Reference your own AWS Secrets Manager secrets in Amazon Bedrock AgentCore Identity 在 Amazon Bedrock AgentCore Identity 中引用您自己的 AWS Secrets Manager 密钥

The real race in AI isn’t about who has the biggest model anymore; it’s about who can make their agents trustworthy enough to hand them the keys to the kingdom. And the kingdom, in this case, is your cloud infrastructure. Amazon’s quiet update to Bedrock AgentCore Identity isn’t just a feature drop—it’s a concession to a brutal truth: the autonomic, self-managing secret is a fantasy in the enterprise. For months, the pitch for AI agents has been about autonomous action, but autonomy without governance is just a liability walking around in a trench coat. AWS is finally admitting that, and offering a lifeline.

Let’s be clear about the original sin here. The initial design of AgentCore Identity, where the system itself created and managed secrets in AWS Secrets Manager, was a classic "developer convenience" play. It’s elegant, automated, and clean. It also fundamentally misunderstands how mature organizations operate. Security and ops teams don’t cede control of secrets to a new, black-box system because it’s neat. They have rotation policies, encryption standards, tagging rules, and cross-account access patterns painstakingly built over years. Telling them a new AI platform will generate its own secrets and they can just... trust it... was a non-starter. It’s like installing a brilliant new robot in the factory but telling the maintenance crew it handles its own safety inspections and oil changes. They’d rightly pull the plug.

This update, allowing you to reference your own preconfigured secret, is AWS doing the necessary, unglamorous work of integration into the real world. It’s not revolutionary, but it’s essential. It transforms AgentCore Identity from a siloed, AI-centric tool into a citizen of the existing AWS ecosystem. The ability to pull a secret from another AWS account in the same region is particularly telling. It speaks to the complex reality of large enterprises—divided into organizational accounts but needing to share resources. It acknowledges that an agent’s power often depends on accessing a central service, like a CRM or a code repository, whose credentials are managed by another team entirely. This isn’t about AI magic anymore; it’s about IAM policies and cross-account roles, the plumbing of the cloud.

The rotation story is the real win. The old model, where AgentCore created the secret, likely tied the agent’s lifecycle to that secret’s lifecycle. Rotate the secret, and you might be scrambling to update the agent configuration. Now, with secrets decoupled, the agent simply reads the latest value from the vault on its next call. This aligns AI operations with fundamental security hygiene. You can rotate a database password every 30 days—a boring but critical practice—without triggering a cascade of updates to every AI agent that uses that database. The agent becomes a stateless consumer of credentials, not a stateful manager of them. That’s how you build systems that are both agile and secure.

But let’s not applaud too loudly. This move is as defensive as it is proactive. For every enterprise architect who demanded this control, there are a dozen startups who preferred the slick, all-in-one automation. AWS is hedging, acknowledging that the "one ring to rule them all" approach to secrets failed. They’re playing catch-up with the operational realities their own best customers have been screaming about. The lack of cross-region support is a glaring hole, a reminder that even this improved model is still constrained by AWS’s own architectural boundaries. If your agent in us-east-1 needs to use a secret from a European account, you’re still out of luck. The "global" nature of AI agents is once again run aground on the rocky shores of data sovereignty and cloud region silos.

Ultimately, this update is a small but significant step in the maturation of agentic systems. It’s the moment the AI team has to sit down with the security and compliance team and say, "Okay, we’ll use your keys, but we still get to drive." The power isn’t in the agent’s ability to create its own identity; it’s in its ability to be granted an identity with precise, limited, and auditable permissions. This is less about enhancing AI and more about containing it. The most powerful agent is not the most creative one, but the most accountable one. AWS has just given developers the tools to build that accountability. The challenge now falls on those developers to use them, to actually build agents that respect the boundaries of their environments, rather than just bulldoze through them. The age of the autonomous, rogue AI agent was fun to theorize about. The age of the credentialed, supervised, and governed AI agent is where the real work, and the real value, finally begins.

这次亚马逊终于低头了。在AgentCore Identity这个处理AI代理“钥匙串”的核心模块上，他们悄然开放了一个早已被企业客户骂上天的功能：允许你直接引用自己已有的、预先在AWS Secrets Manager中配置好的密钥。这不仅仅是一次功能升级，更是一次对现实世界安全运维复杂性的妥协，或者说，一次迟来的、务实的认错。

在此之前，AgentCore Identity的逻辑简单得近乎霸道：你每想让AI代理去访问一个新的外部服务（比如CRM、Slack、GitHub），它都会自动在你账户里创建一个新的Secret。听起来很省心，对吧？对于一个刚起步的原型项目来说，或许如此。但对于任何一家有点规模、正在严肃考虑将AI代理投入生产的公司而言，这简直是场灾难。安全团队会第一个跳出来拍桌子：我们公司有统一的密钥轮换策略，有强制的KMS加密密钥，有复杂的资源标签来追踪成本，所有密钥都必须经过特定的治理流程。你现在让一堆自动生成的“野生”密钥四处乱窜，怎么审计？怎么加密？怎么确保在泄露时能快速轮换？这完全是在挑战企业安全运营的底线。

亚马逊最初的思路，典型地带着大厂那种“我全包”的傲慢。他们假设开发者会喜欢这种“托管一切”的便利，却忽视了在真实的企业环境中，“控制权”和“可见性”远比“自动化”更重要。你的AI代理再智能，如果它的“钥匙”不在你严格的管控之下，它就不是生产力工具，而是一个潜行在你系统内部、拥有特权访问权限的、难以追踪的“黑户”。这无异于给每个新出生的AI代理发一把万能钥匙，然后指望它自己保管好——这在任何正经的IT治理框架里都是不可接受的。

所以，今天这个“引用现有Secret”功能的发布，核心价值不在技术实现，而在于姿态的转变。亚马逊终于承认，他们不能也不应该成为企业密钥的唯一管家。企业需要的是“能力集成”，而不是“服务捆绑”。你现有的密钥管理流程、加密策略、轮换周期，是公司数字安全的基石。AI代理作为一个新的访问主体，必须融入这个既有的、经过验证的安全体系，而不是试图在体系之外另起炉灶。现在，你可以把你那套用得顺手的、贴满合规标签的、由硬件安全模块加密的密钥直接“租借”给AI代理使用。代理用完即还，核心的管理权、轮换权、访问策略权，牢牢攥在你自己手里。

这解决了最尖锐的矛盾，但故事还没完。新的问题随之而来：复杂性。现在，你不仅需要管理AI代理本身的逻辑，还需要管理它所引用的、可能来自其他账户甚至第三方密钥管理器的Secret。跨账户引用、外部连接器集成——这些功能听起来很强大，但也意味着你的密钥流转路径变得更长、更不可见。安全团队需要重新绘制访问关系图谱，监控点也必须随之增加。从“一把梭”到“精细管控”，运维的复杂度是指数级上升的。亚马逊提供了一个更正确的工具，但把驾驭这个工具的挑战，部分转移回了用户自己肩上。

对于开发者社区而言，这无疑是个好消息，它释放了一个信号：在构建生产级AI系统时，安全不是事后可以打补丁的选项，而是必须从第一天就深植其中的架构原则。一个不能与企业现有安全实践无缝对接的AI平台，注定只能停留在实验室里。亚马逊这次更新，相当于给AgentCore装上了一个符合企业标准的“安全接口”。

然而，我们也别高兴得太早。功能的开放只是一步。真正的考验在于，围绕这个新能力的文档、教程、最佳实践是否足够清晰？AWS IAM策略的精细权限定义是否会变得极其复杂？当代理使用的密钥轮换失败时，调试路径是否会清晰可循？我们见过太多次，大厂推出强大的底层功能，却让集成和排错变成一片需要用户自己摸索的丛林。

总而言之，这步棋亚马逊走对了，而且走得很必要。它标志着AI代理开发从“炫酷的Demo阶段”正式进入了“企业级治理阶段”。安全与便利的古老权衡，在这里以另一种形式上演。现在，球踢到了企业安全架构师和DevOps团队这边：如何利用这份新获得的控制权，构建起真正稳健、透明且合规的AI代理基础设施，将是接下来真正的硬仗。代理的“大脑”可以无限进化，但它的“钥匙”必须始终握在合规与安全的手中。