feat(java-on-aws-infra): add AI Agent AgentCore runtime role and expand IAM permissions

Author: Yuriy Bezsonov

infra/cdk/src/main/java/sample/com/WorkshopStack.java

@@ -168,6 +168,39 @@ public WorkshopStack(final Construct scope, final String id, final StackProps pr
 
             // java-spring-ai-agents specific resources
             if (isSpringAi) {
+                // AI Agent Runtime role for AgentCore deployment
+                software.amazon.awscdk.services.iam.Role aiAgentRuntimeRole = software.amazon.awscdk.services.iam.Role.Builder.create(this, "AiAgentRuntimeRole")
+                    .roleName("aiagent-agentcore-runtime-role")
+                    .assumedBy(software.amazon.awscdk.services.iam.ServicePrincipal.Builder.create("bedrock-agentcore.amazonaws.com")
+                        .conditions(java.util.Map.of(
+                            "StringEquals", java.util.Map.of("aws:SourceAccount", this.getAccount()),
+                            "ArnLike", java.util.Map.of("aws:SourceArn", "arn:aws:bedrock-agentcore:" + this.getRegion() + ":" + this.getAccount() + ":*")
+                        ))
+                        .build())
+                    .description("Role for AI Agent AgentCore Runtime")
+                    .inlinePolicies(java.util.Map.of("AgentCoreExecutionPolicy",
+                        software.amazon.awscdk.services.iam.PolicyDocument.Builder.create()
+                            .statements(java.util.List.of(
+                                software.amazon.awscdk.services.iam.PolicyStatement.Builder.create()
+                                    .effect(software.amazon.awscdk.services.iam.Effect.ALLOW)
+                                    .actions(java.util.List.of("bedrock:*", "bedrock-agentcore:*"))
+                                    .resources(java.util.List.of("*"))
+                                    .build(),
+                                software.amazon.awscdk.services.iam.PolicyStatement.Builder.create()
+                                    .effect(software.amazon.awscdk.services.iam.Effect.ALLOW)
+                                    .actions(java.util.List.of("ecr:*", "logs:*", "xray:*", "cloudwatch:*"))
+                                    .resources(java.util.List.of("*"))
+                                    .build(),
+                                software.amazon.awscdk.services.iam.PolicyStatement.Builder.create()
+                                    .effect(software.amazon.awscdk.services.iam.Effect.ALLOW)
+                                    .actions(java.util.List.of("aws-marketplace:Subscribe", "aws-marketplace:Unsubscribe", "aws-marketplace:ViewSubscriptions"))
+                                    .resources(java.util.List.of("*"))
+                                    .build()
+                            ))
+                            .build()
+                    ))
+                    .build();
+
                 // AI Agent EKS Pod Identity role with Bedrock access
                 software.amazon.awscdk.services.iam.Role aiAgentEksRole = software.amazon.awscdk.services.iam.Role.Builder.create(this, "AiAgentEksRole")
                     .roleName("ai-agent-eks-pod-role")

infra/cdk/src/main/resources/iam-policy.json

@@ -31,6 +31,8 @@
 				"bedrock:*",
 				"bedrock-agentcore:*",
 				"apigateway:*",
+				"cloudfront:*",
+				"cognito-idp:*",
 				"application-autoscaling:*",
 				"application-signals:*",
 				"cloudformation:*",
@@ -47,6 +49,7 @@
 				"logs:*",
 				"rds:*",
 				"s3:*",
+				"s3vectors:*",
 				"secretsmanager:*",
 				"ssm:*",
 				"sts:*",
@@ -66,9 +69,9 @@
 				"arn:aws:iam::{{.AccountId}}:role/unicorn*",
 				"arn:aws:iam::{{.AccountId}}:role/service-role/unicorn*",
 				"arn:aws:iam::{{.AccountId}}:role/ai-jvm-analyzer*",
-				"arn:aws:iam::{{.AccountId}}:role/workshop-*",
-				"arn:aws:iam::{{.AccountId}}:role/ai-agent*",
-				"arn:aws:iam::{{.AccountId}}:role/mcp-server*"
+				"arn:aws:iam::{{.AccountId}}:role/workshop*",
+				"arn:aws:iam::{{.AccountId}}:role/aiagent*",
+				"arn:aws:iam::{{.AccountId}}:role/mcpserver*"
 			]
 		},
 		{