Securing AI agent identity with X.509 PKI on AWS

23d

Age

Published: Oct 20, 2026, 4:03 PM UTC
Collected: Oct 20, 2026, 4:11 PM UTC

Learn how to secure multi-agent AI systems with cryptographic identity using Keyfactor EJBCA and AWS services. This reference architecture combines signed request envelopes, user-signed delegation assertions, RFC 8693 audience-scoped tokens, and real-time OCSP revocation to prove agent identity and prevent request forgery across agent-to-agent and MCP tool calls.

Excerpt from the source

When AI agents access databases, APIs, and sensitive business operations, establishing cryptographic identity through X.509 public key infrastructure (PKI) becomes a critical requirement. The core challenge is proving which agent made a request, preventing forgery between agents, and confirming that each agent acts only on behalf of an authorized user. Traditional approaches such as sharing API keys between components or passing OAuth tokens through agent chains fall short of the zero-trust…

Read the full article at aws.amazon.com

overfeed.news indexes and links. We publish a short excerpt — the full article stays at AWS Machine Learning Blog.

More from AWS Machine Learning Blog

AWS Machine Learning Blog1 hour ago

Four Amazon Bedrock inference choices that affect cost

Your Amazon Bedrock inference bill can keep climbing even after you tune prompts and application logic. Four request-level choices (cache duration, service tier, reasoning effort, and maxTokens) change how many tokens the service processes and the rate applied. We show how we tested each and how to verify the effect.

AWS Machine Learning Blog2 hours ago

Tokenomics at scale: Track and cap Amazon Bedrock spend per IAM principal with CUR 2.0 and AWS Budgets

Get per-identity Amazon Bedrock cost visibility and enforceable spend limits using only AWS-native features, with no application code for the common case. Attribute spend with IAM principal tags, report with CUR 2.0 or Cost Explorer, and enforce with AWS Budgets actions that apply a Deny policy when a threshold is crossed.

AWS Machine Learning Blog3 hours ago

Optimizing cost per task and proving agent ROI on Amazon Bedrock

Comparing per-token prices hides the real cost of running a model on Amazon Bedrock. This post shows how to calculate the true cost per task across four hidden cost drivers, reduce it with caching, routing, and output constraints, and prove agent ROI with human baselines, holdout experiments, and a five-dimension scorecard.

AWS Machine Learning Blog3 hours ago

Building a self-service LLM gateway with Amazon Bedrock and LiteLLM

Build a self-service LLM gateway with LiteLLM on AWS Fargate that puts Amazon Bedrock foundation models behind an OpenAI-compatible API. Developers get instant access through a single API key, while platform teams gain per-user cost controls, quota isolation, and observability.

More from AWS Machine Learning Blog

Four Amazon Bedrock inference choices that affect cost↗

Tokenomics at scale: Track and cap Amazon Bedrock spend per IAM principal with CUR 2.0 and AWS Budgets↗

Optimizing cost per task and proving agent ROI on Amazon Bedrock↗

Building a self-service LLM gateway with Amazon Bedrock and LiteLLM↗

Four Amazon Bedrock inference choices that affect cost

Tokenomics at scale: Track and cap Amazon Bedrock spend per IAM principal with CUR 2.0 and AWS Budgets

Optimizing cost per task and proving agent ROI on Amazon Bedrock

Building a self-service LLM gateway with Amazon Bedrock and LiteLLM