Amazon Bedrock AgentCore 2026-08-30

Use these rules for the continuously delivered Amazon Bedrock AgentCore service and documentation snapshot from 2026-08-30, including Runtime, Gateway, Identity, Memory, tools, browser and code execution, observability, and deployment.

Inbound identity and authorization

• Require IAM SigV4 for AWS service-to-service invocation or a strictly validated JWT authorizer for user-facing runtime and gateway access.
• For JWT, validate signature, issuer, audience, expiry, not-before, token type, and required claims and reject tokens from unapproved discovery or key URLs.
• Do not use a Gateway with no authorization for production merely for convenience; if an intentionally public gateway is required, add equivalent authentication, abuse controls, and non-sensitive targets.
• Do not mistake Gateway AUTHENTICATE_ONLY for IAM authorization: it accepts any valid SigV4 caller regardless of permissions, so enforce authorization in a policy engine, interceptor, or target.
• Scope IAM identity and resource policies to required actions and the exact resource ARNs each action supports, including runtime and endpoint ARNs, and use explicit denies for prohibited paths.
• Restrict cross-account access on every resource in the authorization chain and use source-account and source-ARN conditions to prevent confused deputy behavior.
• Reauthorize long-lived and queued work when credentials, sessions, user status, policy, or resource ownership changes.
• Treat X-Amzn-Bedrock-AgentCore-Runtime-User-Id as an unverified assertion. A caller holding