Amazon Bedrock AgentCore GatewayのTargetにAgentCore RuntimeにデプロイしたMCP Serverを指定してみた

from mcp.server.fastmcp import FastMCP

mcp = FastMCP(host="0.0.0.0", stateless_http=True)

@mcp.tool()
def add_numbers(a: int, b: int) -> int:
    """Add two numbers together"""
    return a + b

@mcp.tool()
def multiply_numbers(a: int, b: int) -> int:
    """Multiply two numbers together"""
    return a * b

@mcp.tool()
def greet_user(name: str) -> str:
    """Greet a user by name"""
    return f"Hello, {name}! Nice to meet you."

if __name__ == "__main__":
    mcp.run(transport="streamable-http")

resource "aws_bedrockagentcore_gateway_target" "mcp_server" {
  name               = "${var.project_name}-mcp-target"
  gateway_identifier = aws_bedrockagentcore_gateway.main.gateway_id

  # Outbound Authentication: OAuth M2M (client_credentials)
  credential_provider_configuration {
    oauth {
      provider_arn = aws_bedrockagentcore_oauth2_credential_provider.m2m.credential_provider_arn
      scopes = [
        "${aws_cognito_resource_server.mcp.identifier}/tools.read",
        "${aws_cognito_resource_server.mcp.identifier}/tools.write",
        "${aws_cognito_resource_server.mcp.identifier}/tools.execute"
      ]
    }
  }

  # Target Configuration: MCP Server
  target_configuration {
    mcp {
      mcp_server {
        endpoint = "https://bedrock-agentcore.${data.aws_region.current.name}.amazonaws.com/runtimes/${urlencode(aws_bedrockagentcore_agent_runtime.mcp_server.agent_runtime_arn)}/invocations"
      }
    }
  }
}

resource "aws_bedrockagentcore_oauth2_credential_provider" "m2m" {
  name                       = "${var.project_name}-m2m-oauth2-provider"
  credential_provider_vendor = "CustomOauth2"

  oauth2_provider_config {
    custom_oauth2_provider_config {
      client_id     = aws_cognito_user_pool_client.m2m.id
      client_secret = aws_cognito_user_pool_client.m2m.client_secret

      oauth_discovery {
        discovery_url = "https://cognito-idp.${data.aws_region.current.name}.amazonaws.com/${aws_cognito_user_pool.outbound.id}/.well-known/openid-configuration"
      }
    }
  }
}

git clone https://github.com/yuu551/agentcore-gateway-runtime-m2m-auth-demo.git
cd agentcore-gateway-runtime-m2m-auth-demo

terraform init
terraform apply --auto-approve

INBOUND_USER_POOL_ID=$(terraform output -raw inbound_user_pool_id)
INBOUND_CLIENT_ID=$(terraform output -raw inbound_client_id)
export AWS_REGION=us-east-1 

aws cognito-idp admin-create-user \
  --user-pool-id $INBOUND_USER_POOL_ID \
  --username test-user \
  --temporary-password 'TempPass123!' \
  --message-action SUPPRESS

aws cognito-idp admin-set-user-password \
  --user-pool-id $INBOUND_USER_POOL_ID \
  --username test-user \
  --password 'TestPass123!' \
  --permanent

TOKEN=$(aws cognito-idp initiate-auth \
  --client-id $INBOUND_CLIENT_ID \
  --auth-flow USER_PASSWORD_AUTH \
  --auth-parameters USERNAME=test-user,PASSWORD='TestPass123!' \
  --query 'AuthenticationResult.AccessToken' \
  --output text)

GATEWAY_URL=$(terraform output -raw gateway_url)

curl -X POST "$GATEWAY_URL" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "tools": [
      {
        "inputSchema": {
          "type": "object",
          "properties": {
            "query": {
              "type": "string"
            }
          },
          "required": ["query"]
        },
        "name": "x_amz_bedrock_agentcore_search",
        "description": "A special tool that returns a trimmed down list of tools given a context. Use this tool only when there are many tools available and you want to get a subset that matches the provided context."
      },
      {
        "inputSchema": {
          "type": "object",
          "properties": {
            "a": { "type": "integer" },
            "b": { "type": "integer" }
          },
          "required": ["a", "b"]
        },
        "name": "m2m-auth-demo-mcp-target___add_numbers",
        "description": "Add two numbers together"
      },
      {
        "inputSchema": {
          "type": "object",
          "properties": {
            "name": { "type": "string" }
          },
          "required": ["name"]
        },
        "name": "m2m-auth-demo-mcp-target___greet_user",
        "description": "Greet a user by name"
      },
      {
        "inputSchema": {
          "type": "object",
          "properties": {
            "a": { "type": "integer" },
            "b": { "type": "integer" }
          },
          "required": ["a", "b"]
        },
        "name": "m2m-auth-demo-mcp-target___multiply_numbers",
        "description": "Multiply two numbers together"
      }
    ]
  }
}

curl -X POST "$GATEWAY_URL" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc":"2.0",
    "id":2,
    "method":"tools/call",
    "params":{
      "name":"m2m-auth-demo-mcp-target___add_numbers",
      "arguments":{"a": 5, "b": 3}
    }
  }' | jq

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [
      {
        "type": "text",
        "text": "8"
      }
    ],
    "isError": false,
    "structuredContent": {
      "result": 8
    }
  }
}

curl -X POST "$GATEWAY_URL" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc":"2.0",
    "id":3,
    "method":"tools/call",
    "params":{
      "name":"m2m-auth-demo-mcp-target___greet_user",
      "arguments":{"name": "Alice"}
    }
  }' | jq

{
  "jsonrpc": "2.0",
  "id": 3,
  "result": {
    "content": [
      {
        "type": "text",
        "text": "Hello, Alice! Nice to meet you."
      }
    ],
    "isError": false,
    "structuredContent": {
      "result": "Hello, Alice! Nice to meet you."
    }
  }
}

# ARNベースのURL
endpoint = "https://bedrock-agentcore.${region}.amazonaws.com/runtimes/${urlencode(runtime_arn)}/invocations"