AgentCore - Authentication to existing API via Cogntio

Question

Hi,

I have an application already deployed on AWS (Static SPA + API hosted on ECS via ALB) and I would like to create an AgentCore deployed agent this is able to use a sub-set of the existing API (called directly with a Bearer Token from SPA). Is this possible and is it a good idea?

I have been able to expose a subset of the existing API (by removing operations exported from the main API in Open API format) via the AgentCore Gateway and I'm able to list the tools (by passing the JWT as part of the payload which is a not secure from what I can gather) but not able to invoke them as I'm not able to figure out how to support required_access_token with USER_FEDERATION with Cognito as Outbound Authenticated Target and I cannot find any examples using USER_FEDERATION with Amazon Cognito.

The API currently tries to use a M2M token, which fails (the API rejects it).

How can I make this work? Is there some way I can exchange the M2M token or pass a user context and the upgrade the API auth logic to work on the user's behalf or similar?

re:Post Agent · Answer

Amazon Bedrock AgentCore provides two main authentication mechanisms: IAM SigV4 Authentication (default) and JWT bearer tokens with OAuth. For your scenario where you need to access an existing API that requires a user's bearer token, you have a few options:

1. Configure JWT Inbound Authentication:
You can set up AgentCore to accept JWT bearer tokens by configuring an authorizer during agent creation. This requires:
- A Discovery URL matching the OpenID Connect discovery pattern
- Allowed audiences matching the 'aud' claim in the token
- Allowed clients matching the 'client_id' claim

2. Pass User Context:
When making requests to your agent, include both the user's access token and user ID:
- Use the "Authorization: Bearer " header
- Include the "X-Amzn-Bedrock-AgentCore-Runtime-User-Id: " header

3. Configure Outbound OAuth Access:
For the USER_FEDERATION approach with Cognito, you need to properly configure the agent to use the token for outbound OAuth calls. This involves setting up the agent to forward the token to external services.

For machine-to-machine authentication with AgentCore Gateway using Cognito:
1. Create a Cognito user pool and note the User Pool ID
2. Create a resource server for the user pool
3. Create a client for the user pool with appropriate OAuth flows and scopes
4. Configure the Gateway Inbound Auth with the Discovery URL and Allowed Clients

You can also use Amazon Cognito's pre-token generation Lambda trigger to customize access tokens for your AI agent. This allows the agent to obtain its own access token while passing the user's access token as context using the `aws_client_metadata` request parameter. The customized token can then include user context that your API can validate.

This approach would allow your agent to act on behalf of users while maintaining proper authentication with your existing API.  
**Sources**  
[Amazon Cognito - Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity-idp-cognito.html)  
[Authenticate and authorize with Inbound Auth and Outbound Auth - Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-oauth.html)  
[How to route pass through an access token in AWS Bedrock AgentCore? | AWS re:Post](https://repost.aws/questions/QUCAGE_5rrREa7Q4Pa4YdqLQ/how-to-route-pass-through-an-access-token-in-aws-bedrock-agentcore)  
[Setting up inbound Auth - Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-inbound-auth.html)  
[Empower AI agents with user context using Amazon Cognito | AWS Security Blog](https://aws.amazon.com/blogs/security/empower-ai-agents-with-user-context-using-amazon-cognito/)

AgentCore - Authentication to existing API via Cogntio

Add your answer

Relevant content