I created an agent that utilizes the Identity feature to implement Cognito authentication and Azure OpenAI integration

strands-agents
strands-agents-tools
boto3
litellm
openai
bedrock-agentcore
bedrock-agentcore-starter-toolkit
python-dotenv

# Create and activate a virtual environment
python3 -m venv agentcore-env
source agentcore-env/bin/activate

# Install dependencies
pip install -r requirements.txt

# Cognito Configuration (to be filled in later)
DISCOVERY_URL=placeholder
CLIENT_ID=placeholder
USERNAME=testuser
PASSWORD=Testpass123!
REGION=us-west-2

# IAM Role (to be filled in later)
ROLE_ARN=placeholder

# Agent Name (you can set any agent name)
AGENT_NAME=strands_sample_agent

# Azure OpenAI Configuration  
AZURE_DEPLOYMENT_NAME=gpt-4.1-mini
AZURE_API_BASE=https://your-resource.openai.azure.com/
AZURE_API_VERSION=2025-01-01-preview

#!/bin/bash

# Cognito User Pool creation script
# AgentCore only works in us-west-2, so we fix the region
REGION="us-west-2"

# Create User Pool
echo "Creating Cognito User Pool..."
POOL_ID=$(aws cognito-idp create-user-pool \
  --pool-name "MyUserPool" \
  --policies '{"PasswordPolicy":{"MinimumLength":8}}' \
  --region $REGION | jq -r '.UserPool.Id')

# Create App Client (important: enable USER_PASSWORD_AUTH flow)
echo "Creating App Client..."
CLIENT_ID=$(aws cognito-idp create-user-pool-client \
  --user-pool-id $POOL_ID \
  --client-name "MyClient" \
  --no-generate-secret \
  --explicit-auth-flows "ALLOW_USER_PASSWORD_AUTH" "ALLOW_REFRESH_TOKEN_AUTH" \
  --region $REGION | jq -r '.UserPoolClient.ClientId')

# Create a test user
echo "Creating test user..."
aws cognito-idp admin-create-user \
  --user-pool-id $POOL_ID \
  --username "testuser" \
  --temporary-password "TempPass123!" \
  --region $REGION \
  --message-action SUPPRESS > /dev/null

# Set permanent password
aws cognito-idp admin-set-user-password \
  --user-pool-id $POOL_ID \
  --username "testuser" \
  --password "Testpass123!" \
  --region $REGION \
  --permanent > /dev/null

# Output configuration
echo "===== Cognito Setup Complete ====="
echo "Pool ID: $POOL_ID"
echo "Discovery URL: https://cognito-idp.us-west-2.amazonaws.com/$POOL_ID/.well-known/openid-configuration"
echo "Client ID: $CLIENT_ID"
echo "Username: testuser"
echo "Password: Testpass123!"

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AssumeRolePolicy",
            "Effect": "Allow",
            "Principal": {
                "Service": "bedrock-agentcore.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "123456789012"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:bedrock-agentcore:us-west-2:123456789012:*"
                }
            }
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ECRImageAccess",
            "Effect": "Allow",
            "Action": [
                "ecr:BatchGetImage",
                "ecr:GetDownloadUrlForLayer"
            ],
            "Resource": [
                "arn:aws:ecr:us-west-2:123456789012:repository/*"
            ]
        },
        {
            "Sid": "ECRTokenAccess",
            "Effect": "Allow",
            "Action": [
                "ecr:GetAuthorizationToken"
            ],
            "Resource": "*"
        },
        {
            "Sid": "LogsAccess",
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogStreams",
                "logs:CreateLogGroup",
                "logs:DescribeLogGroups",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:us-west-2:123456789012:log-group:*"
            ]
        },
        {
            "Sid": "XRayAccess",
            "Effect": "Allow",
            "Action": [
                "xray:PutTraceSegments",
                "xray:PutTelemetryRecords",
                "xray:GetSamplingRules",
                "xray:GetSamplingTargets"
            ],
            "Resource": ["*"]
        },
        {
            "Sid": "CloudWatchMetrics",
            "Effect": "Allow",
            "Resource": "*",
            "Action": "cloudwatch:PutMetricData",
            "Condition": {
                "StringEquals": {
                    "cloudwatch:namespace": "bedrock-agentcore"
                }
            }
        },
        {
            "Sid": "GetAgentAccessToken",
            "Effect": "Allow",
            "Action": [
                "bedrock-agentcore:GetWorkloadAccessToken",
                "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
                "bedrock-agentcore:GetWorkloadAccessTokenForUserId"
            ],
            "Resource": [
                "arn:aws:bedrock-agentcore:us-west-2:123456789012:workload-identity-directory/default",
                "arn:aws:bedrock-agentcore:us-west-2:123456789012:workload-identity-directory/default/*"
            ]
        },
        {
            "Sid": "BedrockModelInvocation",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:*::foundation-model/*",
                "arn:aws:bedrock:us-west-2:123456789012:*"
            ]
        },
        {
            "Sid": "CredentialProviderAccess",
            "Effect": "Allow",
            "Action": [
                "bedrock-agentcore:GetApiKeyCredentialProvider",
                "bedrock-agentcore:GetOauth2CredentialProvider",
                "bedrock-agentcore:CreateApiKeyCredentialProvider",
                "bedrock-agentcore:CreateOauth2CredentialProvider",
                "bedrock-agentcore:GetResourceApiKey"
            ],
            "Resource": [
                "arn:aws:bedrock-agentcore:us-west-2:123456789012:workload-identity-directory/*",
                "arn:aws:bedrock-agentcore:us-west-2:123456789012:token-vault/*"
            ]
        },
        {
            "Sid": "SecretsManagerAccess",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue"
            ],
            "Resource": "*"
        }
    ]
}

#!/bin/bash

# Get account ID and region
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
REGION="us-west-2"
AGENT_NAME="${AGENT_NAME:-strands_full_auth_agent}"

# Replace placeholders in JSON files
sed -i.bak "s/123456789012/$ACCOUNT_ID/g" trust-policy.json
sed -i.bak "s/123456789012/$ACCOUNT_ID/g" execution-policy.json

# Create IAM role
ROLE_NAME="AgentCoreExecutionRole-$(date +%s)"

aws iam create-role \
    --role-name $ROLE_NAME \
    --assume-role-policy-document file://trust-policy.json

# Create and attach policy
aws iam put-role-policy \
    --role-name $ROLE_NAME \
    --policy-name AgentCoreExecutionPolicy \
    --policy-document file://execution-policy.json

# Get role ARN
ROLE_ARN=$(aws iam get-role --role-name $ROLE_NAME --query 'Role.Arn' --output text)
echo "✅ IAM Role created: $ROLE_ARN"
export ROLE_ARN

# Save environment variable to file
echo "export ROLE_ARN=\"$ROLE_ARN\"" > role_vars.sh
echo "IAM Role ARN has been saved to role_vars.sh"

import os
from bedrock_agentcore.identity.auth import requires_api_key
from strands import Agent, tool
from strands.models.litellm import LiteLLMModel
from bedrock_agentcore.runtime import BedrockAgentCoreApp

# Manage API key with global variable
AZURE_API_KEY_FROM_CREDS_PROVIDER = ""

# Outbound Auth: Function with decorator to get API key
# This decorator automatically retrieves the API key from token-vault!
@requires_api_key(
    provider_name="azure-openai-key"  # Provider name created in Step 4
)
async def need_api_key(*, api_key: str):
    global AZURE_API_KEY_FROM_CREDS_PROVIDER
    print(f'✅ Got API key from Credential Provider: {api_key[:10]}...')
    AZURE_API_KEY_FROM_CREDS_PROVIDER = api_key

app = BedrockAgentCoreApp()

# Azure OpenAI settings (loaded from environment variables)
os.environ["AZURE_OPENAI_ENDPOINT"] = os.getenv("AZURE_OPENAI_ENDPOINT", "")
os.environ["AZURE_OPENAI_API_VERSION"] = os.getenv("AZURE_OPENAI_API_VERSION", "2025-01-01-preview")

# Custom tool definition (a simple tool that returns weather information)
@tool
def weather():
    """Get the current weather"""
    return "The current weather is sunny. It's a pleasant day"

# Manage agent as a global variable (initialize only once)
agent = None

@app.entrypoint
async def full_auth_agent(payload):
    """
    Entry point for the agent using both Inbound Auth (Cognito authentication)
    and Outbound Auth (Azure OpenAI)

    By the time this method is called, Cognito authentication has already been passed!
    """
    global AZURE_API_KEY_FROM_CREDS_PROVIDER, agent

    print("✅ Received Cognito-authenticated request")
    print(f"Received payload: {payload}")

    # Outbound Auth: Get API key only the first time
    # Reuse the key from the second time onwards
    if not AZURE_API_KEY_FROM_CREDS_PROVIDER:
        print("Outbound Auth: Getting Azure API key from Credential Provider...")
        try:
            await need_api_key(api_key="")  # The decorator automatically injects the key
            os.environ["AZURE_OPENAI_API_KEY"] = AZURE_API_KEY_FROM_CREDS_PROVIDER
            print("✅ Azure API key setup complete!")
        except Exception as e:
            print(f"❌ API key retrieval error: {e}")
            raise

    # Initialize agent (only once)
    # Initializing every time would be slow, so initialize once and reuse
    if agent is None:
        print("Initializing agent with Azure OpenAI model...")
        deployment_name = os.environ.get("AZURE_DEPLOYMENT_NAME", "gpt-4o-mini")
        model = f"azure/{deployment_name}"  # Format for LiteLLM
        print(f"Model to use: {model}")

        litellm_model = LiteLLMModel(
            model_id=model, 
            params={"max_tokens": 4096, "temperature": 0.7}
        )

        agent = Agent(
            model=litellm_model,
            tools=[calculator, weather],  # Add calculation and weather tools
            system_prompt="You are a helpful assistant. You can provide calculation and weather information."
        )
        print("✅ Agent initialization complete!")

    # Process user input
    user_input = payload.get("prompt", "Hello")
    print(f"User input: {user_input}")

    try:
        # Generate response using Azure OpenAI
        response = agent(user_input)
        result = response.message['content'][0]['text']
        print(f"Agent response: {result}")
        return result
    except Exception as e:
        print(f"❌ Agent processing error: {e}")
        return f"An error occurred: {str(e)}"

if __name__ == "__main__":
    app.run()

from bedrock_agentcore_starter_toolkit import Runtime
import os
from urllib.parse import urlencode
from dotenv import load_dotenv

def prepare_environment_variables():
    """Prepare all environment variables for the agent"""
    print("⚙️  Preparing environment variables...")

    # Prepare environment variables for the agent container
    env_vars = {
        # Azure OpenAI settings
        "AZURE_API_BASE": os.environ.get('AZURE_API_BASE', ''),
        "AZURE_API_VERSION": os.environ.get('AZURE_API_VERSION', '2025-01-01-preview'),
        "AZURE_DEPLOYMENT_NAME": os.environ.get('AZURE_DEPLOYMENT_NAME', 'gpt-4.1-mini'),
    }

    # Filter out empty values
    env_vars = {k: v for k, v in env_vars.items() if v}

    print(f"✅ Environment variables prepared: {list(env_vars.keys())}")
    return env_vars

def deploy_agent():
    """Deploy agent with integrated environment variable management"""
    print("🚀 Starting integrated deployment script...")

    # Load .env file using python-dotenv
    print("📋 Loading .env file...")
    if not load_dotenv():
        print("❌ .env file not found")
        return

    # Get required environment variables
    try:
        discovery_url = os.environ['DISCOVERY_URL']
        client_id = os.environ['CLIENT_ID']
        role_arn = os.environ['ROLE_ARN']
    except KeyError as e:
        print(f"❌ Required environment variable not set: {e}")
        return

    # Prepare environment variables for agent container
    env_vars = prepare_environment_variables()

    print("🔧 Configuring AgentCore Runtime...")

    # Configure AgentCore Runtime
    agentcore_runtime = Runtime()

    response = agentcore_runtime.configure(
        entrypoint="strands_full_auth_agent.py",
        execution_role=role_arn,
        auto_create_ecr=True,  # Automatically create ECR repository
        requirements_file="requirements.txt",
        region="us-west-2",
        # Can't use hyphens in agent names! Use underscores
        agent_name=os.environ.get('AGENT_NAME', 'strands_full_auth_agent'),
        # Inbound Auth: Cognito authentication settings
        authorizer_configuration={
            "customJWTAuthorizer": {
                "discoveryUrl": discovery_url,
                "allowedClients": [client_id]
            }
        }
    )

    print("✅ Configuration complete! Deploying...")

    # Execute deployment (inject environment variables)
    launch_result = agentcore_runtime.launch(env_vars=env_vars)

    print(f"✅ Deployment complete!")
    print(f"   Agent ARN: {launch_result.agent_arn}")

    return agentcore_runtime

if __name__ == "__main__":
    deploy_agent()

python deploy_agent.py

🚀 Starting integrated deployment script...
📋 Loading .env file...
⚙️  Preparing environment variables...
🔧 Configuring AgentCore Runtime...
✅ Configuration complete! Deploying...
✅ Deployment complete!
   Agent ARN: arn:aws:bedrock-agentcore:us-west-2:123456789012:agent/...

arn:aws:bedrock-agentcore:us-west-2:XXXXXXXXXXXX:runtime/strands_full_auth_agent-abc123

https://bedrock-agentcore.us-west-2.amazonaws.com/runtimes/arn%3Aaws%3Abedrock-agentcore%3Aus-west-2%3AXXXXXXXXXXXX%3Aruntime%2Fstrands_full_auth_agent-abc123/invocations?qualifier=DEFAULT

python get_token.py && source .token_env

# Get token
python get_token.py && source .token_env

# Call the agent (properly encode the ARN portion of the URL)
curl -X POST "https://bedrock-agentcore.us-west-2.amazonaws.com/runtimes/arn%3Aaws%3Abedrock-agentcore%3Aus-west-2%3AXXXXXXXXXXXX%3Aruntime%2Fstrands_full_auth_agent-{your-id}/invocations?qualifier=DEFAULT" \
  -H "Authorization: Bearer ${BEARER_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "What kind of AI are you?"}'

# Response
"I am a helpful assistant AI. I can answer questions, provide information, and offer various kinds of support. I can also provide weather information, so please let me know if there's anything you'd like to know."

curl -X POST "https://bedrock-agentcore.us-west-2.amazonaws.com/runtimes/..." \
  -H "Content-Type: application/json" \
  -d '{"prompt": "Hello"}'

# Error response
{"message":"Missing Authentication Token"}