Authenticate with Private Key JWT using Amazon Bedrock AgentCore Identity 使用 Amazon Bedrock AgentCore Identity 通过私钥 JWT 进行身份验证

TL;DR

• Amazon Bedrock AgentCore Identity now supports Private Key JWT client authentication, allowing agents to authenticate using signed JSON Web Tokens (JWT) instead of shared OAuth 2.0 client secrets.
• The private key is securely stored in AWS KMS and never leaves the service, while the public key is registered with the downstream identity provider for verification.
• This enhancement improves security by eliminating the need to manage or distribute shared secrets and aligns with modern best practices for machine-to-machine authentication.
• Supported grant flows include Machine-to-Machine (M2M), On-Behalf-Of (OBO), and User-Delegated Access, enabling flexible integration patterns for various agent use cases.

Why It Matters

This feature is highly relevant for AI practitioners and enterprises deploying autonomous agents that require secure, scalable, and auditable access to downstream APIs. By leveraging Private Key JWT with AWS KMS, organizations can reduce credential exposure risks, enhance compliance, and streamline identity management across multi-agent systems without compromising on performance or flexibility.

Technical Details

• Authentication Mechanism: Agents use a signed JWT client assertion generated via AWS KMS’s kms:Sign operation, replacing traditional OAuth 2.0 client secret-based authentication.
• Key Management: Asymmetric KMS keys (RS256, PS256, ES256) are used; the private key remains within AWS KMS, ensuring it is never exposed or exported unless explicitly imported from an external source.
• Credential Provider Configuration: A credential provider must be created in AWS Bedrock AgentCore Identity using the CreateOauth2CredentialProvider API, specifying the client ID, KMS key ARN, and signing algorithm.
• Token Request Flow: AgentCore Identity calls GetResourceOauth2Token, constructs a JWT with required claims (e.g., iss, sub, aud, jti), signs it using KMS, and posts it to the identity provider’s token endpoint with grant_type=client_credentials and client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer.
• Supported Grant Flows:
  • Machine-to-Machine (M2M): Agent acts independently using client_credentials grant.
  • On-Behalf-Of (OBO): Agent exchanges an inbound user token for a downstream token representing the user, supporting RFC 8693 token exchange or RFC 7523 JWT authorization grant.
  • User-Delegated Access: Interactive authorization code flow where user consent is obtained before token issuance.

Industry Insight

Adopting Private Key JWT authentication enables more robust and future-proof agent architectures, particularly in regulated industries where auditability and minimal credential exposure are critical. Organizations should prioritize integrating this method into their agent deployment pipelines to align with zero-trust principles and prepare for increased automation at scale. Additionally, this capability simplifies cross-platform interoperability with identity providers that support OIDC and JWT-based assertions, reducing dependency on proprietary or less secure authentication mechanisms.

TL;DR

• Amazon Bedrock AgentCore Identity 新增对 Private Key JWT 客户端认证的支持，允许代理使用签名 JWT 断言代替共享 OAuth 2.0 客户端密钥进行身份验证。
• 私钥保留在 AWS KMS 中，AgentCore Identity 调用 KMS 的 kms:Sign API 生成签名，公钥注册到下游身份提供商以实现验证。
• 支持三种授权流程：机器间（M2M）、以用户名义（OBO）和用户委托访问，覆盖无用户参与、用户令牌交换及交互式授权场景。
• 配置需创建 KMS 非对称密钥、导出公钥注册至身份提供商、设置凭证提供者，并匹配支持的签名算法（RS256/PS256/ES256）。
• 该机制提升安全性与合规性，避免密钥泄露风险，适用于企业级 AI 代理安全集成。

为什么值得看

本文揭示了 AWS 如何通过结合 KMS 与 AgentCore Identity 实现更安全、可扩展的 AI 代理身份认证方案，特别适合构建高安全要求的自动化工作流或跨系统集成的智能体应用。对于关注云原生安全架构和 OAuth 最佳实践的开发者而言，这是理解现代服务间认证演进的重要案例。

技术解析

• 核心机制：AgentCore Identity 不存储私钥，而是通过调用 AWS KMS 的 kms:Sign 接口，使用配置的不对称密钥对 JWT 客户端断言进行签名；下游身份提供商使用预先注册的公钥验证签名有效性。
• 支持算法：兼容 RS256（RSA SHA-256）、PS256（PSS SHA-256）和 ES256（ECDSA P-256），确保与主流身份提供商如 Okta、Auth0 等无缝对接。
• 授权流程覆盖：
  • M2M 模式用于后台任务或服务账户自主调用资源；
  • OBO 模式支持基于现有用户令牌的身份传递，符合 RFC 8693 或 RFC 7523 标准；
  • 用户委托模式通过交互式授权码流程获取带用户上下文 token，增强权限可控性。
• 配置依赖：需在 IAM 策略中赋予 kms:CreateKey, kms:GetPublicKey, bedrock-agentcore-control:CreateOauth2CredentialProvider 等权限，并确保 KMS 区域与 AgentCore 一致。
• 审计能力：所有操作记录于 AWS CloudTrail，便于追踪代理访问行为与密钥使用情况，满足合规审计需求。

行业启示

• 安全优先设计趋势凸显：随着 AI 代理深入企业核心业务，传统共享密钥模型已难以满足零信任架构要求，基于硬件保护私钥的 JWT 认证将成为新标配。
• 云服务商深化身份生态整合：AWS 此举表明其正将 IAM、KMS 与 AgentCore 深度绑定，推动“身份即基础设施”理念落地，降低第三方集成复杂度。
• 建议行动：企业在部署生产级 AI 代理时，应优先评估是否启用 Private Key JWT 认证，并同步更新内部身份提供商配置以支持该标准，同时建立密钥轮换与监控机制以维持长期安全性。