Summary
agentcore project build cannot synthesize a new project when a gateway target references an OAuth credential declared in the same project before the first deployment.
agentcore project deploy works around this by provisioning credentials before it builds, but the standalone build command does not. This makes an otherwise valid project impossible to build in CI or inspect with CDK synthesis before its first deploy.
Reproduction
In a new project, add a gateway and then run:
printf '%s' "$CLIENT_SECRET" | agentcore project add credentials oauth \
--name MyOauthCredential \
--vendor CustomOauth2 \
--client-id my-client \
--discovery-url https://auth.example.com/.well-known/openid-configuration \
--client-secret -
agentcore project add gateway-target \
--gateway MyGateway \
--name MyMCPTarget \
--endpoint https://my-mcp-server.example.com \
--outbound-auth oauth \
--credential-name MyOauthCredential
agentcore project build
Actual behavior
CDK synthesis fails:
AgentCore CDK synthesis failed: Credential "MyOauthCredential" not found in deployed state
The generated CDK application resolves the target's credential reference only from .cli/deployed-state.json. That state cannot contain the credential before the first deployment.
The deploy path provisions credentials before calling build, so agentcore project deploy does not expose the same failure.
Expected behavior
A project whose resources reference other resources declared in the same project should synthesize before its first deployment. project build should not require deployed state for an in-project credential reference.
Suggested direction
Represent credential references symbolically during synthesis, or make the generated CDK application resolve credentials declared in the project without requiring deployed state. If this cannot be supported, project build should produce a targeted error and the project workflow should explicitly model the required credential provisioning phase.
Please add a regression test for a fresh project containing an OAuth credential and an MCP gateway target that references it.
Summary
agentcore project buildcannot synthesize a new project when a gateway target references an OAuth credential declared in the same project before the first deployment.agentcore project deployworks around this by provisioning credentials before it builds, but the standalone build command does not. This makes an otherwise valid project impossible to build in CI or inspect with CDK synthesis before its first deploy.Reproduction
In a new project, add a gateway and then run:
Actual behavior
CDK synthesis fails:
The generated CDK application resolves the target's credential reference only from
.cli/deployed-state.json. That state cannot contain the credential before the first deployment.The deploy path provisions credentials before calling build, so
agentcore project deploydoes not expose the same failure.Expected behavior
A project whose resources reference other resources declared in the same project should synthesize before its first deployment.
project buildshould not require deployed state for an in-project credential reference.Suggested direction
Represent credential references symbolically during synthesis, or make the generated CDK application resolve credentials declared in the project without requiring deployed state. If this cannot be supported,
project buildshould produce a targeted error and the project workflow should explicitly model the required credential provisioning phase.Please add a regression test for a fresh project containing an OAuth credential and an MCP gateway target that references it.