CognitoのOAuth 2.0トークン交換でMCP向けにスコープを絞る利用を試してみた

aws cognito-idp create-user-pool-client --user-pool-id <user-pool-id> --client-name mcp-actor-m2m --generate-secret --explicit-auth-flows ALLOW_CLIENT_TOKEN_AUTH --allowed-o-auth-flows client_credentials --allowed-o-auth-flows-user-pool-client --allowed-o-auth-scopes files/public.read

aws cognito-idp get-client-token --cli-input-json file:///tmp/actor-req.json

{
  "AccessToken": "<AccessToken: 862 chars>",
  "ExpiresIn": 3600,
  "TokenType": "Bearer"
}

#!/usr/bin/env python3
"""GetDerivedToken を HTTPS で直接呼ぶ（2026-11-13 時点で CLI/SDK に無いため）。
使い方: get-derived-token.py <リクエストJSONのファイル> [発行トークンの保存先]
- 署名なし。ClientId（+ ClientSecret）で認証する。
- 標準出力には、秘匿値（ClientSecret・SubjectToken・ActorToken・IssuedToken）を伏せたリクエストと応答を出す。
"""
import json, sys, urllib.request, urllib.error

REGION = "ap-northeast-1"
req = json.load(open(sys.argv[1]))
mask = lambda d: {k: (f"<{k}: {len(v)} chars>" if k in ("ClientSecret", "SubjectToken", "ActorToken", "IssuedToken") else v) for k, v in d.items()}
print("request:", json.dumps(mask(req), ensure_ascii=False))
r = urllib.request.Request(
    f"https://cognito-idp.{REGION}.amazonaws.com/",
    data=json.dumps(req).encode(),
    headers={
        "Content-Type": "application/x-amz-json-1.1",
        "X-Amz-Target": "AWSCognitoIdentityProviderService.GetDerivedToken",
    },
)
try:
    resp = urllib.request.urlopen(r)
    status, body = resp.status, resp.read()
except urllib.error.HTTPError as e:
    status, body = e.code, e.read()
print("HTTP", status)
out = json.loads(body)
if "IssuedToken" in out and len(sys.argv) > 2:
    open(sys.argv[2], "w").write(out["IssuedToken"])
print("response:", json.dumps(mask(out), ensure_ascii=False, indent=2))
sys.exit(0 if status == 200 else 1)

// API Gateway (Cognito オーソライザー) の背後で S3 の一覧を返す。
// スコープに応じて ListObjectsV2 の Prefix を変える。判定はこの Lambda の中。
import { S3Client, ListObjectsV2Command } from "@aws-sdk/client-s3";

const s3 = new S3Client({});

export const handler = async (event) => {
  const claims = event.requestContext.authorizer.claims;
  const scopes = (claims.scope || "").split(" ");
  const prefix = scopes.includes("files/private.read")
    ? ""
    : scopes.includes("files/public.read")
      ? "public/"
      : null;
  if (prefix === null) {
    return { statusCode: 403, body: JSON.stringify({ message: "no files scope" }) };
  }
  const res = await s3.send(
    new ListObjectsV2Command({ Bucket: process.env.BUCKET, Prefix: prefix }),
  );
  return {
    statusCode: 200,
    headers: { "content-type": "application/json" },
    body: JSON.stringify({
      scope: claims.scope,
      aud: claims.aud ?? null,
      client_id: claims.client_id ?? null,
      act: claims.act ?? null,
      prefix,
      keys: (res.Contents ?? []).map((o) => o.Key),
    }),
  };
};

aws apigateway put-method --rest-api-id <rest-api-id> --resource-id <resource-id> --http-method GET --authorization-type COGNITO_USER_POOLS --authorizer-id <authorizer-id> --authorization-scopes files/public.read files/private.read

{"customJWTAuthorizer":{"discoveryUrl":"https://cognito-idp.ap-northeast-1.amazonaws.com/<user-pool-id>/.well-known/openid-configuration","allowedClients":["<user-client-id>","<mcp-server-client-id>"],"allowedScopes":["files/private.read"]}}

aws bedrock-agentcore-control create-gateway --name devio-tx-1113-gw --role-arn <gateway-role-arn> --protocol-type MCP --authorizer-type CUSTOM_JWT --authorizer-configuration file://gw-authorizer.json

aws bedrock-agentcore-control create-gateway-target --gateway-identifier <gateway-id> --name tool --target-configuration '{"mcp":{"lambda":{"lambdaArn":"<tool-lambda-arn>","toolSchema":{"inlinePayload":[{"name":"list_files","description":"List all object keys in the bucket","inputSchema":{"type":"object","properties":{}}}]}}}}' --credential-provider-configurations file://gw-target-cred.json

// AgentCore Gateway の Lambda ターゲット用。スコープの判定は含まず、バケット全体の一覧を返す。
import { S3Client, ListObjectsV2Command } from "@aws-sdk/client-s3";

const s3 = new S3Client({});

export const handler = async () => {
  const res = await s3.send(new ListObjectsV2Command({ Bucket: process.env.BUCKET }));
  return { keys: (res.Contents ?? []).map((o) => o.Key) };
};

curl -sS -i -X POST -H "Authorization: Bearer <token>" -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"tool___list_files","arguments":{}}}' https://<gateway-id>.gateway.bedrock-agentcore.ap-northeast-1.amazonaws.com/mcp