propagate X-Amz-Bedrock-AgentCore-Identity-WAT on outbound calls

[Sudip2403]

…gation

Add support for workload identity chain propagation across service hops:

• Add IDENTITY_WAT_HEADER constant and allowlist it in is_forwardable_header
• Add identity_wat context variable to BedrockAgentCoreContext
• Extract the WAT header from inbound requests in _build_request_context
• Auto-propagate on outbound Runtime/Gateway boto3 calls via event handler
• Add @requires_wat decorator for explicit WAT minting and propagation
• Register WAT propagation on Runtime data plane client only (Identity is excluded as it is the WAT issuer)
• Document manual Gateway MCP call propagation pattern
• Add comprehensive tests for all new functionality

Issue #, if available:

Description of changes:

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[jariy17]

Thanks for the PR. We already store the workload access token in the context. Can we use that instead?

[jariy17]

Instead of filtering on Line 52, we should call this register for every WAT allowlisted operation (InvokeAgentRuntime).

for op in ("InvokeAgentRuntime", ...):
      self.dp_client.meta.events.register(
          f"before-sign.bedrock-agentcore.{op}",
          _add_identity_wat_header,
          unique_id=f"identity-wat-{op}",
      )

[Sudip2403]

Instead of filtering on Line 52, we should call this register for every WAT allowlisted operation (InvokeAgentRuntime).

for op in ("InvokeAgentRuntime", ...):
      self.dp_client.meta.events.register(
          f"before-sign.bedrock-agentcore.{op}",
          _add_identity_wat_header,
          unique_id=f"identity-wat-{op}",
      )

│ Done. Now registers per-operation with unique_id:
│

for op in _WAT_PROPAGATION_OPERATIONS:
client.meta.events.register(
f"before-sign.bedrock-agentcore.{op}",
_inject_identity_wat_header,
unique_id=f"identity-wat-{op}",
)

[Sudip2403]

Updated

[jariy17]

Please scope this client's type to botocore.client.BaseClient.

[Sudip2403]

│ Done. Changed to client: BaseClient with import from botocore.client.

[jariy17]

We are already store WAT in _workload_access_token. Can this PR just use this variable instead of creating a whole new one?

[Sudip2403]

Updated

[codecov-commenter]

Codecov Report

❌ Patch coverage is 53.48837% with 20 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@5d23292). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
src/bedrock_agentcore/identity/auth.py	4.76%	20 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #607   +/-   ##
=======================================
  Coverage        ?   88.37%           
=======================================
  Files           ?      113           
  Lines           ?     9450           
  Branches        ?     1435           
=======================================
  Hits            ?     8351           
  Misses          ?      731           
  Partials        ?      368           

Flag	Coverage Δ
unittests	88.37% <53.48%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.