(bedrock-agentcore-alpha): support service/region in IAM credential provider for gateway targets

[badmintoncryer]

Describe the feature

Add optional service / region arguments to GatewayCredentialProvider.fromIamRole().

GatewayCredentialProvider.fromIamRole({ service: 'bedrock-runtime', region: 'us-east-1' });

Use Case

coverage: missing feature

The L1 IamCredentialProvider (service / region) already exists, but the L2 alpha only emits credentialProviderType: 'GATEWAY_IAM_ROLE' and cannot specify the SigV4 signing service / region. Needed for cross-region calls and for targets where the service can't be inferred from the URL.

Proposed Solution

Add optional props (service?, region?) to fromIamRole(). Zero-arg call keeps existing behavior.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS CDK Library version (aws-cdk-lib)

2.251.0

AWS CDK CLI version

2.1119.0

Environment details (OS name and version, etc.)

all

[pahud]

Thanks for filing this. It appears the L2 GatewayCredentialProvider.fromIamRole() was shipped without threading through the L1's IamCredentialProvider block (service / region). The gap is clear from the source:

aws-cdk/packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/gateway/outbound-auth/iam-role.ts

Lines 12 to 27 in 17f69d6

	* Can be used with Lambda and Smithy targets
	* @internal
	*/
	export class GatewayIamRoleCredentialProviderConfig implements ICredentialProviderConfig {
	public readonly credentialProviderType = CredentialProviderType.GATEWAY_IAM_ROLE;
	constructor() {}
	/**
	* @internal
	*/
	_render(): any {
	return {
	credentialProviderType: this.credentialProviderType,
	};
	}

Reproduction was not performed locally, but the coverage gap is confirmed by code inspection — fromIamRole() takes no arguments and _render() emits no service / region.

I see you've already opened PR #37697 to address this — the approach (optional props, backward-compatible zero-arg call, synth-time validation, MCP-only restriction) looks solid. Thank you for the contribution!