Add agentcore-identity-cognito-multi-tenant-cdk pattern

[sudhansuamz]

Description

Adds a new serverless pattern: Multi-tenant Amazon Bedrock AgentCore Runtime with Amazon Cognito (agentcore-identity-cognito-multi-tenant-cdk, Python / AWS CDK).

The pattern demonstrates multi-tenant authentication and tenant isolation for an AgentCore Runtime agent using Amazon Cognito as the OAuth 2.0 / JWT identity provider:

• AgentCore Identity validates the inbound Cognito JWT via a custom JWT authorizer before the request reaches the agent.
• Two Cognito groups (tenant-acme, tenant-globex) represent tenants. The agent resolves the caller's tenant from the validated cognito:groups claim, requiring exactly one tenant group.
• A no-argument DynamoDB tool is bound to that tenant's partition, so the model cannot be prompted into reading another tenant's data (pool multi-tenancy model).

What's included

• CDK infra: Cognito user pool with tenant groups, DynamoDB table, AgentCore Runtime (HTTP) with Authorization header forwarding, scoped IAM execution role.
• Containerized Strands agent enforcing per-tenant isolation from the validated token.
• test/ scripts (token minting, data seeding, HTTPS invocation) and README + example-pattern.json.
• README security section documenting the enforced boundaries and production hardening (dynamodb:LeadingKeys with per-tenant scoped credentials).

Testing

Deployed to a personal AWS account (us-west-2) and validated end to end:

• acme user -> only acme records; globex user -> only globex records.
• Prompt-injection asking for another tenant's data -> refused, no leak.
• Tampered group claim (re-signed payload) -> 401 Invalid Signature at the edge.
• Invalid token -> 403. User in zero or multiple tenant groups -> rejected, no data.

Stack cleans up fully with cdk destroy.