AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 4 / c4.4
Enhanced AI Application SecurityDefense-in-depth layer: AI Application Capability 4 · ToolsUse case: AI that acts 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c4.4 Centralize tools behind AgentCore Gateway with rate limits

Register tools explicitly through a central gateway, control which applications can invoke each tool, authorize every call, and use rate limits as traffic shaping so a looping or abusive tool call is contained.

Foundational
Enhanced
Advanced
Effort: Medium Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models Agentic security dimensionsFrom the AWS Agentic AI Security Scoping Matrix.: Orchestration & flow, Operational boundaries

Implementation guidance

How to implement on AWS

Use Amazon Bedrock AgentCore Gateway to register tools (Lambda, OpenAPI, Smithy, MCP servers) explicitly and configure which AI applications may invoke each. Authenticate callers with an IAM or JWT (OAuth) authorizer, and authorize each tool call with AgentCore Policy (Cedar), which denies by default. Add gateway rate limits per identity, target, or tool to smooth bursts and protect backends. Rate limits are approximate and fail open, so they are not a security boundary; account-level service quotas remain the hard ceiling.

Acceptance criteria

Only registered tools are invocable; callers are authenticated at the gateway; a tool call is allowed only when a policy permits it; rate limits are configured as traffic shaping, with authorization and account-level service quotas as the enforced limits.

Practical implementation

How this control is implemented in each reference architecture:

AgentCore Gateway in the Generative AI account is the single registration point for tools: it authenticates callers, authorizes each call with a default-deny policy, and shapes traffic with rate limits.

  1. Register tools (Lambda, OpenAPI, Smithy, MCP servers) explicitly in Amazon Bedrock AgentCore Gateway so only known tools are invocable.
    Generative AI account AgentCore Gateway AWS Lambda
  2. Configure which AI applications may invoke each tool and set OAuth authorizers for gateway access.
    Generative AI account Amazon Bedrock IAM
  3. Associate an AgentCore Policy engine with the gateway and write Cedar policies that permit specific principals to call specific tools. The engine denies by default and a forbid wins over a permit, so a tool call is allowed only when a policy permits it.
    Generative AI account AgentCore Gateway
  4. Add gateway rate limits per identity, target, or tool to smooth bursts and contain looping tool calls. Treat them as approximate traffic shaping that fails open, not as a security boundary: rely on authentication, authorization, and account-level service quotas as the hard ceiling.
    Generative AI account AgentCore Gateway

How to validate: Only registered tools are invocable; per-tool access is scoped to specific applications; a tool call with no permitting policy is denied; rate limits shape traffic, and service quotas are the hard ceiling.

Avoid: Letting the model call arbitrary functions it discovers at runtime, or treating rate limits as the control that stops abuse. Register and authorize every tool; rate limits are approximate and fail open.

Generative AI OU (multi-account) →

AgentCore Gateway centralizes tool registration in the account: it authenticates callers, authorizes each call with a default-deny policy, and shapes traffic with rate limits.

  1. Register tools explicitly in AgentCore Gateway so only known tools can be invoked.
    Generative AI tier (IAM role) AgentCore Gateway AWS Lambda
  2. Scope per-tool access to the approved application and add OAuth authorizers.
    Generative AI tier (IAM role) Amazon Bedrock IAM
  3. Associate an AgentCore Policy engine with the gateway and write Cedar policies that permit specific principals to call specific tools. The engine denies by default and a forbid wins over a permit, so a tool call is allowed only when a policy permits it.
    Generative AI tier (IAM role) AgentCore Gateway
  4. Add gateway rate limits per identity, target, or tool to smooth bursts and contain looping tool calls. Treat them as approximate traffic shaping that fails open, not as a security boundary: rely on authentication, authorization, and account-level service quotas as the hard ceiling.
    Generative AI tier (IAM role) AgentCore Gateway

How to validate: Only registered tools are invocable; access is scoped per app; a tool call with no permitting policy is denied; rate limits shape traffic, and service quotas are the hard ceiling.

Avoid: A free-for-all tool catalog guarded only by rate limits. Register tools, authenticate and authorize every call, and keep service quotas as the hard ceiling.

Single account (entry point) →

Threats addressed

  • Unregistered or ungoverned tools invoked by the model.
  • Resource exhaustion from excessive or looping tool calls.

AWS services

Amazon Bedrock AgentCore Gateway

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM03 Excessive Agency
  • LLM06 Unbounded Consumption

NIST AI Risk Management Framework (AI 100-1)

  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Security Hub — AI Security Best Practices

  • BedrockAgentCore.2 Bedrock AgentCore Gateways should require authorization for inbound requests

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC05-BP01 Implement least privilege and permission boundaries for agentic workflows
  • GENSEC04-BP02 Sanitize and validate user inputs to foundation models

OWASP GenAI Top 10 for Agentic Applications (2025)

  • ASI02 Tool Misuse and Exploitation

Watch

AWS video: an introduction to Amazon Bedrock AgentCore Gateway — how tools are registered through a central gateway, which applications may invoke each one, and how rate limits keep any single tool from being misused.

Learning resources

References

  • AWS SRA for AI — Capability 4, Identity and access management