r/aws_bedrockagentcore_oauth2_credential_provider: add on_behalf_of_token_exchange_config block

[rh0dy]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

No changes to the provider's own security controls. This adds a new optional configuration block that is passed through to the AWS Bedrock AgentCore API; the on-behalf-of token exchange it configures is brokered server-side by AWS AgentCore Identity. OAuth client credentials continue to be handled by the existing write-only attributes/AWS Secrets Manager integration on this resource and are unchanged.

Description

Adds the oauth2_provider_config.custom_oauth2_provider_config.on_behalf_of_token_exchange_config block to aws_bedrockagentcore_oauth2_credential_provider, enabling on-behalf-of (OBO) token exchange on custom OAuth2 credential providers.

The new block supports:

• grant_type (Required) TOKEN_EXCHANGE (RFC 8693) or JWT_AUTHORIZATION_GRANT (RFC 7523)
• token_exchange_grant_type_config (Optional) used with the TOKEN_EXCHANGE grant type:
  • actor_token_content (Required) M2M, AWS_IAM_ID_TOKEN_JWT, or NONE
  • actor_token_scopes (Optional) scopes for the actor token; only valid when actor_token_content is M2M

Includes acceptance test coverage and documentation.

Relations

Relates #48486.

References

• AWS docs: https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/on-behalf-of-token-exchange.html

Output from Acceptance Testing

make testacc PKG=bedrockagentcore TESTS=TestAccBedrockAgentCoreOAuth2CredentialProvider_onBehalfOfTokenExchange
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Validating schemas
ok      github.com/hashicorp/terraform-provider-aws/internal/provider/sdkv2     6.213s
ok      github.com/hashicorp/terraform-provider-aws/internal/provider/framework 6.513s
make: Running acceptance tests on branch: 🌿 main 🌿...
TF_ACC=1 go1.26.4 test ./internal/service/bedrockagentcore/... -v -count 1 -parallel 20 -run='TestAccBedrockAgentCoreOAuth2CredentialProvider_onBehalfOfTokenExchange'  -timeout 360m -vet=off -buildvcs=false
2026/06/26 22:23:21 Creating Terraform AWS Provider (SDKv2-style)...
2026/06/26 22:23:21 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccBedrockAgentCoreOAuth2CredentialProvider_onBehalfOfTokenExchange
=== PAUSE TestAccBedrockAgentCoreOAuth2CredentialProvider_onBehalfOfTokenExchange
=== CONT  TestAccBedrockAgentCoreOAuth2CredentialProvider_onBehalfOfTokenExchange
--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_onBehalfOfTokenExchange (34.14s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/bedrockagentcore   40.215s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[aidandaly24]

Hi @rh0dy, heads-up on some overlap we have #48517 open (opened a few days earlier) which adds this same on_behalf_of_token_exchange_config block as part of a broader custom_oauth2_provider_config expansion, atlassian/linkedin/included provider configs, client_secret_source/client_secret_config, client_authentication_method, and private-endpoint support. We're moving forward with #48517 for that surface, so the OBO block will likely land there, flagging so the effort isn't duplicated.

Thanks!