r/aws_bedrockagentcore_oauth2_credential_provider: add custom provider endpoint and token-exchange config

[aidandaly24]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

This adds configuration for private (VPC Lattice) connectivity and on-behalf-of token exchange for the custom OAuth2 provider. It surfaces existing service capabilities; it does not change provider-side access controls, encryption, or logging.

Description

Note: This PR is stacked on top of #48723 and contains its commits. Please review/merge #48723 first; this PR's own change is the final commit (r/aws_bedrockagentcore_oauth2_credential_provider: add custom provider endpoint and token-exchange config).

Completes parity for the CustomOauth2ProviderConfigInput shape in the AgentCore SDK by adding the remaining custom-provider fields to custom_oauth2_provider_config:

• client_authentication_method - client authentication method used with the token endpoint (CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, AWS_IAM_ID_TOKEN_JWT).
• on_behalf_of_token_exchange_config - on-behalf-of token exchange configuration (RFC 8693 / RFC 7523), with nested token_exchange_grant_type_config (actor_token_content, actor_token_scopes).
• private_endpoint - default private endpoint (managed_vpc_resource / self_managed_lattice_resource), reusing the existing private-endpoint models from aws_bedrockagentcore_gateway_target.
• private_endpoint_overrides - per-domain private endpoint overrides.

Source of truth: aws-sdk-go-v2 service/bedrockagentcorecontrol v1.45.1 (the version pinned by the provider).

Relations

Relates #0000

References

• CustomOauth2ProviderConfigInput / OnBehalfOfTokenExchangeConfigType / PrivateEndpoint in aws-sdk-go-v2 service/bedrockagentcorecontrol@v1.45.1

Output from Acceptance Testing

% make testacc TESTS='TestAccBedrockAgentCoreOAuth2CredentialProvider_(basic|atlassian|customDiscoveryURL|customTokenExchange)' PKG=bedrockagentcore

--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_customTokenExchange (27.37s)
--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_atlassian (27.21s)
--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_basic (28.60s)
--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_customDiscoveryURL (42.91s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/bedrockagentcore   43.083s

private_endpoint / private_endpoint_overrides require VPC Lattice infrastructure and are exercised via unit-level flatten/expand and plan validation rather than a full acceptance test; the shapes reuse the proven aws_bedrockagentcore_gateway_target private-endpoint implementation.

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[aidandaly24]

Closing to avoid duplication. The on_behalf_of_token_exchange_config block overlaps #48658 (@rh0dy), and the remaining custom-provider fields (client_authentication_method, private_endpoint, private_endpoint_overrides) are being contributed on top of #48517. Consolidating there instead of maintaining a competing PR.

[github-actions]

Warning

This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.