feat(tf): Create agent runtime from Terraform

Extend the Terraform IaC to include provisioning the Agent to Bedrock
AgentCore Runtime.

Author: athewsey

infra/main.tf

@@ -81,3 +81,26 @@ module "secrets" {
   depends_on = [module.cognito]
 }
 
+# Deploy the endpoint
+resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
+  agent_runtime_name = "langgraph_cx_agent"
+  description        = "Example customer service agent for Agentic AI Foundation"
+  role_arn           = module.bedrock_role.role_arn
+  authorizer_configuration {
+    custom_jwt_authorizer {
+      discovery_url   = module.cognito.user_pool_discovery_url
+      allowed_clients = [module.cognito.user_pool_client_id]
+    }
+  }
+  agent_runtime_artifact {
+    container_configuration {
+      container_uri = module.container_image.ecr_image_uri
+    }
+  }
+  network_configuration {
+    network_mode = "PUBLIC"
+  }
+  protocol_configuration {
+    server_protocol = "HTTP"
+  }
+}

infra/modules/cognito/main.tf

@@ -1,3 +1,5 @@
+data "aws_region" "current" {}
+
 resource "aws_cognito_user_pool" "user_pool" {
   name = var.user_pool_name
 

infra/modules/cognito/outputs.tf

@@ -8,6 +8,10 @@ output "user_pool_arn" {
   value       = aws_cognito_user_pool.user_pool.arn
 }
 
+output "user_pool_discovery_url" {
+  value       = "https://cognito-idp.${data.aws_region.current.name}.amazonaws.com/${aws_cognito_user_pool.user_pool.id}/.well-known/openid-configuration"
+}
+
 output "user_pool_client_id" {
   description = "ID of the Cognito User Pool Client"
   value       = aws_cognito_user_pool_client.user_pool_client.id

infra/terraform.tf

@@ -7,7 +7,7 @@ terraform {
 
   required_providers {
     aws = {
-      source  = "hashicorp/aws"
+      source = "hashicorp/aws"
       # v6.18 added support for Bedrock AgentCore Memory
       version = ">= 6.18"
     }