使用 Okta Cross App Access 和 Amazon Bedrock AgentCore 管理 AI Agent 访问权限（第 2 部分）
Govern AI agent access with Okta Cross App Access and Amazon Bedrock AgentCore – Part 2
- 谁
- AWS
- 引文
In this post, you make that change on the Part 1 solution.
发生了什么
AWS 作者扩展了第 1 部分中的 Agent 治理方案，使用 Amazon Bedrock AgentCore Gateway 作为共享入口来兑换 Okta 授权，同时由 Cedar 策略在调用到达 MCP 服务器之前控制工具访问权限。他们在 Amazon EKS 上添加了第二个 Agent，并在 CloudWatch 中关联 AgentCore 跟踪记录与 Okta System Log 事件。文章还比较了 Cross App Access 与按用户进行 OAuth 授权同意的方式，并报告了观察到的延迟和撤销行为。
推荐理由
本演示说明 Gateway 和 Cedar 策略如何取代每个 Agent 各自的凭证路径及重复的服务器检查，并测量授权延迟、比较两种访问模型下的撤销行为。
接下来读什么
查看这件事的完整进展AWS Shows How AgentCore and Okta Govern Access for Multiple AI Agents这件事到目前为止
AWS extended its Part 1 tutorial with Amazon Bedrock AgentCore Gateway as a shared entry point for agent access. The gateway redeems Okta grants, while Cedar policies check tool access before calls reach MCP servers. The setup adds a second agent on Amazon EKS and joins AgentCore traces with Okta System Log events in CloudWatch. AWS also compares Cross App Access with per-user OAuth consent and reports latency and revocation behavior. The code is sample code for non-production use, and AWS says the example is not a complete, deployable solution. The EKS control plane costs $0.10 per hour, plus node and Amazon EKS Auto Mode management fees; AgentCore features are charged based on usage.
每天一封，跟上 AI 的重要变化
模型发布、价格变化、算力进展，附原始来源。免费，确认后开始发送，随时一键退订。 看一份往期日报 · 2026-11-06