Add patch enabling IamCredentialProvider on Bedrock AgentCore gateway targets

[dirien]

What this is

A backport of an open upstream fix, hashicorp/terraform-provider-aws#47626, as a new patch under patches/. The patch adds two optional attributes (service and region) to the gateway_iam_role block on aws_bedrockagentcore_gateway_target.

Why I want this

Without these attributes you cannot use aws.bedrock.AgentcoreGatewayTarget to point a Bedrock AgentCore Gateway at an mcp_server endpoint that needs SigV4 signing, like another Bedrock AgentCore Runtime. The schema currently exposes gateway_iam_role {} as an empty block, and the Expand path hard-codes CredentialProvider = nil. AWS happily accepts the create call and returns a 200, but the gateway's tool-discovery probe then fails with Missing Authentication Token because there is no SigV4 service for the gateway to sign with.

I hit this while wiring up the AgentCore Gateway -> AgentCore Runtime MCP server pattern for a workshop. The only workaround today is to drop out of Pulumi for that one resource and call boto3.create_gateway_target(...) inside pulumi env run, which is fine but ugly.

What the patch changes

Forty-two lines added, four removed, all in internal/service/bedrockagentcore/gateway_target.go:

• adds service and region attributes to the gateway_iam_role schema block
• updates Flatten to read the existing IamCredentialProvider body when one is present
• updates Expand to construct awstypes.CredentialProviderMemberIamCredentialProvider when service is set
• adds Service and Region fields to gatewayIAMRoleProviderModel

It is byte-identical to the upstream PR and applies cleanly on top of the other 26 patches. Backward compatible too, since existing gateway_iam_role {} configs still send no IamCredentialProvider body.

After the patch, this works:

new aws.bedrock.AgentcoreGatewayTarget("mcp", {
  // ...
  credentialProviderConfigurations: [{
    credentialProviderType: "GATEWAY_IAM_ROLE",
    credentialProvider: {
      gatewayIamRole: { service: "bedrock-agentcore" },
    },
  }],
});

What I did not do

I did not regenerate the SDKs. The schema regen does pick up the new service/region properties on the bedrock types, and from there the SDK regen ripples through TypeScript, Python, Go, .NET, and Java. I would rather a maintainer run that on a clean CI machine than push partial SDK diffs from my laptop.

Happy to add the SDK regen on top of this PR once a maintainer confirms the direction is fine. Equally happy if you would rather close this and wait for upstream #47626 to merge, then bump the submodule. Either way works for me.

Validation I did run

• ./scripts/upstream.sh init -f applies all 27 patches cleanly
• go build ./internal/service/bedrockagentcore/... passes
• go vet ./internal/service/bedrockagentcore/... passes
• make schema regenerates aws:bedrock/...GatewayIamRole with both service and region properties present in provider/cmd/pulumi-resource-aws/schema.json

Links

• Upstream bug report: hashicorp/terraform-provider-aws#47628
• Upstream fix (open): hashicorp/terraform-provider-aws#47626
• AWS docs: AWS::BedrockAgentCore::GatewayTarget IamCredentialProvider

[github-actions]

PR is now waiting for a maintainer to run the acceptance tests.
Note for the maintainer: To run the acceptance tests, please comment /run-acceptance-tests on the PR