● Covered by 1 source · 1 reportMedium impact1 neutral
Amazon Bedrock AgentCore Identity Adds Private Key JWT Authentication
Key points
- AgentCore Identity supports Private Key JWT authentication.
- Agents use signed JWT client assertions for authentication.
- Private keys are stored in AWS KMS for security.
- Public keys are registered with the identity provider.
New Authentication Method for Bedrock Agents
Amazon Bedrock AgentCore Identity has introduced support for Private Key JWT client authentication. This new method allows agents to authenticate with a downstream identity provider's token endpoint using a signed JSON Web Token (JWT) client assertion. This replaces the previous reliance on shared OAuth 2.0 client secrets, offering a more secure authentication mechanism.
Enhanced Security with AWS KMS
With Private Key JWT authentication, a public key is registered with the identity provider, while the corresponding private key remains securely stored within AWS Key Management Service (AWS KMS). AgentCore Identity utilizes AWS KMS to sign the assertion, which is then sent to the identity provider for verification using the registered public key. This process ensures that the private key never leaves KMS, significantly enhancing security.
How the Authentication Flow Works
When an agent requires a token, it calls GetResourceOauth2Token on AgentCore Identity. AgentCore Identity then constructs a JWT client assertion, which is signed by AWS KMS using the agent's private key. The signed assertion is subsequently posted to the identity provider's token endpoint. The identity provider verifies the signature against the registered public key and issues an access token back to AgentCore Identity, completing the secure authentication process.
Practical Implementation Steps
Implementing this feature involves creating an AWS KMS signing key, registering its public key with the identity provider, and configuring a credential provider via the AWS Management Console. The system also provides AWS CloudTrail events to record and monitor the agent's access, offering transparency and auditability for authentication activities.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub awslabs/agentcore-samplesReporting from
Amazon Bedrock AgentCore Identity now supports Private Key JWT client authentication for agents, allowing them to authenticate to identity providers using signed JSON Web Tokens instead of shared secrets. This enhancement improves security by keeping private keys within AWS Key Management Service (KMS) and enabling more secure machine-to-machine authentication flows for AI agents.