Amazon announced a new authorization framework for Model Context Protocol (MCP) tools on Amazon Quick, designed to enforce granular access controls with four sequential gates.
This framework addresses the need for compliance by applying role-based and attribute-based access control at the tool and parameter level. The solution enables organizations to manage permissions based on group membership, location, and specific tool access.
The framework leverages OpenID Connect (OIDC) JSON Web Token (JWT) claims to evaluate access through four gates: MFA verification, geographic restriction, group-to-role mapping, and tool-level permission checks. These gates are configured using environment variables, with the latter two forming the core authorization layer and being always active. The first two gates are conditional and can be disabled if not required.
The authorization process is implemented through an AWS Lambda interceptor attached to the Amazon Bedrock AgentCore Gateway. This interceptor evaluates JWT claims in a fixed sequence, ensuring that each gate operates independently.
A request that fails any gate is denied with a 403 error and does not reach the tool or its data. Each successful mutation writes an immutable audit record to satisfy compliance and forensic requirements.
"Authenticated no longer equals authorized," said the blog post.
"Authorization decides which tools a caller can invoke, from which locations, and at what privilege level." The framework ensures that even with a valid single sign-on (SSO) token, additional checks are applied to enforce access controls.
This is crucial when tools reach sensitive data, where a broad token could expose information beyond the caller’s role.
The announcement follows the release of Amazon Quick and the introduction of the Model Context Protocol (MCP). Amazon said the framework is relevant for financial services, healthcare, and government organizations requiring granular access controls for compliance audits. The solution is part of a broader effort to enhance security and compliance for cloud-based applications.
Amazon did not specify the exact deployment timeline for the framework, and the blog post raises the question of how to balance security with operational flexibility. The solution assumes that AWS components, including the gateway, interceptor, and DynamoDB tables, are already deployed. The framework provides an auditable, composable security layer between user requests and business logic.
Source: [awsml](https://aws.amazon.com/blogs/machine, machine-learning/implementing-defense-in-depth-authorization-for-mcp-tools-on-amazon-quick/)
