+"
+`;

package/src/migrations/latest/gateway-cognito-passthrough/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Front Cognito agents with an AgentCore Gateway via JWT passthrough: addAgent picks the target credential from the agent's auth, agent constructs gain an auth member, and Cognito runtimes allowlist the Authorization header"
+}

package/src/migrations/latest/gateway-cognito-passthrough/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/gateway-cognito-passthrough/migration.js

@@ -0,0 +1,195 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Bring existing workspaces up to the generators' current gateway->agent
+ * support for Cognito agents, which forward the caller's JWT to the runtime:
+ *
+ * - The vended `AgentCoreGateway` construct's `addAgent`/`addAgentTarget` pick
+ *   the outbound credential from the agent's `auth`: a `cognito` agent uses
+ *   `JWT_PASSTHROUGH` (the caller's token reaches the runtime), an `iam` agent
+ *   the gateway role (`GATEWAY_IAM_ROLE`, the previous behaviour).
+ * - Vended agent constructs gain an `auth` member `addAgent` reads, and Cognito
+ *   agents allowlist the `Authorization` header (CDK + Terraform runtime) so the
+ *   runtime receives the forwarded token.
+ *
+ * These files are generated with `KeepExisting`, so without this an upgraded
+ * workspace pairs new app-level constructs with stale core ones. Diverged files
+ * are left untouched and reported via `nextSteps`.
+ */ const GATEWAY_CONSTRUCT_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/agentcore-gateway/agentcore-gateway.ts`;
+const AGENTS_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/agents`;
+const TF_RUNTIME_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/agent-core/runtime.tf`;
+/**
+ * Teach the vended `AgentCoreGateway` construct to pick the target credential
+ * from the agent's `auth` (JWT passthrough for Cognito, gateway role for IAM).
+ */ const migrateGatewayConstruct = async (tree, nextSteps)=>{
+    if (!tree.exists(GATEWAY_CONSTRUCT_FILE)) {
+        return; // No vended gateway construct.
+    }
+    // Predates agent-target support (the gateway-agent-targets migration adds
+    // addAgentTarget first) — match the method, not a bare identifier.
+    if (!await matchGritQL(tree, GATEWAY_CONSTRUCT_FILE, '`addAgentTarget(props: { $_ }): agentcore.CfnGatewayTarget { $_ }`')) {
+        return;
+    }
+    // Already migrated: the credentials member is on addAgentTarget's props.
+    if (await matchGritQL(tree, GATEWAY_CONSTRUCT_FILE, "`credentials?: 'gateway-iam' | 'jwt-passthrough'`")) {
+        return;
+    }
+    const divergedMessage = `In ${GATEWAY_CONSTRUCT_FILE}: have addAgent read the agent's \`auth\` and pass \`credentials: 'jwt-passthrough'\` to addAgentTarget, so the target's credentialProviderType becomes 'JWT_PASSTHROUGH' for Cognito agents.`;
+    // GritQL patterns for each of the four edits. Verified against the tree
+    // up-front so the transform is all-or-nothing: a construct missing any
+    // anchor is left untouched with a single actionable next step, rather than
+    // half-migrated.
+    const authParamPattern = `\`readonly agentName: string\` as $sig where {
+  $program <: not contains \`readonly auth?\`
+} => \`$sig;
+      readonly auth?: 'iam' | 'cognito'\``;
+    const callPattern = `\`agentRuntimeArn: agent.agentCoreRuntime.agentRuntimeArn\` as $prop where {
+  $program <: not contains \`credentials:\`
+} => \`$prop,
+      credentials: agent.auth === 'cognito' ? 'jwt-passthrough' : 'gateway-iam'\``;
+    // The addAgentTarget props type: matched on its `agentRuntimeArn: string`
+    // member signature (without trailing semicolon), which the rewrite re-adds
+    // followed by the credentials member. The `: string` type distinguishes it
+    // from the `agentRuntimeArn:` value in the addAgent call.
+    const paramPattern = `\`agentRuntimeArn: string\` as $sig where {
+  $program <: not contains \`credentials?\`
+} => \`$sig;
+    credentials?: 'gateway-iam' | 'jwt-passthrough'\``;
+    // Scoped to the agent target's own CfnGatewayTarget (the one configured with
+    // an agentcoreRuntime), so the MCP server target's GATEWAY_IAM_ROLE — a
+    // sibling method with its own credential block — is left untouched.
+    const credentialPattern = `\`credentialProviderType: 'GATEWAY_IAM_ROLE'\` as $cred where {
+  $cred <: within \`new agentcore.CfnGatewayTarget($_, $_, $config)\`,
+  $config <: contains \`agentcoreRuntime\`
+} => \`credentialProviderType:
+              props.credentials === 'jwt-passthrough'
+                ? 'JWT_PASSTHROUGH'
+                : 'GATEWAY_IAM_ROLE'\``;
+    // Verify every anchor matches before mutating anything (matchGritQL is
+    // read-only), so a diverged construct is never left partially migrated.
+    for (const pattern of [
+        authParamPattern,
+        callPattern,
+        paramPattern,
+        credentialPattern
+    ]){
+        if (!await matchGritQL(tree, GATEWAY_CONSTRUCT_FILE, pattern)) {
+            nextSteps.push(divergedMessage);
+            return;
+        }
+    }
+    await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, authParamPattern);
+    await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, callPattern);
+    await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, paramPattern);
+    await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, credentialPattern);
+};
+/**
+ * Add the `auth` member to each vended agent construct, and for Cognito agents
+ * allowlist the Authorization header so the runtime receives the forwarded JWT.
+ */ const migrateAgentConstructs = async (tree, nextSteps)=>{
+    if (!tree.exists(AGENTS_DIR)) {
+        return;
+    }
+    for (const dir of tree.children(AGENTS_DIR)){
+        const constructFile = `${AGENTS_DIR}/${dir}/${dir}.ts`;
+        if (!tree.exists(constructFile)) {
+            continue;
+        }
+        // Only agents (which carry a gateway target name), not MCP servers.
+        if (!await matchGritQL(tree, constructFile, '`public readonly agentName = $_`')) {
+            continue;
+        }
+        if (await matchGritQL(tree, constructFile, '`public readonly auth = $_`')) {
+            continue; // Already migrated (or user-added).
+        }
+        // Cognito agents configure the runtime's inbound authorizer with a Cognito
+        // JWT — match that authorizerConfiguration property specifically.
+        const isCognito = await matchGritQL(tree, constructFile, '`authorizerConfiguration: RuntimeAuthorizerConfiguration.usingCognito($_)`');
+        const authValue = isCognito ? 'cognito' : 'iam';
+        // The `auth` member, after the agentName member. Matched without the
+        // trailing semicolon — GritQL parses the field's initializer as its AST
+        // node, so the semicolon is appended by the rewrite.
+        const authPattern = `\`public readonly agentName = $name\` as $field => \`$field;
+  /** Inbound auth — a fronting Gateway uses this to pick its outbound credential. */
+  public readonly auth = '${authValue}'\``;
+        // Cognito agents allowlist the Authorization header so the runtime (and a
+        // fronting gateway, via passthrough) receives the caller's token.
+        const headerNeeded = isCognito && !await matchGritQL(tree, constructFile, '`requestHeaderConfiguration: $_`');
+        const headerPattern = `\`authorizerConfiguration: RuntimeAuthorizerConfiguration.usingCognito($args)\` as $authz where {
+  $program <: not contains \`requestHeaderConfiguration\`
+} => \`$authz,
+      ${GRIT_INSERT_PLACEHOLDER}\``;
+        const headerText = `// Receive the caller's Authorization header (validated by the authorizer).
+      requestHeaderConfiguration: {
+        allowlistedHeaders: ['Authorization'],
+      }`;
+        // Verify every anchor up-front so the construct is never half-migrated:
+        // if any edit can't be applied, leave the file untouched with one
+        // actionable next step.
+        const authOk = await matchGritQL(tree, constructFile, authPattern);
+        const headerOk = !headerNeeded || await matchGritQL(tree, constructFile, headerPattern);
+        if (!authOk || !headerOk) {
+            const actions = [
+                `add a \`public readonly auth = '${authValue}';\` member`
+            ];
+            if (headerNeeded) {
+                actions.push(`add \`requestHeaderConfiguration: { allowlistedHeaders: ['Authorization'] }\` to its Runtime so a gateway can pass the caller's JWT through`);
+            }
+            nextSteps.push(`In ${constructFile}: ${actions.join('; and ')}.`);
+            continue;
+        }
+        await applyGritQL(tree, constructFile, authPattern);
+        if (headerNeeded) {
+            await insertViaGritQL(tree, constructFile, headerPattern, headerText);
+        }
+    }
+};
+/**
+ * Add the `request_header_configuration` block to the vended Terraform runtime
+ * module so a JWT-authorized runtime receives the forwarded Authorization
+ * header (the analogue of the CDK requestHeaderConfiguration).
+ */ const migrateTerraformRuntime = async (tree, nextSteps)=>{
+    if (!tree.exists(TF_RUNTIME_FILE)) {
+        return;
+    }
+    if (await matchGritQL(tree, TF_RUNTIME_FILE, 'language hcl\n`dynamic "request_header_configuration" { $_ }`')) {
+        return; // Already migrated.
+    }
+    const tfActionMessage = `In ${TF_RUNTIME_FILE}: add a \`request_header_configuration { request_header_allowlist = ["Authorization"] }\` block (guarded by the JWT authorizer) to the aws_bedrockagentcore_agent_runtime resource so a gateway can pass the caller's JWT through.`;
+    const hasAuthorizerBlock = await matchGritQL(tree, TF_RUNTIME_FILE, 'language hcl\n`dynamic "authorizer_configuration" { $_ }`');
+    if (!hasAuthorizerBlock) {
+        nextSteps.push(tfActionMessage);
+        return;
+    }
+    const added = await insertViaGritQL(tree, TF_RUNTIME_FILE, `language hcl
+\`dynamic "authorizer_configuration" { $body }\` as $block where {
+  $block <: within \`resource "aws_bedrockagentcore_agent_runtime" $_ { $_ }\`
+} => \`$block
+
+  ${GRIT_INSERT_PLACEHOLDER}\``, `# Receive the caller's Authorization header (validated by the JWT authorizer).
+  dynamic "request_header_configuration" {
+    for_each = var.authorizer_configuration != null && try(var.authorizer_configuration.custom_jwt_authorizer, null) != null ? [1] : []
+    content {
+      request_header_allowlist = ["Authorization"]
+    }
+  }`);
+    if (!added) {
+        nextSteps.push(tfActionMessage);
+    }
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    await migrateGatewayConstruct(tree, nextSteps);
+    await migrateAgentConstructs(tree, nextSteps);
+    await migrateTerraformRuntime(tree, nextSteps);
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/gateway-cognito-passthrough/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/gateway-cognito-passthrough/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Bring existing workspaces up to the generators' current gateway->agent\n * support for Cognito agents, which forward the caller's JWT to the runtime:\n *\n * - The vended `AgentCoreGateway` construct's `addAgent`/`addAgentTarget` pick\n *   the outbound credential from the agent's `auth`: a `cognito` agent uses\n *   `JWT_PASSTHROUGH` (the caller's token reaches the runtime), an `iam` agent\n *   the gateway role (`GATEWAY_IAM_ROLE`, the previous behaviour).\n * - Vended agent constructs gain an `auth` member `addAgent` reads, and Cognito\n *   agents allowlist the `Authorization` header (CDK + Terraform runtime) so the\n *   runtime receives the forwarded token.\n *\n * These files are generated with `KeepExisting`, so without this an upgraded\n * workspace pairs new app-level constructs with stale core ones. Diverged files\n * are left untouched and reported via `nextSteps`.\n */\n\nconst GATEWAY_CONSTRUCT_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/agentcore-gateway/agentcore-gateway.ts`;\nconst AGENTS_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/agents`;\nconst TF_RUNTIME_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/agent-core/runtime.tf`;\n\n/**\n * Teach the vended `AgentCoreGateway` construct to pick the target credential\n * from the agent's `auth` (JWT passthrough for Cognito, gateway role for IAM).\n */\nconst migrateGatewayConstruct = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(GATEWAY_CONSTRUCT_FILE)) {\n    return; // No vended gateway construct.\n  }\n  // Predates agent-target support (the gateway-agent-targets migration adds\n  // addAgentTarget first) — match the method, not a bare identifier.\n  if (\n    !(await matchGritQL(\n      tree,\n      GATEWAY_CONSTRUCT_FILE,\n      '`addAgentTarget(props: { $_ }): agentcore.CfnGatewayTarget { $_ }`',\n    ))\n  ) {\n    return;\n  }\n  // Already migrated: the credentials member is on addAgentTarget's props.\n  if (\n    await matchGritQL(\n      tree,\n      GATEWAY_CONSTRUCT_FILE,\n      \"`credentials?: 'gateway-iam' | 'jwt-passthrough'`\",\n    )\n  ) {\n    return;\n  }\n\n  const divergedMessage = `In ${GATEWAY_CONSTRUCT_FILE}: have addAgent read the agent's \\`auth\\` and pass \\`credentials: 'jwt-passthrough'\\` to addAgentTarget, so the target's credentialProviderType becomes 'JWT_PASSTHROUGH' for Cognito agents.`;\n\n  // GritQL patterns for each of the four edits. Verified against the tree\n  // up-front so the transform is all-or-nothing: a construct missing any\n  // anchor is left untouched with a single actionable next step, rather than\n  // half-migrated.\n  const authParamPattern = `\\`readonly agentName: string\\` as $sig where {\n  $program <: not contains \\`readonly auth?\\`\n} => \\`$sig;\n      readonly auth?: 'iam' | 'cognito'\\``;\n\n  const callPattern = `\\`agentRuntimeArn: agent.agentCoreRuntime.agentRuntimeArn\\` as $prop where {\n  $program <: not contains \\`credentials:\\`\n} => \\`$prop,\n      credentials: agent.auth === 'cognito' ? 'jwt-passthrough' : 'gateway-iam'\\``;\n\n  // The addAgentTarget props type: matched on its `agentRuntimeArn: string`\n  // member signature (without trailing semicolon), which the rewrite re-adds\n  // followed by the credentials member. The `: string` type distinguishes it\n  // from the `agentRuntimeArn:` value in the addAgent call.\n  const paramPattern = `\\`agentRuntimeArn: string\\` as $sig where {\n  $program <: not contains \\`credentials?\\`\n} => \\`$sig;\n    credentials?: 'gateway-iam' | 'jwt-passthrough'\\``;\n\n  // Scoped to the agent target's own CfnGatewayTarget (the one configured with\n  // an agentcoreRuntime), so the MCP server target's GATEWAY_IAM_ROLE — a\n  // sibling method with its own credential block — is left untouched.\n  const credentialPattern = `\\`credentialProviderType: 'GATEWAY_IAM_ROLE'\\` as $cred where {\n  $cred <: within \\`new agentcore.CfnGatewayTarget($_, $_, $config)\\`,\n  $config <: contains \\`agentcoreRuntime\\`\n} => \\`credentialProviderType:\n              props.credentials === 'jwt-passthrough'\n                ? 'JWT_PASSTHROUGH'\n                : 'GATEWAY_IAM_ROLE'\\``;\n\n  // Verify every anchor matches before mutating anything (matchGritQL is\n  // read-only), so a diverged construct is never left partially migrated.\n  for (const pattern of [\n    authParamPattern,\n    callPattern,\n    paramPattern,\n    credentialPattern,\n  ]) {\n    if (!(await matchGritQL(tree, GATEWAY_CONSTRUCT_FILE, pattern))) {\n      nextSteps.push(divergedMessage);\n      return;\n    }\n  }\n\n  await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, authParamPattern);\n  await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, callPattern);\n  await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, paramPattern);\n  await applyGritQL(tree, GATEWAY_CONSTRUCT_FILE, credentialPattern);\n};\n\n/**\n * Add the `auth` member to each vended agent construct, and for Cognito agents\n * allowlist the Authorization header so the runtime receives the forwarded JWT.\n */\nconst migrateAgentConstructs = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(AGENTS_DIR)) {\n    return;\n  }\n  for (const dir of tree.children(AGENTS_DIR)) {\n    const constructFile = `${AGENTS_DIR}/${dir}/${dir}.ts`;\n    if (!tree.exists(constructFile)) {\n      continue;\n    }\n    // Only agents (which carry a gateway target name), not MCP servers.\n    if (\n      !(await matchGritQL(\n        tree,\n        constructFile,\n        '`public readonly agentName = $_`',\n      ))\n    ) {\n      continue;\n    }\n    if (await matchGritQL(tree, constructFile, '`public readonly auth = $_`')) {\n      continue; // Already migrated (or user-added).\n    }\n\n    // Cognito agents configure the runtime's inbound authorizer with a Cognito\n    // JWT — match that authorizerConfiguration property specifically.\n    const isCognito = await matchGritQL(\n      tree,\n      constructFile,\n      '`authorizerConfiguration: RuntimeAuthorizerConfiguration.usingCognito($_)`',\n    );\n    const authValue = isCognito ? 'cognito' : 'iam';\n\n    // The `auth` member, after the agentName member. Matched without the\n    // trailing semicolon — GritQL parses the field's initializer as its AST\n    // node, so the semicolon is appended by the rewrite.\n    const authPattern = `\\`public readonly agentName = $name\\` as $field => \\`$field;\n  /** Inbound auth — a fronting Gateway uses this to pick its outbound credential. */\n  public readonly auth = '${authValue}'\\``;\n\n    // Cognito agents allowlist the Authorization header so the runtime (and a\n    // fronting gateway, via passthrough) receives the caller's token.\n    const headerNeeded =\n      isCognito &&\n      !(await matchGritQL(\n        tree,\n        constructFile,\n        '`requestHeaderConfiguration: $_`',\n      ));\n    const headerPattern = `\\`authorizerConfiguration: RuntimeAuthorizerConfiguration.usingCognito($args)\\` as $authz where {\n  $program <: not contains \\`requestHeaderConfiguration\\`\n} => \\`$authz,\n      ${GRIT_INSERT_PLACEHOLDER}\\``;\n    const headerText = `// Receive the caller's Authorization header (validated by the authorizer).\n      requestHeaderConfiguration: {\n        allowlistedHeaders: ['Authorization'],\n      }`;\n\n    // Verify every anchor up-front so the construct is never half-migrated:\n    // if any edit can't be applied, leave the file untouched with one\n    // actionable next step.\n    const authOk = await matchGritQL(tree, constructFile, authPattern);\n    const headerOk =\n      !headerNeeded || (await matchGritQL(tree, constructFile, headerPattern));\n    if (!authOk || !headerOk) {\n      const actions = [\n        `add a \\`public readonly auth = '${authValue}';\\` member`,\n      ];\n      if (headerNeeded) {\n        actions.push(\n          `add \\`requestHeaderConfiguration: { allowlistedHeaders: ['Authorization'] }\\` to its Runtime so a gateway can pass the caller's JWT through`,\n        );\n      }\n      nextSteps.push(`In ${constructFile}: ${actions.join('; and ')}.`);\n      continue;\n    }\n\n    await applyGritQL(tree, constructFile, authPattern);\n    if (headerNeeded) {\n      await insertViaGritQL(tree, constructFile, headerPattern, headerText);\n    }\n  }\n};\n\n/**\n * Add the `request_header_configuration` block to the vended Terraform runtime\n * module so a JWT-authorized runtime receives the forwarded Authorization\n * header (the analogue of the CDK requestHeaderConfiguration).\n */\nconst migrateTerraformRuntime = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(TF_RUNTIME_FILE)) {\n    return;\n  }\n  if (\n    await matchGritQL(\n      tree,\n      TF_RUNTIME_FILE,\n      'language hcl\\n`dynamic \"request_header_configuration\" { $_ }`',\n    )\n  ) {\n    return; // Already migrated.\n  }\n\n  const tfActionMessage = `In ${TF_RUNTIME_FILE}: add a \\`request_header_configuration { request_header_allowlist = [\"Authorization\"] }\\` block (guarded by the JWT authorizer) to the aws_bedrockagentcore_agent_runtime resource so a gateway can pass the caller's JWT through.`;\n\n  const hasAuthorizerBlock = await matchGritQL(\n    tree,\n    TF_RUNTIME_FILE,\n    'language hcl\\n`dynamic \"authorizer_configuration\" { $_ }`',\n  );\n  if (!hasAuthorizerBlock) {\n    nextSteps.push(tfActionMessage);\n    return;\n  }\n\n  const added = await insertViaGritQL(\n    tree,\n    TF_RUNTIME_FILE,\n    `language hcl\n\\`dynamic \"authorizer_configuration\" { $body }\\` as $block where {\n  $block <: within \\`resource \"aws_bedrockagentcore_agent_runtime\" $_ { $_ }\\`\n} => \\`$block\n\n  ${GRIT_INSERT_PLACEHOLDER}\\``,\n    `# Receive the caller's Authorization header (validated by the JWT authorizer).\n  dynamic \"request_header_configuration\" {\n    for_each = var.authorizer_configuration != null && try(var.authorizer_configuration.custom_jwt_authorizer, null) != null ? [1] : []\n    content {\n      request_header_allowlist = [\"Authorization\"]\n    }\n  }`,\n  );\n  if (!added) {\n    nextSteps.push(tfActionMessage);\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  await migrateGatewayConstruct(tree, nextSteps);\n  await migrateAgentConstructs(tree, nextSteps);\n  await migrateTerraformRuntime(tree, nextSteps);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","GATEWAY_CONSTRUCT_FILE","AGENTS_DIR","TF_RUNTIME_FILE","migrateGatewayConstruct","tree","nextSteps","exists","divergedMessage","authParamPattern","callPattern","paramPattern","credentialPattern","pattern","push","migrateAgentConstructs","dir","children","constructFile","isCognito","authValue","authPattern","headerNeeded","headerPattern","headerText","authOk","headerOk","actions","join","migrateTerraformRuntime","tfActionMessage","hasAuthorizerBlock","added","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAA6C;AAEpD;;;;;;;;;;;;;;;CAeC,GAED,MAAMC,yBAAyB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,gDAAgD,CAAC;AACzH,MAAMG,aAAa,GAAGJ,aAAa,CAAC,EAAEC,sBAAsB,eAAe,CAAC;AAC5E,MAAMI,kBAAkB,GAAGL,aAAa,CAAC,EAAEE,qBAAqB,+BAA+B,CAAC;AAEhG;;;CAGC,GACD,MAAMI,0BAA0B,OAC9BC,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACN,yBAAyB;QACxC,QAAQ,+BAA+B;IACzC;IACA,0EAA0E;IAC1E,mEAAmE;IACnE,IACE,CAAE,MAAML,YACNS,MACAJ,wBACA,uEAEF;QACA;IACF;IACA,yEAAyE;IACzE,IACE,MAAML,YACJS,MACAJ,wBACA,sDAEF;QACA;IACF;IAEA,MAAMO,kBAAkB,CAAC,GAAG,EAAEP,uBAAuB,6LAA6L,CAAC;IAEnP,wEAAwE;IACxE,uEAAuE;IACvE,2EAA2E;IAC3E,iBAAiB;IACjB,MAAMQ,mBAAmB,CAAC;;;yCAGa,CAAC;IAExC,MAAMC,cAAc,CAAC;;;iFAG0D,CAAC;IAEhF,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,0DAA0D;IAC1D,MAAMC,eAAe,CAAC;;;qDAG6B,CAAC;IAEpD,6EAA6E;IAC7E,wEAAwE;IACxE,oEAAoE;IACpE,MAAMC,oBAAoB,CAAC;;;;;;sCAMS,CAAC;IAErC,uEAAuE;IACvE,wEAAwE;IACxE,KAAK,MAAMC,WAAW;QACpBJ;QACAC;QACAC;QACAC;KACD,CAAE;QACD,IAAI,CAAE,MAAMhB,YAAYS,MAAMJ,wBAAwBY,UAAW;YAC/DP,UAAUQ,IAAI,CAACN;YACf;QACF;IACF;IAEA,MAAMf,YAAYY,MAAMJ,wBAAwBQ;IAChD,MAAMhB,YAAYY,MAAMJ,wBAAwBS;IAChD,MAAMjB,YAAYY,MAAMJ,wBAAwBU;IAChD,MAAMlB,YAAYY,MAAMJ,wBAAwBW;AAClD;AAEA;;;CAGC,GACD,MAAMG,yBAAyB,OAC7BV,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACL,aAAa;QAC5B;IACF;IACA,KAAK,MAAMc,OAAOX,KAAKY,QAAQ,CAACf,YAAa;QAC3C,MAAMgB,gBAAgB,GAAGhB,WAAW,CAAC,EAAEc,IAAI,CAAC,EAAEA,IAAI,GAAG,CAAC;QACtD,IAAI,CAACX,KAAKE,MAAM,CAACW,gBAAgB;YAC/B;QACF;QACA,oEAAoE;QACpE,IACE,CAAE,MAAMtB,YACNS,MACAa,eACA,qCAEF;YACA;QACF;QACA,IAAI,MAAMtB,YAAYS,MAAMa,eAAe,gCAAgC;YACzE,UAAU,oCAAoC;QAChD;QAEA,2EAA2E;QAC3E,kEAAkE;QAClE,MAAMC,YAAY,MAAMvB,YACtBS,MACAa,eACA;QAEF,MAAME,YAAYD,YAAY,YAAY;QAE1C,qEAAqE;QACrE,wEAAwE;QACxE,qDAAqD;QACrD,MAAME,cAAc,CAAC;;0BAEC,EAAED,UAAU,GAAG,CAAC;QAEtC,0EAA0E;QAC1E,kEAAkE;QAClE,MAAME,eACJH,aACA,CAAE,MAAMvB,YACNS,MACAa,eACA;QAEJ,MAAMK,gBAAgB,CAAC;;;MAGrB,EAAE7B,wBAAwB,EAAE,CAAC;QAC/B,MAAM8B,aAAa,CAAC;;;OAGjB,CAAC;QAEJ,wEAAwE;QACxE,kEAAkE;QAClE,wBAAwB;QACxB,MAAMC,SAAS,MAAM7B,YAAYS,MAAMa,eAAeG;QACtD,MAAMK,WACJ,CAACJ,gBAAiB,MAAM1B,YAAYS,MAAMa,eAAeK;QAC3D,IAAI,CAACE,UAAU,CAACC,UAAU;YACxB,MAAMC,UAAU;gBACd,CAAC,gCAAgC,EAAEP,UAAU,WAAW,CAAC;aAC1D;YACD,IAAIE,cAAc;gBAChBK,QAAQb,IAAI,CACV,CAAC,2IAA2I,CAAC;YAEjJ;YACAR,UAAUQ,IAAI,CAAC,CAAC,GAAG,EAAEI,cAAc,EAAE,EAAES,QAAQC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChE;QACF;QAEA,MAAMnC,YAAYY,MAAMa,eAAeG;QACvC,IAAIC,cAAc;YAChB,MAAM3B,gBAAgBU,MAAMa,eAAeK,eAAeC;QAC5D;IACF;AACF;AAEA;;;;CAIC,GACD,MAAMK,0BAA0B,OAC9BxB,MACAC;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACJ,kBAAkB;QACjC;IACF;IACA,IACE,MAAMP,YACJS,MACAF,iBACA,kEAEF;QACA,QAAQ,oBAAoB;IAC9B;IAEA,MAAM2B,kBAAkB,CAAC,GAAG,EAAE3B,gBAAgB,kOAAkO,CAAC;IAEjR,MAAM4B,qBAAqB,MAAMnC,YAC/BS,MACAF,iBACA;IAEF,IAAI,CAAC4B,oBAAoB;QACvBzB,UAAUQ,IAAI,CAACgB;QACf;IACF;IAEA,MAAME,QAAQ,MAAMrC,gBAClBU,MACAF,iBACA,CAAC;;;;;EAKH,EAAET,wBAAwB,EAAE,CAAC,EAC3B,CAAC;;;;;;GAMF,CAAC;IAEF,IAAI,CAACsC,OAAO;QACV1B,UAAUQ,IAAI,CAACgB;IACjB;AACF;AAEA,eAAe,eAAeG,UAC5B5B,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,MAAMF,wBAAwBC,MAAMC;IACpC,MAAMS,uBAAuBV,MAAMC;IACnC,MAAMuB,wBAAwBxB,MAAMC;IAEpC,MAAMT,qBAAqBQ;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/strip-pip-from-python-images/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,48 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`strip-pip-from-python-images migration > strips pip from a py#agent Dockerfile 1`] = `
+"FROM public.ecr.aws/docker/library/python:3.14-slim
+
+# Remove the base image's pip: the runtime runs from the bundled environment and
+# never needs it, and pip's vendored packages carry known HIGH/CRITICAL
+# vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \\
+    rm -rf /usr/local/lib/python*/site-packages/pip \\
+           /usr/local/lib/python*/site-packages/pip-*.dist-info
+
+WORKDIR /app
+
+# Copy bundled package
+COPY . /app
+
+EXPOSE 8080
+
+ENV PYTHONPATH=/app
+ENV PATH="/app/bin:\${PATH}"
+
+CMD ["python", "bin/opentelemetry-instrument", "python", "-m", "proj_py_project.my_agent.main"]
+"
+`;
+
+exports[`strip-pip-from-python-images migration > strips pip from a py#mcp-server Dockerfile 1`] = `
+"FROM public.ecr.aws/docker/library/python:3.14-slim
+
+# Remove the base image's pip: the runtime runs from the bundled environment and
+# never needs it, and pip's vendored packages carry known HIGH/CRITICAL
+# vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \\
+    rm -rf /usr/local/lib/python*/site-packages/pip \\
+           /usr/local/lib/python*/site-packages/pip-*.dist-info
+
+WORKDIR /app
+
+# Copy bundled package
+COPY . /app
+
+EXPOSE 8000
+
+ENV PYTHONPATH=/app
+
+CMD ["python", "bin/opentelemetry-instrument", "python", "-m", "uvicorn", "proj_py_project.my_mcp.http:app", "--host", "0.0.0.0", "--port", "8000"]
+"
+`;

package/src/migrations/latest/strip-pip-from-python-images/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Remove pip from vended Python agent / MCP server images so its vulnerable vendored packages are not present at runtime"
+}

package/src/migrations/latest/strip-pip-from-python-images/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/strip-pip-from-python-images/migration.js

@@ -0,0 +1,91 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Remove pip from the vended Python agent / MCP server images.
+ *
+ * The runtime runs entirely from the bundled `/app` environment and never needs
+ * pip, whose vendored packages (setuptools, msgpack) in the base image carry
+ * known HIGH/CRITICAL vulnerabilities the image scan flags. New workspaces get
+ * this from the generator templates; this brings existing ones up to date.
+ *
+ * Only the Dockerfiles of `py#agent` / `py#mcp-server` components are touched,
+ * located from their project metadata. The Dockerfile is generated
+ * `KeepExisting`, so it is edited in place: the pip removal is inserted right
+ * after the `FROM` line. A Dockerfile whose pip usage has been customised (an
+ * added `pip install`, or any pip command other than this removal) is left
+ * untouched and reported via `nextSteps`, since stripping pip could break it.
+ */ /**
+ * The generators whose runtime images vend pip and should have it stripped.
+ * Hardcoded rather than imported from the generators: a migration matches the
+ * ids workspaces recorded at generation time, which must stay fixed even if the
+ * generators' current ids change later.
+ */ const RUNTIME_IMAGE_GENERATOR_IDS = [
+    'py#agent',
+    'py#mcp-server'
+];
+const PIP_REMOVAL = `# Remove the base image's pip: the runtime runs from the bundled environment and
+# never needs it, and pip's vendored packages carry known HIGH/CRITICAL
+# vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \\
+    rm -rf /usr/local/lib/python*/site-packages/pip \\
+           /usr/local/lib/python*/site-packages/pip-*.dist-info`;
+/** The exact pip command this migration adds; used to detect an applied fix. */ const PIP_UNINSTALL = 'pip uninstall -y pip';
+/** Matches any `pip` invocation in a RUN instruction (python -m pip … or pip …). */ const PIP_COMMAND = /\b(?:python\s+-m\s+)?pip\s+\S+/g;
+/**
+ * The Dockerfiles of every `py#agent` / `py#mcp-server` component, located from
+ * each project's recorded component metadata (`path` is the component directory
+ * relative to the project root).
+ */ const runtimeImageDockerfiles = (tree)=>{
+    const paths = [];
+    for (const project of getProjects(tree).values()){
+        const components = project.metadata?.components ?? [];
+        for (const component of components){
+            if (!RUNTIME_IMAGE_GENERATOR_IDS.includes(component.generator) || !component.path) {
+                continue;
+            }
+            const dockerfile = joinPathFragments(projectRoot(project), component.path, 'Dockerfile');
+            if (tree.exists(dockerfile)) {
+                paths.push(dockerfile);
+            }
+        }
+    }
+    return paths;
+};
+/** A project's root, falling back to sourceRoot for the TS-solution layout. */ const projectRoot = (project)=>project.root ?? project.sourceRoot ?? '';
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const filePath of runtimeImageDockerfiles(tree)){
+        const content = tree.read(filePath, 'utf-8');
+        if (!content) {
+            continue;
+        }
+        if (content.includes(PIP_UNINSTALL)) {
+            continue; // Already stripped (migrated or user-added).
+        }
+        // Leave a customised Dockerfile alone: any pip usage other than this
+        // migration's removal (e.g. an added `pip install`) means stripping pip
+        // could break the image, so flag it for the user instead of editing.
+        const pipUsages = content.match(PIP_COMMAND) ?? [];
+        if (pipUsages.length > 0) {
+            nextSteps.push(`In ${filePath}: this image uses pip (${pipUsages.join(', ')}), so it was left unchanged. pip's vendored packages carry known vulnerabilities flagged by the image scan — remove pip once it is no longer needed, e.g. \`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\`.`);
+            continue;
+        }
+        // Insert the pip removal after the FROM line and its trailing blank line,
+        // matching the spacing a freshly generated Dockerfile has.
+        const updated = content.replace(/^(FROM\s+\S*python:.*\n)\n/m, `$1\n${PIP_REMOVAL}\n\n`);
+        if (updated === content) {
+            nextSteps.push(`In ${filePath}: remove pip from the image so its vulnerable vendored packages are not scanned — add \`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\` after the FROM line (the runtime does not need pip).`);
+            continue;
+        }
+        tree.write(filePath, updated);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/strip-pip-from-python-images/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/strip-pip-from-python-images/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport type { ComponentMetadata } from '../../../utils/nx';\n\n/**\n * Remove pip from the vended Python agent / MCP server images.\n *\n * The runtime runs entirely from the bundled `/app` environment and never needs\n * pip, whose vendored packages (setuptools, msgpack) in the base image carry\n * known HIGH/CRITICAL vulnerabilities the image scan flags. New workspaces get\n * this from the generator templates; this brings existing ones up to date.\n *\n * Only the Dockerfiles of `py#agent` / `py#mcp-server` components are touched,\n * located from their project metadata. The Dockerfile is generated\n * `KeepExisting`, so it is edited in place: the pip removal is inserted right\n * after the `FROM` line. A Dockerfile whose pip usage has been customised (an\n * added `pip install`, or any pip command other than this removal) is left\n * untouched and reported via `nextSteps`, since stripping pip could break it.\n */\n\n/**\n * The generators whose runtime images vend pip and should have it stripped.\n * Hardcoded rather than imported from the generators: a migration matches the\n * ids workspaces recorded at generation time, which must stay fixed even if the\n * generators' current ids change later.\n */\nconst RUNTIME_IMAGE_GENERATOR_IDS = ['py#agent', 'py#mcp-server'];\n\nconst PIP_REMOVAL = `# Remove the base image's pip: the runtime runs from the bundled environment and\n# never needs it, and pip's vendored packages carry known HIGH/CRITICAL\n# vulnerabilities flagged by the image scan.\nRUN python -m pip uninstall -y pip && \\\\\n    rm -rf /usr/local/lib/python*/site-packages/pip \\\\\n           /usr/local/lib/python*/site-packages/pip-*.dist-info`;\n\n/** The exact pip command this migration adds; used to detect an applied fix. */\nconst PIP_UNINSTALL = 'pip uninstall -y pip';\n\n/** Matches any `pip` invocation in a RUN instruction (python -m pip … or pip …). */\nconst PIP_COMMAND = /\\b(?:python\\s+-m\\s+)?pip\\s+\\S+/g;\n\n/**\n * The Dockerfiles of every `py#agent` / `py#mcp-server` component, located from\n * each project's recorded component metadata (`path` is the component directory\n * relative to the project root).\n */\nconst runtimeImageDockerfiles = (tree: Tree): string[] => {\n  const paths: string[] = [];\n  for (const project of getProjects(tree).values()) {\n    const components = ((\n      project.metadata as { components?: ComponentMetadata[] }\n    )?.components ?? []) as ComponentMetadata[];\n    for (const component of components) {\n      if (\n        !RUNTIME_IMAGE_GENERATOR_IDS.includes(component.generator) ||\n        !component.path\n      ) {\n        continue;\n      }\n      const dockerfile = joinPathFragments(\n        projectRoot(project),\n        component.path,\n        'Dockerfile',\n      );\n      if (tree.exists(dockerfile)) {\n        paths.push(dockerfile);\n      }\n    }\n  }\n  return paths;\n};\n\n/** A project's root, falling back to sourceRoot for the TS-solution layout. */\nconst projectRoot = (project: ProjectConfiguration): string =>\n  project.root ?? project.sourceRoot ?? '';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const filePath of runtimeImageDockerfiles(tree)) {\n    const content = tree.read(filePath, 'utf-8');\n    if (!content) {\n      continue;\n    }\n    if (content.includes(PIP_UNINSTALL)) {\n      continue; // Already stripped (migrated or user-added).\n    }\n\n    // Leave a customised Dockerfile alone: any pip usage other than this\n    // migration's removal (e.g. an added `pip install`) means stripping pip\n    // could break the image, so flag it for the user instead of editing.\n    const pipUsages = content.match(PIP_COMMAND) ?? [];\n    if (pipUsages.length > 0) {\n      nextSteps.push(\n        `In ${filePath}: this image uses pip (${pipUsages.join(', ')}), so it was left unchanged. pip's vendored packages carry known vulnerabilities flagged by the image scan — remove pip once it is no longer needed, e.g. \\`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\\`.`,\n      );\n      continue;\n    }\n\n    // Insert the pip removal after the FROM line and its trailing blank line,\n    // matching the spacing a freshly generated Dockerfile has.\n    const updated = content.replace(\n      /^(FROM\\s+\\S*python:.*\\n)\\n/m,\n      `$1\\n${PIP_REMOVAL}\\n\\n`,\n    );\n    if (updated === content) {\n      nextSteps.push(\n        `In ${filePath}: remove pip from the image so its vulnerable vendored packages are not scanned — add \\`RUN python -m pip uninstall -y pip && rm -rf /usr/local/lib/python*/site-packages/pip /usr/local/lib/python*/site-packages/pip-*.dist-info\\` after the FROM line (the runtime does not need pip).`,\n      );\n      continue;\n    }\n    tree.write(filePath, updated);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","formatFilesInSubtree","RUNTIME_IMAGE_GENERATOR_IDS","PIP_REMOVAL","PIP_UNINSTALL","PIP_COMMAND","runtimeImageDockerfiles","tree","paths","project","values","components","metadata","component","includes","generator","path","dockerfile","projectRoot","exists","push","root","sourceRoot","migration","nextSteps","filePath","content","read","pipUsages","match","length","join","updated","replace","write"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAIZ,aAAa;AACpB,SAASC,oBAAoB,QAAQ,2BAAwB;AAG7D;;;;;;;;;;;;;;CAcC,GAED;;;;;CAKC,GACD,MAAMC,8BAA8B;IAAC;IAAY;CAAgB;AAEjE,MAAMC,cAAc,CAAC;;;;;+DAK0C,CAAC;AAEhE,8EAA8E,GAC9E,MAAMC,gBAAgB;AAEtB,kFAAkF,GAClF,MAAMC,cAAc;AAEpB;;;;CAIC,GACD,MAAMC,0BAA0B,CAACC;IAC/B,MAAMC,QAAkB,EAAE;IAC1B,KAAK,MAAMC,WAAWV,YAAYQ,MAAMG,MAAM,GAAI;QAChD,MAAMC,aAAc,AAClBF,QAAQG,QAAQ,EACfD,cAAc,EAAE;QACnB,KAAK,MAAME,aAAaF,WAAY;YAClC,IACE,CAACT,4BAA4BY,QAAQ,CAACD,UAAUE,SAAS,KACzD,CAACF,UAAUG,IAAI,EACf;gBACA;YACF;YACA,MAAMC,aAAajB,kBACjBkB,YAAYT,UACZI,UAAUG,IAAI,EACd;YAEF,IAAIT,KAAKY,MAAM,CAACF,aAAa;gBAC3BT,MAAMY,IAAI,CAACH;YACb;QACF;IACF;IACA,OAAOT;AACT;AAEA,6EAA6E,GAC7E,MAAMU,cAAc,CAACT,UACnBA,QAAQY,IAAI,IAAIZ,QAAQa,UAAU,IAAI;AAExC,eAAe,eAAeC,UAC5BhB,IAAU;IAEV,MAAMiB,YAAsB,EAAE;IAE9B,KAAK,MAAMC,YAAYnB,wBAAwBC,MAAO;QACpD,MAAMmB,UAAUnB,KAAKoB,IAAI,CAACF,UAAU;QACpC,IAAI,CAACC,SAAS;YACZ;QACF;QACA,IAAIA,QAAQZ,QAAQ,CAACV,gBAAgB;YACnC,UAAU,6CAA6C;QACzD;QAEA,qEAAqE;QACrE,wEAAwE;QACxE,qEAAqE;QACrE,MAAMwB,YAAYF,QAAQG,KAAK,CAACxB,gBAAgB,EAAE;QAClD,IAAIuB,UAAUE,MAAM,GAAG,GAAG;YACxBN,UAAUJ,IAAI,CACZ,CAAC,GAAG,EAAEK,SAAS,uBAAuB,EAAEG,UAAUG,IAAI,CAAC,MAAM,ySAAyS,CAAC;YAEzW;QACF;QAEA,0EAA0E;QAC1E,2DAA2D;QAC3D,MAAMC,UAAUN,QAAQO,OAAO,CAC7B,+BACA,CAAC,IAAI,EAAE9B,YAAY,IAAI,CAAC;QAE1B,IAAI6B,YAAYN,SAAS;YACvBF,UAAUJ,IAAI,CACZ,CAAC,GAAG,EAAEK,SAAS,yRAAyR,CAAC;YAE3S;QACF;QACAlB,KAAK2B,KAAK,CAACT,UAAUO;IACvB;IAEA,MAAM/B,qBAAqBM;IAE3B,OAAO;QAAEiB;IAAU;AACrB"}

package/src/migrations/latest/waf-log-group-removal/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,57 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`waf-log-group-removal migration > should add a DESTROY removal policy and import to the rest api WAF log group 1`] = `
+"import { IAspect, Stack, RemovalPolicy } from 'aws-cdk-lib';
+import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { CfnLoggingConfiguration } from 'aws-cdk-lib/aws-wafv2';
+import { Construct } from 'constructs';
+
+export class RestApi extends Construct {
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+    const logsKey = new Key(this, 'WebAclLogsKey', { enableKeyRotation: true });
+    // The construct has another log group sharing the encryptionKey shape, so
+    // the migration must scope its rewrite to the WAF log group only.
+    const accessLogs = new LogGroup(this, 'AccessLogs', {
+      retention: RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+    });
+    const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
+      logGroupName: \`aws-waf-logs-\${apiName}-\${this.node.addr.slice(-8)}\`,
+      retention: RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+      // The log group name is deterministic, so retaining it on delete would
+      // orphan it and block re-creation (e.g. after a rolled-back deploy).
+      removalPolicy: RemovalPolicy.DESTROY,
+    });
+  }
+}
+"
+`;
+
+exports[`waf-log-group-removal migration > should add a DESTROY removal policy to the gateway WAF log group 1`] = `
+"import * as cdk from 'aws-cdk-lib';
+import * as kms from 'aws-cdk-lib/aws-kms';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import * as wafv2 from 'aws-cdk-lib/aws-wafv2';
+import { Construct } from 'constructs';
+
+export class AgentCoreGateway extends Construct {
+  private createWebAcl(metricPrefix: string): wafv2.CfnWebACL {
+    const logsKey = new kms.Key(this, 'WebAclLogsKey', {
+      enableKeyRotation: true,
+    });
+    const wafLogGroup = new logs.LogGroup(this, 'WebAclLogs', {
+      logGroupName: \`aws-waf-logs-\${metricPrefix}-\${this.node.addr.slice(-8)}\`,
+      retention: logs.RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+      // The log group name is deterministic, so retaining it on delete would
+      // orphan it and block re-creation (e.g. after a rolled-back deploy).
+      removalPolicy: cdk.RemovalPolicy.DESTROY,
+    });
+    return undefined as any;
+  }
+}
+"
+`;

package/src/migrations/latest/waf-log-group-removal/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Set RemovalPolicy.DESTROY on WAF log groups in the vended AgentCoreGateway and REST API constructs so a rolled-back deploy does not orphan them"
+}

package/src/migrations/latest/waf-log-group-removal/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MigrationReturnObject, Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/waf-log-group-removal/migration.js

@@ -0,0 +1,77 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { addDestructuredImport, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Vended WAF log groups have a deterministic name (WAFv2 requires the
+ * `aws-waf-logs-` prefix, so the name can't be CloudFormation-generated) and,
+ * without an explicit removal policy, inherit CloudFormation's default RETAIN
+ * for log groups. A rolled-back or replaced deploy then orphans the log group,
+ * so the next deploy fails to create one of the same name. Set
+ * `RemovalPolicy.DESTROY` so it is torn down with the stack, matching the
+ * vended user-identity (Cognito) construct.
+ */ const CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;
+const WAF_CONSTRUCTS = [
+    {
+        file: `${CONSTRUCTS_SRC}/core/agentcore-gateway/agentcore-gateway.ts`,
+        logGroupExpr: 'logs.LogGroup',
+        removalPolicyExpr: 'cdk.RemovalPolicy.DESTROY'
+    },
+    {
+        file: `${CONSTRUCTS_SRC}/core/api/rest-api.ts`,
+        logGroupExpr: 'LogGroup',
+        removalPolicyExpr: 'RemovalPolicy.DESTROY',
+        destructuredImport: 'RemovalPolicy'
+    }
+];
+const migrateConstruct = async (tree, construct, nextSteps)=>{
+    const { file, logGroupExpr } = construct;
+    if (!tree.exists(file)) {
+        // Construct not vended in this workspace - nothing to migrate.
+        return;
+    }
+    const contents = tree.read(file, 'utf-8') ?? '';
+    // The WAF web ACL (and its log group) is optional in some constructs, so it
+    // may be absent. Nothing to do if it is.
+    if (!contents.includes(`new ${logGroupExpr}(this, 'WebAclLogs'`)) {
+        return;
+    }
+    // Already migrated (or user-added a removal policy).
+    if (await matchGritQL(tree, file, `\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\` where { $props <: contains \`removalPolicy\` }`)) {
+        return;
+    }
+    // Append the removal policy after the WAF log group's `encryptionKey`
+    // property. The rewrite is scoped to the `WebAclLogs` LogGroup because a
+    // construct can have other log groups sharing the `encryptionKey: logsKey`
+    // shape (e.g. the rest api's access logs).
+    const added = await insertViaGritQL(tree, file, `\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\` where {
+  $props <: contains \`encryptionKey: logsKey\` as $enc,
+  $enc => \`encryptionKey: logsKey,
+      __GRIT_INSERT_PLACEHOLDER__\`
+}`, `// The log group name is deterministic, so retaining it on delete would
+      // orphan it and block re-creation (e.g. after a rolled-back deploy).
+      removalPolicy: ${construct.removalPolicyExpr}`);
+    if (!added) {
+        nextSteps.push(`${file}: could not add a removal policy to the WAF log group automatically - it may have diverged from the generated shape. Add \`removalPolicy: ${construct.removalPolicyExpr}\` to the \`new ${logGroupExpr}(this, 'WebAclLogs', ...)\` call so a rolled-back deploy does not orphan the log group.`);
+        return;
+    }
+    if (construct.destructuredImport) {
+        await addDestructuredImport(tree, file, [
+            construct.destructuredImport
+        ], 'aws-cdk-lib');
+    }
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const construct of WAF_CONSTRUCTS){
+        await migrateConstruct(tree, construct, nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/waf-log-group-removal/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/waf-log-group-removal/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Vended WAF log groups have a deterministic name (WAFv2 requires the\n * `aws-waf-logs-` prefix, so the name can't be CloudFormation-generated) and,\n * without an explicit removal policy, inherit CloudFormation's default RETAIN\n * for log groups. A rolled-back or replaced deploy then orphans the log group,\n * so the next deploy fails to create one of the same name. Set\n * `RemovalPolicy.DESTROY` so it is torn down with the stack, matching the\n * vended user-identity (Cognito) construct.\n */\n\nconst CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;\n\n/**\n * A vended construct carrying a WAF log group. They differ in how the log\n * group is constructed and how `cdk` is imported: the gateway namespaces both\n * (`logs.LogGroup`, `cdk.RemovalPolicy`), the rest api destructures both\n * (`LogGroup`, `RemovalPolicy` — the latter added by this migration when\n * absent).\n */\ninterface WafConstruct {\n  file: string;\n  /** How `LogGroup` is referenced in this file (`LogGroup` or `logs.LogGroup`). */\n  logGroupExpr: string;\n  /** The removal policy expression, matching the file's import style. */\n  removalPolicyExpr: string;\n  /** When set, ensure this destructured import from `aws-cdk-lib`. */\n  destructuredImport?: string;\n}\n\nconst WAF_CONSTRUCTS: WafConstruct[] = [\n  {\n    file: `${CONSTRUCTS_SRC}/core/agentcore-gateway/agentcore-gateway.ts`,\n    logGroupExpr: 'logs.LogGroup',\n    removalPolicyExpr: 'cdk.RemovalPolicy.DESTROY',\n  },\n  {\n    file: `${CONSTRUCTS_SRC}/core/api/rest-api.ts`,\n    logGroupExpr: 'LogGroup',\n    removalPolicyExpr: 'RemovalPolicy.DESTROY',\n    destructuredImport: 'RemovalPolicy',\n  },\n];\n\nconst migrateConstruct = async (\n  tree: Tree,\n  construct: WafConstruct,\n  nextSteps: string[],\n): Promise<void> => {\n  const { file, logGroupExpr } = construct;\n  if (!tree.exists(file)) {\n    // Construct not vended in this workspace - nothing to migrate.\n    return;\n  }\n\n  const contents = tree.read(file, 'utf-8') ?? '';\n\n  // The WAF web ACL (and its log group) is optional in some constructs, so it\n  // may be absent. Nothing to do if it is.\n  if (!contents.includes(`new ${logGroupExpr}(this, 'WebAclLogs'`)) {\n    return;\n  }\n\n  // Already migrated (or user-added a removal policy).\n  if (\n    await matchGritQL(\n      tree,\n      file,\n      `\\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\\` where { $props <: contains \\`removalPolicy\\` }`,\n    )\n  ) {\n    return;\n  }\n\n  // Append the removal policy after the WAF log group's `encryptionKey`\n  // property. The rewrite is scoped to the `WebAclLogs` LogGroup because a\n  // construct can have other log groups sharing the `encryptionKey: logsKey`\n  // shape (e.g. the rest api's access logs).\n  const added = await insertViaGritQL(\n    tree,\n    file,\n    `\\`new ${logGroupExpr}(this, 'WebAclLogs', { $props })\\` where {\n  $props <: contains \\`encryptionKey: logsKey\\` as $enc,\n  $enc => \\`encryptionKey: logsKey,\n      __GRIT_INSERT_PLACEHOLDER__\\`\n}`,\n    `// The log group name is deterministic, so retaining it on delete would\n      // orphan it and block re-creation (e.g. after a rolled-back deploy).\n      removalPolicy: ${construct.removalPolicyExpr}`,\n  );\n\n  if (!added) {\n    nextSteps.push(\n      `${file}: could not add a removal policy to the WAF log group automatically - it may have diverged from the generated shape. Add \\`removalPolicy: ${construct.removalPolicyExpr}\\` to the \\`new ${logGroupExpr}(this, 'WebAclLogs', ...)\\` call so a rolled-back deploy does not orphan the log group.`,\n    );\n    return;\n  }\n\n  if (construct.destructuredImport) {\n    await addDestructuredImport(\n      tree,\n      file,\n      [construct.destructuredImport],\n      'aws-cdk-lib',\n    );\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const construct of WAF_CONSTRUCTS) {\n    await migrateConstruct(tree, construct, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["addDestructuredImport","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","CONSTRUCTS_SRC","WAF_CONSTRUCTS","file","logGroupExpr","removalPolicyExpr","destructuredImport","migrateConstruct","tree","construct","nextSteps","exists","contents","read","includes","added","push","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,qBAAqB,EACrBC,eAAe,EACfC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAA6C;AAEpD;;;;;;;;CAQC,GAED,MAAMC,iBAAiB,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,IAAI,CAAC;AAmBrE,MAAME,iBAAiC;IACrC;QACEC,MAAM,GAAGF,eAAe,4CAA4C,CAAC;QACrEG,cAAc;QACdC,mBAAmB;IACrB;IACA;QACEF,MAAM,GAAGF,eAAe,qBAAqB,CAAC;QAC9CG,cAAc;QACdC,mBAAmB;QACnBC,oBAAoB;IACtB;CACD;AAED,MAAMC,mBAAmB,OACvBC,MACAC,WACAC;IAEA,MAAM,EAAEP,IAAI,EAAEC,YAAY,EAAE,GAAGK;IAC/B,IAAI,CAACD,KAAKG,MAAM,CAACR,OAAO;QACtB,+DAA+D;QAC/D;IACF;IAEA,MAAMS,WAAWJ,KAAKK,IAAI,CAACV,MAAM,YAAY;IAE7C,4EAA4E;IAC5E,yCAAyC;IACzC,IAAI,CAACS,SAASE,QAAQ,CAAC,CAAC,IAAI,EAAEV,aAAa,mBAAmB,CAAC,GAAG;QAChE;IACF;IAEA,qDAAqD;IACrD,IACE,MAAMP,YACJW,MACAL,MACA,CAAC,MAAM,EAAEC,aAAa,iFAAiF,CAAC,GAE1G;QACA;IACF;IAEA,sEAAsE;IACtE,yEAAyE;IACzE,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAMW,QAAQ,MAAMnB,gBAClBY,MACAL,MACA,CAAC,MAAM,EAAEC,aAAa;;;;CAIzB,CAAC,EACE,CAAC;;qBAEgB,EAAEK,UAAUJ,iBAAiB,EAAE;IAGlD,IAAI,CAACU,OAAO;QACVL,UAAUM,IAAI,CACZ,GAAGb,KAAK,0IAA0I,EAAEM,UAAUJ,iBAAiB,CAAC,gBAAgB,EAAED,aAAa,uFAAuF,CAAC;QAEzS;IACF;IAEA,IAAIK,UAAUH,kBAAkB,EAAE;QAChC,MAAMX,sBACJa,MACAL,MACA;YAACM,UAAUH,kBAAkB;SAAC,EAC9B;IAEJ;AACF;AAEA,eAAe,eAAeW,UAC5BT,IAAU;IAEV,MAAME,YAAsB,EAAE;IAE9B,KAAK,MAAMD,aAAaP,eAAgB;QACtC,MAAMK,iBAAiBC,MAAMC,WAAWC;IAC1C;IAEA,MAAMZ,qBAAqBU;IAE3B,OAAO;QAAEE;IAAU;AACrB"}

package/src/py/agent/__snapshots__/generator.constructs.spec.ts.snap

@@ -3,6 +3,13 @@
 exports[`py#agent generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > agent-Dockerfile 1`] = `
 "FROM public.ecr.aws/docker/library/python:3.14-slim
 
+# Remove the base image's pip: the agent runs from the bundled environment and
+# never needs it at runtime, and pip's vendored packages carry known
+# HIGH/CRITICAL vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \\
+    rm -rf /usr/local/lib/python*/site-packages/pip \\
+           /usr/local/lib/python*/site-packages/pip-*.dist-info
+
 WORKDIR /app
 
 # Copy bundled package
@@ -57,6 +64,8 @@ export class SnapshotBedrockAgent
   public readonly agentCoreRuntime: Runtime;
   /** Default Gateway target name for this agent. */
   public readonly agentName = 'snapshot-bedrock-agent';
+  /** Inbound auth — a fronting Gateway uses this to pick its outbound credential. */
+  public readonly auth = 'iam';
 
   constructor(scope: Construct, id: string, props?: SnapshotBedrockAgentProps) {
     super(scope, id);

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -506,6 +506,14 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
     }
   }
 
+  # Receive the caller's Authorization header (validated by the JWT authorizer).
+  dynamic "request_header_configuration" {
+    for_each = var.authorizer_configuration != null && try(var.authorizer_configuration.custom_jwt_authorizer, null) != null ? [1] : []
+    content {
+      request_header_allowlist = ["Authorization"]
+    }
+  }
+
   network_configuration {
     network_mode = var.enable_vpc ? "VPC" : "PUBLIC"
 

package/src/py/agent/files/deploy/Dockerfile.template

@@ -1,5 +1,12 @@
 FROM <%- pythonBaseImage %>
 
+# Remove the base image's pip: the agent runs from the bundled environment and
+# never needs it at runtime, and pip's vendored packages carry known
+# HIGH/CRITICAL vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \
+    rm -rf /usr/local/lib/python*/site-packages/pip \
+           /usr/local/lib/python*/site-packages/pip-*.dist-info
+
 WORKDIR /app
 
 # Copy bundled package

package/src/py/fast-api/__snapshots__/generator.spec.ts.snap

@@ -1085,7 +1085,7 @@ import {
   Stage,
   ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigateway';
-import { IAspect, Stack } from 'aws-cdk-lib';
+import { IAspect, RemovalPolicy, Stack } from 'aws-cdk-lib';
 import {
   CfnLoggingConfiguration,
   CfnWebACL,
@@ -1284,6 +1284,9 @@ export class RestApi<
         logGroupName: \`aws-waf-logs-\${apiName}-\${this.node.addr.slice(-8)}\`,
         retention: RetentionDays.ONE_YEAR,
         encryptionKey: logsKey,
+        // The log group name is deterministic, so retaining it on delete would
+        // orphan it and block re-creation (e.g. after a rolled-back deploy).
+        removalPolicy: RemovalPolicy.DESTROY,
       });
 
       new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {

package/src/py/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -527,6 +527,14 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
     }
   }
 
+  # Receive the caller's Authorization header (validated by the JWT authorizer).
+  dynamic "request_header_configuration" {
+    for_each = var.authorizer_configuration != null && try(var.authorizer_configuration.custom_jwt_authorizer, null) != null ? [1] : []
+    content {
+      request_header_allowlist = ["Authorization"]
+    }
+  }
+
   network_configuration {
     network_mode = var.enable_vpc ? "VPC" : "PUBLIC"
 

package/src/py/mcp-server/files/deploy/Dockerfile.template

@@ -1,5 +1,12 @@
 FROM <%- pythonBaseImage %>
 
+# Remove the base image's pip: the server runs from the bundled environment and
+# never needs it at runtime, and pip's vendored packages carry known
+# HIGH/CRITICAL vulnerabilities flagged by the image scan.
+RUN python -m pip uninstall -y pip && \
+    rm -rf /usr/local/lib/python*/site-packages/pip \
+           /usr/local/lib/python*/site-packages/pip-*.dist-info
+
 WORKDIR /app
 
 # Copy bundled package

package/src/trpc/backend/__snapshots__/generator.spec.ts.snap

@@ -2122,7 +2122,7 @@ import {
   Stage,
   ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigateway';
-import { IAspect, Stack } from 'aws-cdk-lib';
+import { IAspect, RemovalPolicy, Stack } from 'aws-cdk-lib';
 import {
   CfnLoggingConfiguration,
   CfnWebACL,
@@ -2321,6 +2321,9 @@ export class RestApi<
         logGroupName: \`aws-waf-logs-\${apiName}-\${this.node.addr.slice(-8)}\`,
         retention: RetentionDays.ONE_YEAR,
         encryptionKey: logsKey,
+        // The log group name is deterministic, so retaining it on delete would
+        // orphan it and block re-creation (e.g. after a rolled-back deploy).
+        removalPolicy: RemovalPolicy.DESTROY,
       });
 
       new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {

package/src/ts/agent/__snapshots__/generator.spec.ts.snap

@@ -724,6 +724,8 @@ export class SnapshotBedrockAgent
   public readonly agentCoreRuntime: Runtime;
   /** Default Gateway target name for this agent. */
   public readonly agentName = 'snapshot-bedrock-agent';
+  /** Inbound auth — a fronting Gateway uses this to pick its outbound credential. */
+  public readonly auth = 'iam';
 
   constructor(scope: Construct, id: string, props?: SnapshotBedrockAgentProps) {
     super(scope, id);
@@ -1633,6 +1635,14 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
     }
   }
 
+  # Receive the caller's Authorization header (validated by the JWT authorizer).
+  dynamic "request_header_configuration" {
+    for_each = var.authorizer_configuration != null && try(var.authorizer_configuration.custom_jwt_authorizer, null) != null ? [1] : []
+    content {
+      request_header_allowlist = ["Authorization"]
+    }
+  }
+
   network_configuration {
     network_mode = var.enable_vpc ? "VPC" : "PUBLIC"
 
@@ -2359,6 +2369,8 @@ export class InMemoryAgent
   public readonly agentCoreRuntime: Runtime;
   /** Default Gateway target name for this agent. */
   public readonly agentName = 'in-memory-agent';
+  /** Inbound auth — a fronting Gateway uses this to pick its outbound credential. */
+  public readonly auth = 'iam';
 
   constructor(scope: Construct, id: string, props?: InMemoryAgentProps) {
     super(scope, id);

package/src/ts/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -527,6 +527,14 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
     }
   }
 
+  # Receive the caller's Authorization header (validated by the JWT authorizer).
+  dynamic "request_header_configuration" {
+    for_each = var.authorizer_configuration != null && try(var.authorizer_configuration.custom_jwt_authorizer, null) != null ? [1] : []
+    content {
+      request_header_allowlist = ["Authorization"]
+    }
+  }
+
   network_configuration {
     network_mode = var.enable_vpc ? "VPC" : "PUBLIC"
 

package/src/utils/agent-core-constructs/files/cdk/app/agent-core/__nameKebabCase__/__nameKebabCase__.ts.template

@@ -69,6 +69,8 @@ export class <%- nameClassName %> extends Construct implements IGrantable, IConn
 <%_ } else { _%>
   /** Default Gateway target name for this agent. */
   public readonly agentName = '<%- nameKebabCase %>';
+  /** Inbound auth — a fronting Gateway uses this to pick its outbound credential. */
+  public readonly auth = '<%- auth %>';
 <%_ } _%>
 
   constructor(scope: Construct, id: string, props<%_ if (auth !== 'cognito') { _%>?<%_ } _%>: <%- nameClassName %>Props) {
@@ -207,6 +209,10 @@ export class <%- nameClassName %> extends Construct implements IGrantable, IConn
         identity.userPool,
         [identity.userPoolClient],
       ),
+      // Receive the caller's Authorization header (validated by the authorizer).
+      requestHeaderConfiguration: {
+        allowlistedHeaders: ['Authorization'],
+      },
       ...restProps,
 <%_ } else { _%>
       ...props,

package/src/utils/agent-core-constructs/files/cdk/core/agentcore-gateway/agentcore-gateway.ts.template

@@ -266,6 +266,9 @@ export class AgentCoreGateway extends Construct implements iam.IGrantable {
       logGroupName: `aws-waf-logs-${metricPrefix}-${this.node.addr.slice(-8)}`,
       retention: logs.RetentionDays.ONE_YEAR,
       encryptionKey: logsKey,
+      // The log group name is deterministic, so retaining it on delete would
+      // orphan it and block re-creation (e.g. after a rolled-back deploy).
+      removalPolicy: cdk.RemovalPolicy.DESTROY,
     });
 
     new wafv2.CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
@@ -458,6 +461,7 @@ export class AgentCoreGateway extends Construct implements iam.IGrantable {
     agent: Construct & {
       readonly agentCoreRuntime: agentcore.Runtime;
       readonly agentName: string;
+      readonly auth?: 'iam' | 'cognito';
     },
     props?: {
       gatewayTargetName?: string;
@@ -466,16 +470,22 @@ export class AgentCoreGateway extends Construct implements iam.IGrantable {
     return this.addAgentTarget({
       gatewayTargetName: props?.gatewayTargetName ?? agent.agentName,
       agentRuntimeArn: agent.agentCoreRuntime.agentRuntimeArn,
+      credentials: agent.auth === 'cognito' ? 'jwt-passthrough' : 'gateway-iam',
     });
   }
 
   /**
    * Register an agent runtime ARN as a Gateway target. Prefer
    * {@link addAgent} when the construct is in scope.
+   *
+   * `credentials` selects the outbound authorization to the runtime:
+   * `gateway-iam` (default) signs with the gateway role; `jwt-passthrough`
+   * forwards the caller's JWT so the runtime authorizes on it.
    */
   public addAgentTarget(props: {
     gatewayTargetName: string;
     agentRuntimeArn: string;
+    credentials?: 'gateway-iam' | 'jwt-passthrough';
   }): agentcore.CfnGatewayTarget {
     if (this.protocol !== 'http') {
       throw new Error(
@@ -500,11 +510,12 @@ export class AgentCoreGateway extends Construct implements iam.IGrantable {
             },
           },
         },
-        // The bare gateway IAM role credential: runtime targets reject the
-        // iamCredentialProvider detail MCP targets carry.
         credentialProviderConfigurations: [
           {
-            credentialProviderType: 'GATEWAY_IAM_ROLE',
+            credentialProviderType:
+              props.credentials === 'jwt-passthrough'
+                ? 'JWT_PASSTHROUGH'
+                : 'GATEWAY_IAM_ROLE',
           },
         ],
       },

package/src/utils/agent-core-constructs/files/terraform/core/agent-core/runtime.tf.template

@@ -376,6 +376,14 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
     }
   }
 
+  # Receive the caller's Authorization header (validated by the JWT authorizer).
+  dynamic "request_header_configuration" {
+    for_each = var.authorizer_configuration != null && try(var.authorizer_configuration.custom_jwt_authorizer, null) != null ? [1] : []
+    content {
+      request_header_allowlist = ["Authorization"]
+    }
+  }
+
   network_configuration {
     network_mode = var.enable_vpc ? "VPC" : "PUBLIC"
 

package/src/utils/api-constructs/files/cdk/core/api/rest/rest-api.ts.template

@@ -10,7 +10,7 @@ import {
   Stage,
   ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigateway';
-import { IAspect, Stack } from 'aws-cdk-lib';
+import { IAspect, RemovalPolicy, Stack } from 'aws-cdk-lib';
 import {
   CfnLoggingConfiguration,
   CfnWebACL,
@@ -209,6 +209,9 @@ export class RestApi<
         logGroupName: `aws-waf-logs-${apiName}-${this.node.addr.slice(-8)}`,
         retention: RetentionDays.ONE_YEAR,
         encryptionKey: logsKey,
+        // The log group name is deterministic, so retaining it on delete would
+        // orphan it and block re-creation (e.g. after a rolled-back deploy).
+        removalPolicy: RemovalPolicy.DESTROY,
       });
 
       new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {