Amazon Bedrock AgentCore Identity now supports OAuth 2.0 discovery URLs

Amazon Bedrock AgentCore Identity has introduced support for OAuth 2.0 authorization server discovery URLs, allowing developers to configure both inbound JWT authorization and outbound OAuth credential providers without requiring OpenID Connect. Previously, AgentCore Identity only accepted OIDC discovery URLs, limiting integration with authorization servers that implement OAuth 2.0 without OIDC. This change addresses a gap for developers relying on servers that publish metadata at a different well-known path.

The update enables developers to use either OIDC or OAuth 2.0 authorization server discovery URLs when setting up a JWT authorizer or a custom OAuth credential provider on AgentCore. This flexibility simplifies the configuration process for authentication flows that do not use OpenID Connect. The feature is designed to accommodate a broader range of authorization server implementations.

This capability is now available in all AWS Regions where Amazon Bedrock AgentCore is offered, with no additional cost for using the feature. Developers can immediately begin leveraging the new support for OAuth 2.0 discovery URLs in their configurations. The change does not introduce new pricing tiers or fees.

To implement the feature, developers can refer to the Amazon Bedrock AgentCore Developer Guide for instructions on configuring an inbound JWT authorizer or adding an OAuth client using a custom provider. The documentation provides step-by-step guidance for integrating OAuth 2.0 authorization servers. This resource ensures developers can quickly adopt the new functionality.