AWS brings managed OAuth consent to Bedrock AgentCore

AWS has introduced a managed consent portal in Amazon Bedrock AgentCore Identity for users authorizing agents to access third-party services through AgentCore Gateway. The AWS-hosted portal gives each Gateway a dedicated web interface where users can sign in, grant consent and check whether connections are active.

This consent control sits in AgentCore Identity rather than the underlying model layer. That distinguishes the release from AWS’s managed Bedrock model availability: it governs how an agent gets a user’s permission to reach an external service, not which models are available through Bedrock.

For supported three-legged OAuth flows, the change moves the callback and consent surface into an AWS-managed service. AWS says this removes the need for customers to build, host and maintain custom callback infrastructure for those Gateway integrations, but no independent deployment data was available to quantify the claimed maintenance or security benefits.

In the documented setup, one portal attaches to one existing Gateway. The Gateway must use inbound JWT authentication, and the portal’s OAuth credential provider must reference the same OpenID Connect issuer trusted by the Gateway. Users authenticate through that primary identity provider, while a separate outbound OAuth provider represents the service the agent will access. AWS says the OAuth flow remains server-side, so the browser does not hold a token.

A Gateway target appears on the portal’s Connections page only when it uses the authorization-code grant for three-legged OAuth and sends users back to the portal’s /connect/callback endpoint. Machine-to-machine targets using the client-credentials grant do not appear because they do not require per-user consent. After a user approves access at the downstream provider, the provider returns the browser to the portal, which binds the consent to the session and marks the connection as active.

Session binding verifies that the person completing consent is the same user who initiated the authorization request. AgentCore Identity then retrieves and stores the downstream access token. The managed path is limited to AgentCore Gateway: AWS’s broader session-binding guidance still requires deployed AgentCore Runtime applications to host a public HTTPS callback endpoint and verify the current browser session before completing authorization.

Provisioning the portal requires an execution-role ARN, a previously created OAuth2 credential provider for the identity provider, a portal name and exactly one AgentCore Gateway source. The portal always requests the openid scope. Administrators must also register the portal callback with the primary identity provider and configure each eligible Gateway target with its outbound provider and portal return URL.

AgentCore Gateway integrates with AWS CloudTrail. However, InvokeGateway data events are not logged by default; customers must enable them explicitly, and AWS says additional charges apply. AWS says the managed portal is available in all commercial regions where Bedrock AgentCore Identity is offered.