feat(bedrock-agentcore): add grantInvokeWithWebSocketStream method to Runtime

[mazyu36]

Issue # (if applicable)

Closes #37495

Reason for this change

grantInvoke does not grant bedrock-agentcore:InvokeAgentRuntimeWithWebSocketStream, so roles cannot invoke AgentCore Runtimes via WebSocket stream.

Description of changes

Add two new grant methods to IBedrockAgentRuntime and RuntimeBase:

• grantInvokeWithWebSocketStream — grants bedrock-agentcore:InvokeAgentRuntimeWithWebSocketStream
• grantInvokeWithWebSocketStreamForUser — grants bedrock-agentcore:InvokeAgentRuntimeWithWebSocketStreamForUser

This follows the same pattern as the existing grantInvokeRuntime / grantInvokeRuntimeForUser methods, and is consistent with how CDK separates invocation channels (e.g. Lambda's grantInvoke vs grantInvokeUrl, API Gateway v2's grantManageConnections).

grantInvoke is intentionally left unchanged — users who need WebSocket stream access can call the new methods explicitly.

References:

• IAM actions and resource types for Amazon Bedrock AgentCore
• Resource-based policies for Amazon Bedrock AgentCore

Description of how you validated changes

• 6 new unit tests added and passing:
  • grantInvokeWithWebSocketStream: permission grant, imported runtime, Grant object
  • grantInvokeWithWebSocketStreamForUser: permission grant, imported runtime, Grant object

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES
• Is this a breaking change? No
• Does this introduce a new feature? Yes — grantInvokeWithWebSocketStream and grantInvokeWithWebSocketStreamForUser

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Features must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

[mazyu36]

Exemption Request: the change only adds a different IAM action string to an existing grant pattern.

[pahud]

Thanks for the clean PR @mazyu36 — the implementation is consistent with existing grant patterns and test coverage looks solid. A couple of suggestions for the maintainers to consider:

• JSDoc on grantInvoke

One thing I noticed is that grantInvoke doesn't mention it excludes WebSocket stream permissions. This is essentially what caused #37495 — users call grantInvoke expecting full access, then hit silent auth failures when using WebSocket. It might be worth updating the JSDoc to call this out explicitly, something like:

/**
 * Permits an IAM principal to invoke this runtime via HTTP and on behalf of a user.
 * Grants both InvokeAgentRuntime and InvokeAgentRuntimeForUser permissions.
 *
 * NOTE: This does not grant WebSocket stream permissions.
 * Use {@link grantInvokeWithWebSocketStream} or
 * {@link grantInvokeWithWebSocketStreamForUser} for WebSocket access.
 *
 * @param grantee The 
 * principal to grant access to
 */

• Idea: grantInvokeAll() convenience method

With this PR, users who want full invoke access would need to call multiple grant methods. A grantInvokeAll() that covers all four actions in one call could be a nice DX improvement. Just a thought — happy to leave this to the maintainers to decide if it's worth the added surface area.

Overall this looks good to me 👍