The new Consent portal within Amazon Bedrock AgentCore addresses the previous requirement for customers to build and host their own session binding infrastructure when utilizing the AgentCore Identity three-legged OAuth (3LO) flow. This involved complex steps such as presenting the authorization URL, hosting a public HTTPS callback, and managing browser sessions. AgentCore Identity’s portal abstracts this complexity, providing a managed web experience for users to authenticate with their corporate identity provider (IdP) and grant consent to the agent’s access requests.
The portal streamlines the process by handling browser redirects and session binding automatically. AgentCore Identity then securely stores the resulting tokens in its token vault. This capability is particularly relevant for agents accessed through IDE and Model Context Protocol (MCP) clients like Kiro, Claude Code, Cursor, and Visual Studio Code, allowing users to grant consent before invoking tools and leveraging pre-existing tokens for subsequent calls.
Example Corp, a representative company, illustrates the implementation. The company utilizes AI coding assistants with access to GitHub and Slack, managed through an AgentCore Gateway. The administrator configures the IdP, gateway targets, and execution role, then shares the portal URL with developers. Users authenticate via the IdP, connect the desired providers, and grant consent. The portal handles the entire flow, simplifying access management and improving the developer experience.
Administrative steps involve attaching specific IAM policies to the administrator identity, configuring the corporate IdP application with an OpenID Connect (OIDC) web application, and creating an OAuth2 credential provider. The portal utilizes this provider to authenticate the user and securely store access tokens. This new approach reduces operational overhead and enhances security for agents accessing external services.
