Software
Amazon Bedrock AgentCore Identity Now Supports AWS Secrets Manager Secrets
Amazon Bedrock AgentCore Identity now allows users to reference existing AWS Secrets Manager secrets, providing full control over encryption and access policies. This update supports cross-account secret sharing within the same AWS region.
Image: AWS Machine Learning
Amazon Bedrock AgentCore Identity now enables users to reference existing AWS Secrets Manager secrets, offering greater control over encryption and access policies. This update allows customers to use preconfigured secrets from AWS Secrets Manager, maintaining full governance over their management. The feature supports cross-account secret sharing within the same AWS region, though cross-Region sharing is not available. Users can also integrate secrets from external connectors, enabling third-party secret manager compatibility. The update addresses the challenge of securely passing credentials at runtime for AI agents, ensuring they can access external APIs without exposing sensitive information. By referencing an existing secret, users retain control over encryption configurations, rotation, replication, tags, and resource policies, just as they would with other secrets in Secrets Manager. This enhancement supports various use cases, including secure secret rotation, scoped access, and compliance with encryption requirements. Users can now configure credential provider resources with an existing secret through the AWS Management Console, AWS CLI, or AI agents. *Source: [awsml](https://aws.amazon.com/blogs/machine-learning/reference-your-own-aws-secrets-manager-secrets-in-amazon-bedrock-agentcore-identity/)*
Key points
- Amazon Bedrock AgentCore Identity now allows users to reference existing AWS Secrets Manager secrets.
- Users retain full control over encryption configuration, rotation, replication, tags, and resource policies for referenced secrets.
- The update supports cross-account secret sharing within the same AWS region but not across regions.
- Secrets from external connectors are supported, enabling integration with third-party secret managers.
- Credential provider resources can be configured with an existing secret through the AWS Management Console, AWS CLI, or AI agents.
- Users can scope secret access to specific agents by configuring resource policies in AWS Secrets Manager.
- Secrets can be encrypted with customer-managed AWS KMS keys, preserving encryption configurations when referenced.