fix(bedrock-agentcore-alpha): default Cognito User Pool for AgentCore Gateway is not set up for M2M authentication.

[mazyu36]

Issue # (if applicable)

N/A

Reason for this change

Gateway requires M2M authentication for service-to-service communication. The default Cognito authorizer was missing OAuth 2.0 client credentials flow configuration, making Gateway unusable for its intended purpose.

Description of changes

Updated the default Cognito authorizer configuration to support M2M authentication:

• Added Cognito Resource Server with read and write scopes
• Enabled OAuth 2.0 client credentials flow in User Pool Client
• Created Cognito Domain for OAuth2 token endpoint access
• Exposed Cognito resources (userPool, userPoolClient, userPoolDomain, resourceServer) as public properties for Runtime integration

Ref:

• https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/common-use-cases.html
• https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity-idp-cognito.html
• https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-building-adding-targets-authorization.html

Describe any new or updated permissions being added

N/A

Description of how you validated changes

Add unit tests and an integ test.

BREAKING CHANGE: The User Pool Client will be replaced and new Resource Server and Domain resources will be added for existing Gateway stacks using the default Cognito authorizer.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

	Tests	Passed ☑️	Skipped	Failed ❌️
Security Guardian Results	130 ran	127 passed		3 failed

Test	Result
Security Guardian Results
packages/@aws-cdk/aws-bedrock-agentcore-alpha/test/agentcore/gateway/integ.gateway-with-runtime-m2m.js.snapshot/BedrockAgentCoreRuntimeGatewayM2MIntegTest.template.json
iam-no-wildcard-actions-inline.guard	❌ failure
packages/@aws-cdk/aws-bedrock-agentcore-alpha/test/agentcore/gateway/integ.gateway.js.snapshot/BedrockAgentCoreGatewayIntegTest.template.json
iam-no-wildcard-actions-inline.guard	❌ failure
packages/@aws-cdk/aws-bedrock-agentcore-alpha/test/agentcore/gateway/integ.target.js.snapshot/BedrockAgentCoreTargetIntegTest.template.json
iam-no-wildcard-actions-inline.guard	❌ failure

• View Security Guardian Results

[github-actions]

	Tests	Passed ☑️	Skipped	Failed ❌️
Security Guardian Results with resolved templates	130 ran	127 passed		3 failed

Test	Result
Security Guardian Results with resolved templates
packages/@aws-cdk/aws-bedrock-agentcore-alpha/test/agentcore/gateway/integ.gateway-with-runtime-m2m.js.snapshot/BedrockAgentCoreRuntimeGatewayM2MIntegTest.template.json
iam-no-wildcard-actions-inline.guard	❌ failure
packages/@aws-cdk/aws-bedrock-agentcore-alpha/test/agentcore/gateway/integ.gateway.js.snapshot/BedrockAgentCoreGatewayIntegTest.template.json
iam-no-wildcard-actions-inline.guard	❌ failure
packages/@aws-cdk/aws-bedrock-agentcore-alpha/test/agentcore/gateway/integ.target.js.snapshot/BedrockAgentCoreTargetIntegTest.template.json
iam-no-wildcard-actions-inline.guard	❌ failure

• View Security Guardian Results with resolved templates