Agentcore Identity Multiple/ Optional Inbound Auth

Amazon Bedrock AgentCore Gateway requires authentication for both inbound and outbound connections, and currently, you can only configure one authentication mechanism per gateway.

For inbound authentication, you have two main options: IAM-based or JWT-based authorization. When you create a gateway with JWT-based authentication, you specify an authorizer configuration that validates tokens from specific identity providers like Amazon Cognito, Okta, or EntraID.

Based on your scenario, here are some potential approaches:

1. Create separate gateways: Since you have tools that require different authentication mechanisms, you could create two separate gateways - one configured with Okta OAuth for authenticated users and another with Cognito for unauthenticated access. Your agent can then be configured to use both gateways, directing requests to the appropriate one based on whether the user is authenticated.

2. Implement a proxy layer: You could create an intermediary service that sits between your application and the AgentCore Gateway. This proxy would handle the authentication logic, determining whether a user needs to be authenticated with Okta or can proceed with the default Cognito authentication, then route the request accordingly.

3. Use a unified identity approach: Consider implementing a solution where all users get some form of identity, even if they're not fully authenticated. Unauthenticated users could receive a limited-scope token from Cognito, while authenticated users would use their Okta credentials. This would require customizing your authentication flow.

AgentCore Identity is designed to support both user-delegated access (using OAuth 2.0 authorization code grant) and machine-to-machine authentication patterns simultaneously for different aspects of functionality. However, the gateway itself currently requires a consistent authentication configuration.

The most straightforward solution given the current constraints would be to create separate gateways for different authentication requirements, though this does add complexity to your architecture.
Sources
Supported authentication patterns - Amazon Bedrock AgentCore
Set up inbound authorization for your gateway - Amazon Bedrock AgentCore
Move your AI agents from proof of concept to production with Amazon Bedrock AgentCore | Artificial Intelligence
Introducing Amazon Bedrock AgentCore Identity: Securing agentic AI at scale | Artificial Intelligence

Hello,

Please allow me to inform you that Amazon Bedrock AgentCore Gateway currently supports only one authentication mechanism per gateway — either IAM-based or JWT-based (like Okta or Cognito). It does not allow optional JWT tokens or multiple identity providers on the same gateway.

To handle both authenticated and unauthenticated tools, you can either create separate gateways (one with Okta OAuth, one with Cognito) or use a proxy layer that routes requests based on auth type. A unified identity setup using guest Cognito tokens for unauthenticated users is another option. The simplest supported approach is to use separate gateways for different auth needs.

For better assistance, I kindly request you to please reach out to Premium Support so that we can check your use case and current configuration better.

I kindly request you to please stay updated through these blogs:

• What's New with AWS - https://aws.amazon.com/new/
• AWS News Blog - https://aws.amazon.com/blogs/aws/

If you have any questions or would like more details about this feature or roadmap, please reach out to AWS Support, and we would be happy to assist you further.

—References—

[1] Creating support cases and case management: https://docs.aws.amazon.com/awssupport/latest/user/case-management.html#creating-a-support-casehttps://docs.aws.amazon.com/awssupport/latest/user/case-management.html#creating-a-support-case

[2] https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/common-use-cases.html

[3] https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-inbound-auth.html