DNA Insider
繁中
Back
Official Source· AWS Artificial Intelligence· AI· Published Nov 6, 2026

AWS details enterprise AI agent access controls with Okta Cross App Access and Amazon Bedrock AgentCore

In a November 6, 2026 Part 2 post, AWS outlines an enterprise pattern using Amazon Bedrock AgentCore Gateway, Cedar policies, and separate agent identities to govern access with Okta Cross App Access. The walkthrough adds an Amazon EKS agent, reports validation results and an EKS cost estimate, and cautions that its examples are not a complete deployable solution.

AWS details enterprise AI agent access controls with Okta Cross App Access and Amazon Bedrock AgentCore

Full Report

AWS published Part 2 of its series on governing AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore on November 6, 2026. The post proposes replacing direct agent-to-server wiring with an Amazon Bedrock AgentCore Gateway endpoint and target registry, with the Gateway performing token exchange. It also describes default-deny Cedar policies evaluated at the Gateway before tools run.

The example adds a reporting agent on Amazon EKS with its own Okta identity and Gateway, illustrating use of the pattern outside AgentCore runtime. AWS recommends giving each agent its own Gateway and credential provider. In the example, the reporting agent's resource connection allows only xaa:read, and its EKS pod has an IAM role for model invocation as well as its own logs and traces.

AWS estimates the additions take about 90 minutes and lists an Amazon EKS control-plane cost of $0.10 per hour, plus nodes and the EKS Auto Mode management fee. The post reports HTTP 403 when an ID-JAG is presented to the wrong agent's Gateway and HTTP 401 when a token is missing. AWS says the snippets and configurations are conceptual, not a complete deployable solution, and that the sample code is for non-production use.

Why This Matters

The walkthrough places agent identity, tool permissions, and token exchange at the Gateway layer, while showing how the pattern extends to an agent running on Amazon EKS. That gives teams evaluating enterprise agent access controls a concrete architecture and validation example. AWS's caveat about the examples' completeness and intended use also helps distinguish a technical demonstration from a production-ready deployment.

Evidence

Start with the primary evidence, then review supporting sources and context.

1 items

Primary Evidence

1
  • OfficialAWS Artificial IntelligenceDocumentOriginal

    Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 2

    Hammad Ausaf

    “In Part 1 you built one governed agent. Part 2 scales the pattern to an enterprise: Amazon Bedrock AgentCore Gateway becomes the single front door and redeems Okta's grant, Cedar policies bind each tool to the agent, a second agent runs on Amazon EKS, and AgentCore Observability traces every allow and deny beside Okta's log in Amazon CloudWatch.”

Recommended signals

Recommended by brand, topic, and recent related coverage

No more recommended signals right now

Official statement

Open original source
Back to Live FeedExplore more signals