r/aws_bedrockagentcore_oauth2_credential_provider: add atlassian/linkedin providers and external secret config

[aidandaly24]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

This adds support for referencing an externally-managed client secret stored in AWS Secrets Manager (client_secret_source = "EXTERNAL" + client_secret_config). It surfaces an existing service capability; it does not change provider-side access controls, encryption, or logging.

Description

Brings aws_bedrockagentcore_oauth2_credential_provider closer to full parity with the Oauth2ProviderConfigInput union in the AgentCore SDK. Two categories of gap are closed:

• New provider variants — adds atlassian_oauth2_provider_config and linkedin_oauth2_provider_config, matching the SDK union variants of the same names. Both follow the existing predefined-provider shape (client credentials + computed oauth_discovery).
• Externally-managed client secrets — adds client_secret_source (MANAGED / EXTERNAL) and the client_secret_config block (secret_id, json_key) to every OAuth2 provider configuration block, so a client secret can be sourced from an AWS Secrets Manager secret you manage.

The Oauth2ProviderConfigInput union has additional members (included) and the custom provider has further fields (private_endpoint, on_behalf_of_token_exchange_config, client_authentication_method) that are more complex and depend on nested union/struct shapes; those are deliberately left to a follow-up PR to keep this change reviewable.

Source of truth: aws-sdk-go-v2 service/bedrockagentcorecontrol v1.45.1 (the version pinned by the provider).

Relations

Relates #0000

References

• Oauth2ProviderConfigInput / AtlassianOauth2ProviderConfigInput / LinkedinOauth2ProviderConfigInput / SecretReference in aws-sdk-go-v2 service/bedrockagentcorecontrol@v1.45.1

Output from Acceptance Testing

% make testacc TESTS='TestAccBedrockAgentCoreOAuth2CredentialProvider_(basic|atlassian|linkedin|customDiscoveryURL|disappears)' PKG=bedrockagentcore

--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_linkedin (22.88s)
--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_disappears (24.13s)
--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_atlassian (28.03s)
--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_basic (29.24s)
--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_customDiscoveryURL (43.58s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/bedrockagentcore   43.749s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[aidandaly24]

Closing in favor of #48517 (which already adds the atlassian/linkedin/included provider variants). The remaining novel piece from this PR — client_secret_source/client_secret_config for externally-managed secrets — is being contributed on top of #48517 rather than as a competing PR. Thanks @jesseturner21!

[github-actions]

Warning

This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.