fix(02-use-cases): Removed client secret from env file and some cleanup to remove files which are not used (#294)

Author: manchandakp

02-use-cases/healthcare-appointment-agent/.env.example

@@ -7,8 +7,8 @@ cognito_discovery_url=
 cognito_issuer=
 cognito_auth_endpoint=
 cognito_token_url=
+cognito_user_pool_id=
 cognito_client_id=
-cognito_client_secret=
 cognito_auth_scope=
 
 openapi_spec_file="./fhir-openapi-spec.yaml"

02-use-cases/healthcare-appointment-agent/init_env.py

@@ -20,7 +20,6 @@
 parser.add_argument('--profile', help = "AWS Credentials Profile Name (optional)")
 
 def main():
-    user_pool_id = ""
     apigateway_endpoint = ""
     apigateway_cognito_lambda = ""
 
@@ -31,8 +30,8 @@ def main():
         "cognito_issuer":"",
         "cognito_auth_endpoint":"",
         "cognito_token_url":"",
+        "cognito_user_pool_id":"",
         "cognito_client_id":"",
-        "cognito_client_secret":"",
         "cognito_auth_scope":"",
         "healthlake_endpoint":"",
         "openapi_spec_file":args.openapi_spec_file
@@ -47,7 +46,6 @@ def main():
 
     print(f"Getting output variables from Cloudformation stack name: {args.cfn_name}")
     cfn_client = session.client("cloudformation", region_name=args.region)
-    cognito_client = session.client("cognito-idp", region_name=args.region)
 
     next_token = "start"
     while next_token != "end":
@@ -80,14 +78,12 @@ def main():
             env_vars['cognito_token_url'] = output['OutputValue']
         elif output['OutputKey'] == 'APIClientId':
             env_vars['cognito_client_id'] = output['OutputValue']
-        elif output['OutputKey'] == 'ClientSecret':
-            env_vars['cognito_client_secret'] = output['OutputValue']
         elif output['OutputKey'] == 'oAuthScope':
             env_vars['cognito_auth_scope'] = output['OutputValue']
         elif output['OutputKey'] == 'HealthLakeEndpoint':
             env_vars['healthlake_endpoint'] = output['OutputValue']
         elif output['OutputKey'] == 'UserPoolId':
-            user_pool_id = output['OutputValue']
+            env_vars['cognito_user_pool_id'] = output['OutputValue']
         elif output['OutputKey'] == 'ApiUrl':
             apigateway_endpoint = output['OutputValue']
         elif output['OutputKey'] == 'APIGWCognitoLambdaName':
@@ -105,13 +101,6 @@ def main():
     if 'issuer' in response_json:
         env_vars['cognito_issuer'] = response_json['issuer']
 
-    print(f"Getting Client Secret using UserPoolId: {user_pool_id} and ClientId: {env_vars['cognito_client_id']}")
-    response = cognito_client.describe_user_pool_client(
-        UserPoolId=user_pool_id,
-        ClientId=env_vars['cognito_client_id']
-    )
-    env_vars['cognito_client_secret'] = response['UserPoolClient']['ClientSecret']
-
     print(f"Creating .env file")
     # Open the .env file in write mode
     with open(".env", "w") as f:

02-use-cases/healthcare-appointment-agent/langgraph_agent.py

@@ -130,5 +130,5 @@ async def main(gateway_endpoint, jwt_token):
     gatewayEndpoint=utils.get_gateway_endpoint(agentcore_client=agentcore_client, gateway_id=args.gateway_id)
     print(f"Gateway Endpoint: {gatewayEndpoint}")
 
-    jwtToken = utils.get_oath_token()
+    jwtToken = utils.get_oath_token(boto_session)
     asyncio.run(main(gatewayEndpoint, jwtToken))

02-use-cases/healthcare-appointment-agent/requirements.txt

@@ -6,10 +6,10 @@ mcp[cli]>=1.10.0
 strands-agents==0.1.8
 ipykernel==6.29.5
 aiohttp==3.12.14
-langchain==0.3.26
-langchain-aws==0.2.27
-langchain-mcp-adapters==0.1.7
-langgraph==0.5.1
+langchain==0.3.27
+langchain-aws==0.2.31
+langchain-mcp-adapters==0.1.9
+langgraph==0.6.6
 botocore
 bedrock-agentcore
 boto3

02-use-cases/healthcare-appointment-agent/setup_fhir_mcp.py

@@ -142,7 +142,7 @@ def create_egress_oauth_provider(gateway_name):
                     }
                 },
                 "clientId": os.getenv("cognito_client_id"),
-                "clientSecret": os.getenv("cognito_client_secret")
+                "clientSecret": utils.get_cognito_client_secret(boto_session)
             }
         }
 

02-use-cases/healthcare-appointment-agent/static/env_screenshot1.png

@@ -43,7 +43,7 @@
     gatewayEndpoint=utils.get_gateway_endpoint(agentcore_client=agentcore_client, gateway_id=args.gateway_id)
     print(f"Gateway Endpoint: {gatewayEndpoint}")
 
-    jwtToken = utils.get_oath_token()
+    jwtToken = utils.get_oath_token(boto_session)
     client = MCPClient(lambda: streamablehttp_client(gatewayEndpoint,headers={"Authorization": f"Bearer {jwtToken}"}))
 
     bedrockmodel = BedrockModel(

02-use-cases/healthcare-appointment-agent/strands_agent.py

@@ -39,12 +39,22 @@ def list_gateways(agentcore_client):
 
     return response['items']
 
-def get_oath_token():
+def get_oath_token(boto_session):
     response = requests.post(
         os.getenv("cognito_token_url"),
-        data=f"grant_type=client_credentials&client_id={os.getenv('cognito_client_id')}&client_secret={os.getenv('cognito_client_secret')}&scope={os.getenv('cognito_auth_scope')}",
+        data=f"grant_type=client_credentials&client_id={os.getenv('cognito_client_id')}&client_secret={get_cognito_client_secret(boto_session)}&scope={os.getenv('cognito_auth_scope')}",
         headers={'Content-Type': 'application/x-www-form-urlencoded'}
     )
 
     #print(response.json())
-    return response.json()['access_token']
+    return response.json()['access_token']
+
+def get_cognito_client_secret(boto_session):
+    cognito_client = boto_session.client("cognito-idp", region_name=os.getenv('aws_default_region'))
+
+    print(f"Getting Client Secret using UserPoolId: {os.getenv('cognito_user_pool_id')} and ClientId: {os.getenv('cognito_client_id')}")
+    response = cognito_client.describe_user_pool_client(
+        UserPoolId=os.getenv('cognito_user_pool_id'),
+        ClientId=os.getenv('cognito_client_id')
+    )
+    return response['UserPoolClient']['ClientSecret']