Govern AI Agent Access with Okta Cross App Access and Amazon Bedrock AgentCore, Part 2
Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 2
- Who
- AWS
- What
- publishes a tutorial using Amazon Bedrock AgentCore Gateway, Cedar policies, and Okta Cross App Access to govern AI agent access
- Quote
In this post, you make that change on the Part 1 solution.
What happened
AWS authors extend a Part 1 agent governance setup with Amazon Bedrock AgentCore Gateway as a shared entry point that redeems Okta grants, while Cedar policies control tool access before calls reach MCP servers. They add a second agent on Amazon EKS and join AgentCore traces with Okta System Log events in CloudWatch. The post also compares Cross App Access with per-user OAuth consent and reports observed latency and revocation behavior.
Why it matters
The walkthrough shows how a Gateway and Cedar policies replace per-agent credential paths and duplicated server checks, with measured authorization latency and a comparison of revocation behavior across two access models.
Read next
See the full storyAWS Shows How AgentCore and Okta Govern Access for Multiple AI AgentsThe story so far
AWS extended its Part 1 tutorial with Amazon Bedrock AgentCore Gateway as a shared entry point for agent access. The gateway redeems Okta grants, while Cedar policies check tool access before calls reach MCP servers. The setup adds a second agent on Amazon EKS and joins AgentCore traces with Okta System Log events in CloudWatch. AWS also compares Cross App Access with per-user OAuth consent and reports latency and revocation behavior. The code is sample code for non-production use, and AWS says the example is not a complete, deployable solution. The EKS control plane costs $0.10 per hour, plus node and Amazon EKS Auto Mode management fees; AgentCore features are charged based on usage.
Keep up with AI, one email a day
Model releases, price changes and compute developments, with original sources. Free, confirmed by email, and easy to unsubscribe. Read a past issue · 2026-11-06