AWS bedrock-agentcore documentation change

Service: bedrock-agentcore · 2025-10-01 · Documentation low

File: bedrock-agentcore/latest/devguide/understanding-agent-identities.md

Summary

Added detailed documentation about automatic and manual creation of workload identities, their use cases, and integration with access control mechanisms.

Security assessment

The changes document security-related features (workload identities, access tokens, IAM policies) but do not address a specific security vulnerability. The additions explain how to securely manage agent identities and credentials, which is preventive security documentation.

Diff

diff --git a/bedrock-agentcore/latest/devguide/understanding-agent-identities.md b/bedrock-agentcore/latest/devguide/understanding-agent-identities.md
index 69451548a..e21b25740 100644
--- a//bedrock-agentcore/latest/devguide/understanding-agent-identities.md
+++ b//bedrock-agentcore/latest/devguide/understanding-agent-identities.md
@@ -4,0 +5,2 @@
+How workload identities are created
+
@@ -11 +13,53 @@ Workload identities represent the digital identity of your agents within the AWS
-Workload identities integrate seamlessly with the broader AgentCore Identity framework, including the token vault for secure credential storage (see [Secure credential storage](./key-features-and-benefits.html#secure-credential-storage)), Resource credential providers for external service access (see [Configure credential provider](./resource-providers.html)), and the AgentCore Identity directory for centralized management
+Workload identities integrate seamlessly with the broader AgentCore Identity framework, including the token vault for secure credential storage (see [Secure credential storage](./key-features-and-benefits.html#secure-credential-storage)), Resource credential providers for external service access (see [Configure credential provider](./resource-providers.html)), and the AgentCore Identity directory for centralized management. For more information about the directory, see [Understanding the agent identity directory](./agent-identity-directory.html).
+
+###### Topics
+
+  * How workload identities are created
+
+
+
+
+## How workload identities are created
+
+Workload identities are created automatically in several scenarios and can also be created manually when needed. These identities are used to obtain workload access tokens that authorize agent access to credentials. For details about how workload identities are used in the authentication flow, see [Get workload access token](./get-workload-access-token.html).
+
+**Automatic creation by Runtime and Gateway:**
+
+  * When you deploy an agent using AgentCore Runtime, a workload identity is automatically created and associated with your agent
+
+  * AgentCore Gateway also creates workload identities automatically for agents deployed through the gateway service
+
+  * These automatically created identities are managed by the service and include the necessary settings for your deployment environment
+
+  * The workload identity ARN is returned in the deployment response and can be used for IAM policies and access control
+
+
+
+
+**Manual creation for custom deployments:**
+
+  * For agents not hosted by Runtime or Gateway (such as self-hosted or hybrid deployments), you can manually create workload identities
+
+  * Use the [CreateWorkloadIdentity API](https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_CreateWorkloadIdentity.html) or AWS CLI to create identities for custom agent deployments
+
+  * Manual creation gives you control over the identity name and metadata
+
+  * This approach is ideal when you need specific identity names or are integrating with existing identity management systems
+
+
+
+
+**When to use each approach:**
+
+  * Use automatic creation when deploying through AgentCore Runtime or Gateway for simplified setup
+
+  * Use manual creation when you need specific identity names or are deploying agents in non-standard environments
+
+  * Manual creation is also useful for testing scenarios or when you need multiple identities for the same agent in different environments
+
+
+
+
+Workload identities are used to obtain workload access tokens that authorize agent access to credentials. For details about how workload identities are used in the authentication flow, see [Get workload access token](./get-workload-access-token.html).
+
+Once you have created workload identities, you can use them to control access to credential providers. For information about implementing fine-grained access control, see [Scope down access to credential providers by workload identity](./scope-credential-provider-access.html).
@@ -21 +75 @@ Manage agent identities
-Create identities
+Agent identity directory