Amazon Bedrock AgentCore Identity now supports On-Behalf-Of (OBO) token exchange

Amazon Bedrock AgentCore Identity Updates

Amazon Bedrock AgentCore Identity now supports On-Behalf-Of (OBO) token exchange, enabling developers to build agents that securely access protected resources on behalf of authenticated users without requiring users to complete multiple consent flows.

Previously, developers had to manage separate consent flows for each protected resource, adding friction for end users and complexity for builders. With OBO token exchange, developers can exchange an access token for a new scoped-down access token that carries both the original user identity and the agent identity. This token is targeted specifically to the outbound protected resource, granting just-in-time, least-privilege access without prompting the user for additional consent.

What to do

• Utilize OBO token exchange to streamline agent access to protected resources.
• Review the Amazon Bedrock AgentCore Identity documentation for implementation details.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.