AWS guide: four JWT authorization gates for MCP tool calls on Amazon Quick
AWS ML Blog · rss · 2026-09-17
The AWS ML Blog published a hands-on guide to implementing defense-in-depth authorization for MCP tool invocations on Amazon Quick + Bedrock AgentCore Gateway: SSO verifies who the caller is, while the authorization layer decides what they may do.
The core is a Lambda REQUEST interceptor attached to the gateway that evaluates OIDC JWT claims in a fixed sequence through four gates:
- MFA verification — enforced by an Entra ID Conditional Access Policy before token issuance; the interceptor can additionally check the amr claim.
- Country geo-fence — restricts access by the ctry claim, toggleable via environment variables.
- Group-to-role RBAC — maps the groups claim to reader/author/admin policies, e.g. readers can query but not mutate.
- Tool-level permission — verifies the requested tool exists in the matched policy allowlist.
Failing any gate returns a 403 before reaching the tool or data; every passing mutation writes an immutable DynamoDB audit record for compliance and forensics. Using a fictional multi-tenant risk register, the post walks through Entra ID app registrations, claims and policy wiring, and validating allowed vs. restricted paths with different test personas.
More from coding & agent
- Why you should build your custom agent harness with MCP tools — omarsar0 · 2026-09-18
- Alignment drift study: one reward hack raises GPT-5.5's re-hack rate from 10% to 64% — maksym_andr · 2026-09-18
- Typesafe goes from two-year stealth cold start to 140k waitlist signups in under 36 hours — damianplayer · 2026-09-18
- New blog finds data issues in a frontier benchmark, ports Agents' Last Exam CLI subset to Verifiers v1 — dejavucoder · 2026-09-18
- After pushing 2B tokens through DeepSeek V4.1 Flash, dev cuts AI bill from $300 to $30/month — gaganghotra_ · 2026-09-18
- Prompting lesson from long-running agents: telling it 'you may skip' makes it skip — BraceSproul · 2026-09-18