AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 4 / c4.2
Foundational Identity and Access ManagementDefense-in-depth layer: Identity & Data Capability 4 · ToolsUse case: AI that acts 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c4.2 Broker tool credentials through AgentCore Identity

Retrieve external-tool credentials at runtime through a secure broker so they are never exposed to the AI application, keeping ingress authentication separate from egress authorization.

Foundational
Enhanced
Advanced
Effort: Medium Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models Agentic security dimensionsFrom the AWS Agentic AI Security Scoping Matrix.: Identity

Implementation guidance

How to implement on AWS

Configure Amazon Bedrock AgentCore Identity as a credential broker: SigV4 for AWS services and OAuth 2.0/JWT for external APIs, with credentials stored in AWS Secrets Manager encrypted with a customer managed key and rotated where supported. AgentCore Identity keeps ingress authentication separate from egress authorization so user credentials are not forwarded to tools.

Acceptance criteria

Tool credentials live in Secrets Manager (CMK-encrypted) and are brokered at runtime; the AI app never sees raw credentials; ingress and egress identity are separated.

Practical implementation

How this control is implemented in each reference architecture:

AgentCore Identity in the Generative AI account brokers tool credentials at runtime (SigV4 for AWS, OAuth/JWT for external), so the AI application never holds them and ingress stays separate from egress.

  1. Configure Amazon Bedrock AgentCore Identity as the credential broker: SigV4 for AWS services and OAuth 2.0/JWT for external APIs.
    Generative AI account AgentCore Identity IAM
  2. Store external-tool credentials in AWS Secrets Manager encrypted with the customer managed key and rotate them where supported.
    Generative AI account Secrets Manager AWS KMS
  3. Keep ingress authentication (who called the app) separate from egress authorization (what the tool may do) so user credentials are never forwarded to tools.
    Generative AI account Amazon Bedrock

How to validate: Tool credentials live in Secrets Manager (CMK-encrypted) and are brokered at runtime; the app never sees raw credentials; ingress and egress identity are separated.

Avoid: Passing the end-user's token straight through to a downstream tool. That is the confused-deputy path; broker credentials and separate ingress from egress.

Generative AI OU (multi-account) →

AgentCore Identity brokers tool credentials at runtime from Secrets Manager (CMK-encrypted); the app never sees them and ingress is kept separate from egress.

  1. Set up AgentCore Identity as the credential broker (SigV4 for AWS, OAuth/JWT for external APIs).
    Generative AI tier (IAM role) AgentCore Identity IAM
  2. Store tool credentials in Secrets Manager encrypted with the customer managed key and rotate them.
    Generative AI tier (IAM role) Secrets Manager AWS KMS
  3. Separate ingress authentication from egress authorization so user credentials are not forwarded to tools.
    Application tier (IAM role) Amazon Bedrock

How to validate: Credentials are brokered from Secrets Manager (CMK-encrypted) at runtime; the app never sees raw credentials; ingress and egress identity are separated.

Avoid: Storing tool API keys in the app's environment variables. Broker them so a compromised app cannot read every downstream credential.

Single account (entry point) →

Threats addressed

  • Tool credentials exposed to or forwarded through the AI application.
  • Confused-deputy: the AI acting with more authority than the caller holds.

AWS services

Amazon Bedrock AgentCore Identity AWS Secrets Manager AWS KMS

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM03 Excessive Agency

NIST AI Risk Management Framework (AI 100-1)

  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC05-BP01 Implement least privilege and permission boundaries for agentic workflows

OWASP GenAI Top 10 for Agentic Applications (2025)

  • ASI03 Identity and Privilege Abuse

Watch

AWS video: an introduction to Amazon Bedrock AgentCore Identity — how external-tool credentials are brokered at runtime through a secure identity layer so they are never exposed to the AI application.

Learning resources

References

  • AWS SRA for AI — Capability 4, Amazon Bedrock AgentCore Identity