AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 5 / c5.1
Foundational Identity and Access ManagementDefense-in-depth layer: Identity & Data Capability 5 · Generative AI agentsUse case: AI that acts 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c5.1 Give each agent its own scoped identity

Establish distinct identities for the three authentication points (user invoking the agent, agent accessing tools, tool accessing downstream systems) so an agent never inherits an over-permissive human identity.

Foundational
Enhanced
Advanced
Effort: Medium Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models Agentic security dimensionsFrom the AWS Agentic AI Security Scoping Matrix.: Identity

Implementation guidance

How to implement on AWS

Configure inbound auth with AgentCore Identity (AWS credentials or OAuth 2.0; Cognito integrates natively). Limit who can call InvokeAgentRuntime with IAM conditions on the agent ARN. Give the agent its own identity for tool access, separate from the user's, and a distinct identity store for gateway calls.

Acceptance criteria

User, agent, and tool authentication are separate; InvokeAgentRuntime is restricted by IAM condition on the agent ARN; the agent uses its own identity, not the user's.

Practical implementation

How this control is implemented in each reference architecture:

The three authentication points are separated: users authenticate at the Application account, and the agent holds its own identity in the Generative AI account for tool and gateway calls.

  1. Configure inbound auth with AgentCore Identity (AWS credentials or OAuth 2.0; Cognito integrates natively) so the user authenticates at the Application account edge.
    Application account AgentCore Identity Amazon Cognito
  2. Restrict who can call InvokeAgentRuntime with an IAM condition on the agent ARN, so only the authenticated app path can start the agent.
    Generative AI account IAM Bedrock AgentCore
  3. Give the agent its own identity for tool access (separate from the user's) and a distinct identity store for gateway calls.
    Generative AI account Bedrock AgentCore IAM

How to validate: User, agent, and tool authentication are separate; InvokeAgentRuntime is restricted by IAM condition on the agent ARN; the agent uses its own identity, not the user's.

Avoid: Letting the agent act as the invoking user. The agent then inherits that human's full permissions; give it its own scoped identity for each hop.

Generative AI OU (multi-account) →

User, agent, and tool identities are kept distinct within the account, and InvokeAgentRuntime is gated by an IAM condition on the agent ARN.

  1. Set up inbound auth with AgentCore Identity (Cognito native) so users authenticate before the agent runs.
    Application tier (IAM role) AgentCore Identity Amazon Cognito
  2. Restrict InvokeAgentRuntime with an IAM condition on the agent ARN.
    Generative AI tier (IAM role) IAM Bedrock AgentCore
  3. Give the agent its own identity for tool/gateway access, separate from the user's.
    Generative AI tier (IAM role) Bedrock AgentCore IAM

How to validate: User, agent, and tool authentication are separate; InvokeAgentRuntime is ARN-conditioned; the agent uses its own identity.

Avoid: One identity shared across the user and the agent. Separate the three authentication points so no hop inherits more than it needs.

Single account (entry point) →

Threats addressed

  • An agent acting with a copy of a user's overly-permissive identity.
  • Confused-deputy across a multi-agent chain where each hop lacks its own identity.

AWS services

Amazon Bedrock AgentCore Identity Amazon Cognito AWS IAM

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM03 Excessive Agency

NIST AI Risk Management Framework (AI 100-1)

  • GOVERN.1 Policies, processes, procedures and accountability structures
  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC05-BP01 Implement least privilege and permission boundaries for agentic workflows

OWASP GenAI Top 10 for Agentic Applications (2025)

  • ASI03 Identity and Privilege Abuse

Learning resources

References

  • AWS SRA for AI — Capability 5, Identity and access management