Skip to lesson

AWSAWS Certified Generative AI Developer - Professional2026-102.3 Design and implement enterprise integration architectures

Secure AI Agent Access with Amazon Bedrock AgentCore Identity

Completed by opening the official lab

Why it matters

Caller authentication is part of securing enterprise access to an agent. This exercise makes that boundary visible by testing which callers AgentCore Identity accepts.

What to practise

Deploy an agent to AgentCore Runtime with Identity inbound authentication. Sign in to a Cognito user pool, obtain a JSON Web Token (JWT), and decode its claims. Confirm rejection without a valid JWT and acceptance with one. Explore the user pool, app client, and test user.

How it fits

For 2.3.6, see a Cognito user pool authenticate the user and issue the JWT whose claims AgentCore Identity checks. The accepted and rejected calls also make concrete the inbound boundary that 2.1.4 keeps separate from outbound credentials.