iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Short answer: An Amazon Bedrock agent should run through a narrowly scoped IAM service role, while the human or application caller and any AgentCore runtime receive separate identities. IAM limits what the agent can reach; action-group code validates every argument and authorization decision; guardrails filter model traffic; and explicit approval protects purchases, deletions, account changes, and other consequential actions. None of these controls is sufficient alone.
What credentials does a Bedrock agent use?
A Bedrock agent normally operates through a custom IAM service role that AWS assumes on the agent’s behalf. The role receives temporary credentials and authorizes only the integrations configured for that agent. In AWS terminology, an IAM role is an identity with specific permissions that provides temporary credentials.
The exact policy depends on the features enabled. A basic agent may need permission to invoke its selected foundation model. An agent with retrieval needs access to its associated knowledge base. An action group backed by an S3 schema needs access to the schema object, while a Lambda-backed action group also requires the Lambda function’s resource-based policy to allow the Bedrock service principal to invoke it. Optional capabilities can add permissions for guardrails, customer-managed KMS encryption, provisioned throughput, or multi-agent collaboration.
Do not copy a broad policy simply because it makes initial setup easier. Build the service role around one agent, one alias, and the specific resources that deployment actually uses. If the agent never uses a knowledge base, it should not have knowledge-base permissions; if it does not encrypt with a customer-managed key, it should not have access to that key.
#1 Best Overall
- Valued Carpenter Pencil Set: You will get 2 pcs solid carpenter pencils with 26 piece 2.8 mm refills, 1 replaceable sharpener, 1 plastic storage box.The complete carpenter pencils combination allows you to finish your work faster and more easily
- Deep Hole Marker Pencil: The deep-hole construction pencils adopts 45mm elongated tip design, which is more convenient to mark in the small hole or in other tight areas that other carpenter markers cannot reach
- Carpenter Pencils with Sharpener: The sharpener is screwed into the top of the work pencil, which won't get lost either. Built-in pencil sharpener that keep the lead with pointed and smooth to Improves line of sight in fine work
- Stronger Solid Lead: This work pencil is matched with a 2.8 mm thick lead , which is much thicker and stronger during the drawing process of construction work, it will not break or damage easily
- Marks on Various Surfaces: 3 colors solid construction pencil can marks on various surfaces,such as metal, plastic, wood, paper etc. Ideals for woodworkers, contractors, craftsmen, builders, merchants and masons
Separate the three identities in your design
Security and auditability improve when the identities that call, orchestrate, and execute an agent are distinct.
Caller identity
The caller is the human, application, or workload that invokes or administers the agent. This identity should be authorized to call only the required agent alias or runtime endpoint, and administrative permissions should be limited to the people and deployment systems that need them.
Bedrock service role
The service-assumed role lets AWS orchestrate model calls, retrieve schemas and knowledge, apply configured guardrails, and invoke integrations. It should not automatically inherit the powers of the person who asked a question. A caller might be allowed to ask an agent for an account operation while the service role remains limited to the approved backend function that performs it.
AgentCore runtime role
When code runs in Amazon Bedrock AgentCore Runtime, the runtime execution role is available to the agent process and its tools. Treat it as a workload identity, not as a substitute for the caller’s identity. Keep it no more powerful than the tool implementation requires, and do not grant it the administrative permissions used by a trusted deployment operator.
Separate roles make CloudTrail and application logs easier to interpret: you can distinguish who requested an operation, which service performed orchestration, and which runtime process accessed a resource.
Rank #2
- Ergonomically Designed: Work in tight areas with a compact design that gets into tough spots
- Both tools are designed to fit into difficult to reach spaces
- Complete a wide range of applications with a high-performance motor that delivers up to 300 UWO, and an impact driver delivering up to 1,400 in-lbs of torque
- Both the DEWALT impact driver and drill driver feature integrated LED work lights with a convenient 20-second delay, ensuring enhanced visibility in dimly lit or challenging work areas
- One-Handed Loading - Keep one hand free with a 1/4 in. hex chuck that accepts 1 in. bit tips
How to build least-privilege IAM permissions
- Inventory the agent’s features. List the foundation model, agent alias, knowledge base, S3 schema locations, Lambda functions, guardrails, KMS keys, provisioned-throughput resources, and collaborating agents actually configured.
- Create a custom policy. Permit only the API actions required for those features. Scope each statement to the exact resource ARN when the service supports resource-level permissions.
- Add conditions where available. Use conditions to constrain accounts, regions, encryption keys, source identities, or other attributes supported by the relevant AWS API.
- Constrain trust separately from permissions. The role’s trust policy should allow assumption by the intended AWS service or deployment principal, not by every principal in the account.
- Test with denied actions. Exercise normal model calls, retrieval, tool invocation, and failure paths. Confirm that an unrelated bucket, function, key, or agent is denied.
- Review after every feature change. Adding a knowledge base, guardrail, action group, or collaboration relationship can require a new permission. Remove permissions when a feature is removed.
AWS-managed full-access policies are convenient for experiments but create a larger blast radius in production. AgentCore guidance specifically says policies generated by its CLI are intended for development and testing, not production. Replace them with custom policies limited to the resources and actions the deployed workload needs.
Action groups are tool boundaries, not authorization boundaries
An action group describes operations an agent may help perform and routes fulfillment to Lambda or another integration. The model can select an action because of text in a user prompt, retrieved document, web page, file, or tool response. Therefore the action-group implementation must assume that both the requested operation and its arguments can be untrusted.
Validate every argument
- Use an allowlist for operation names, object types, regions, and destination systems.
- Validate data types, formats, length limits, ranges, and identifiers against authoritative records.
- Reject extra fields and ambiguous values rather than silently guessing.
- Resolve authorization from the authenticated user and business context, not from a role name or account identifier supplied in the prompt.
- Recheck permissions immediately before the side effect; do not rely solely on an earlier model decision.
Require confirmation for high-impact actions
Purchases, deletions, account changes, external messages, privilege changes, and irreversible updates should pause for explicit user confirmation. Show the normalized operation, target, amount or scope, and material consequences before invoking the function. Confirmation should be bound to the exact pending action and expire if its parameters change.
For lower-risk operations, you can use policy-based approval such as spending limits, destination allowlists, or read-only modes. Keep those rules in application code or a policy service, not only in the natural-language agent instructions.
Design idempotent fulfillment
Retries and timeouts can cause an agent to submit the same request more than once. Use idempotency keys, transaction states, and duplicate detection in the tool implementation. Return a clear status that distinguishes accepted, completed, rejected, and unknown outcomes so the agent cannot claim success when the backend result is uncertain.
Rank #3
- 【Great Compatibility】This Katerk 1/4 inch hex shank bit holder is specifically designed for 1/4 inch hex shank drill bits. It's compatible with most 1/4 fast hex handles, hex sockets, various electric screwdrivers, and handheld screwdrivers. The bit holder makes it a valuable addition for any handyman.
- 【Secure and Safe】Built with a secure backup nut design, each drill bit holder securely locks onto your bits, ensuring they stay firmly in place. Additionally, our bit holder incorporates a high-quality steel ball rolling design that holds up to several kilograms of weight, ensuring your various drill bits don't fall off.
- 【Easy One-Handed Operation】The bit holder for impact driver allows you to change bits single-handedly, simplifying your workflow. Its multi-color design further allows for quick identification of the drill bit you need.
- 【Compact and Convenient】Thanks to its compact size, this 1/4 inch bit holder is easy to carry around. The bit holder allows for easy attachment to various tools, making this a convenient addition to your construction accessories. The Katerk bit holder is cast from high-quality alloy material, promising a long product lifespan. Despite its rugged strength, the bit holder remains lightweight, making it portable.
- 【Cool Christmas Gift For Men Stocking Stuffers】 This screwdriver bit holder, driver bit holder, impact bit holder, can be given as a gift to your loved one, especially for anyone involved in construction or electrical work. It's a must-have for stocking stuffers for men and women, tools gifts for dad, tech gadgets for men, gifts for dad, gifts for him, gifts for husband, gifts for boyfriend, cool gadgets for men, and cool gifts for dad.
Do guardrails make tool execution safe?
Guardrails can be associated with agents and can filter model inputs and outputs. AWS also supports guardrails for model inference, knowledge-base queries, and flows. They are useful for topics such as harmful content, sensitive information, and disallowed instructions.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesGuardrails do not authorize an API call, validate a function argument, enforce a transaction limit, or determine whether a business action is appropriate. A prompt can pass content filtering and still request an unauthorized deletion. Keep IAM least privilege, schema validation, allowlists, transaction controls, and human approval in the execution path.
Apply guardrails at the boundaries that matter: incoming user text, retrieved content where supported, model responses, and tool-facing data. Log which policy decision occurred without recording secrets or unnecessary sensitive text.
Protect API keys and third-party credentials
Do not put API keys in prompts, agent instructions, explicit environment values, source code, or diagnostic logs. A model can repeat text it receives, and a tool error can accidentally expose an environment value.
Use a managed identity and credential service for outbound authentication where available. AgentCore Identity is designed to manage OAuth credentials and API keys for agents and tools while preserving authorization controls and audit trails. The tool should request a credential for a specific destination and scope, use it for the shortest practical time, and return only the minimum response data to the model.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #4
- Long Nib and Deep Hole Marker: Our mechanical carpenter pencil with 45mm nib is designed for easy marking of deep holes or narrow areas. These construction pencils are the great choice for woodworking tools, construction tools, carpenter tools, contractor tools, wood carpentry tools and architect tools
- Extra Refills in 2 Colors for Versatile Marking: The construction mechanical pencil comes with 12 extra 2.8mm refills, including 6 red and 6 black refills. The black refill is suitable for light surfaces, while the red wax is perfect for dark surfaces. Our carpenter mechanical pencil makes sure that you'll have an ample supply for extended use
- Built-in Sharpener: Our construction pencil comes with a built-in sharpener to ensure the mechanical pencil tip is always sharp and ready for use. Never buy an extra pencil sharpener again. A great tool for any woodworker pencil, contractor pencils. The refill can easily be extended or retracted with a simple click of the pencils mechanical, allowing you to work more efficiently and accurately
- Portable Clip Design: Our deep hole construction pencil features a portable clip design, easy to carry and attach to your pocket or tool box, so that you can keep the carpenter pencils mechanical close at hand, making it a convenient tool to have on the go. Great gifts choice for carpenters
- Stronger Pencil Lead: The black refills are made of lead, sturdy and smooth. The red refills are made of wax, clear and light. These marking pencils are much thicker and stronger than normal pencils during the marking process of construction work, suitable for various surfaces, such as glasses, metal, boards, floors, walls, furniture, etc. The written marks can be easily wiped with a wet paper towel when needed
AgentCore Runtime security guidance warns that code inside a microVM can access execution-role credentials through the metadata service. Scope the runtime role accordingly. A compromised or manipulated tool should not be able to read unrelated secrets, assume an administrative role, or enumerate the account.
What AgentCore adds, and what it does not
AgentCore Runtime provides dedicated microVM isolation for sessions. This adds a stronger execution boundary for agent code and command-oriented tools than a shared process model. AgentCore Identity provides managed handling for outbound credentials, and AgentCore Gateway can apply Cedar policies to decide which caller may invoke which tool with which arguments.
Isolation is not a complete trust decision. Your backend must map authenticated users to session IDs, enforce session lifecycle limits, and prevent one user from attaching to another user’s state. Any principal that passes the authentication and authorization gate can reach the capabilities configured for that session. The harness validates request structure; it does not decide whether a prompt is trustworthy or whether a proposed business action is suitable.
Agents Classic documentation labels the older Bedrock Agents experience as maintenance mode for new customers, while AgentCore documentation describes the current runtime security model and controls. Migration is therefore both a platform and a security exercise: map each existing role, tool, session, network path, and log to its AgentCore equivalent, then remove obsolete permissions rather than carrying them forward unchanged.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Security concern | Bedrock Agents Classic | AgentCore-oriented design |
|---|---|---|
| Deployment status | Maintenance mode for new customers according to current documentation | Current runtime model for isolated agent sessions |
| Execution isolation | Depends on the configured integrations and hosting boundaries | Dedicated microVM session isolation |
| Identity handling | Custom Bedrock service role and integration policies | Separate caller and runtime roles, with managed outbound identity options |
| Policy granularity | IAM policies for agent and integrations | IAM plus optional Cedar policies at Gateway |
| Session-to-user enforcement | Application responsibility | Still application responsibility; map users to session IDs |
| Tool and command safety | Validation and approval belong in the tool implementation | Same responsibility; microVM isolation does not approve commands |
| Network placement | Determined by the selected AWS integrations and application architecture | Configure network access narrowly; isolate destinations needed by the runtime |
| Logging | Use AWS and application audit logging for calls and integrations | CloudWatch and application logs can include request and command metadata, subject to redaction |
| Migration effort | Not applicable | Re-map roles, tools, sessions, policies, networking, and observability before cutover |
Defend against prompt injection
Prompt injection occurs when untrusted content attempts to override instructions or trigger a tool. Sources include user messages, retrieved documents, web pages, uploaded files, tool responses, and data returned by external systems.
Best Value
- Milwaukee Ink all Fine Point Marker, Black, 4 Per Pack
- 4 per pack Features Clog Resistant Marker Tip Writes through Dusty, Wet and Oily Surfaces Durable Marker Tip for Writing on Concrete, OSB and Rough Surfaces
- Clog resistant tip writes on dusty, wet and oily surfaces and is optimized for rough surfaces such as OSB, cinderblock and concrete
- Hard hat clip- attaches for easy access
- Quick dry time with reduced smearing and marking
- Label trust boundaries. Keep system policy, user intent, retrieved content, and tool output distinguishable in the application and prompt construction.
- Use retrieval controls. Restrict which repositories the agent can search, filter documents by tenant and authorization, and treat every retrieved instruction as data rather than policy.
- Constrain tools. Expose narrow operations instead of a general-purpose administrative API. Prefer read-only functions for discovery and separate write functions for approved changes.
- Validate at execution time. The backend must independently authenticate the caller, authorize the target, validate arguments, and enforce business limits.
- Insert approval gates. Require confirmation when a request would create an external side effect or cross a defined risk threshold.
- Fail closed. If identity, arguments, policy evaluation, or approval is missing, return a denial rather than asking the model to improvise.
Never treat a model-generated explanation such as “the user approved this” as proof of approval. Approval must come from an authenticated application interaction tied to the exact operation.
Safe shell, browser, and computer-use tools
Commands, websites, files, and tool responses should all be treated as untrusted inputs. Give command-capable agents a dedicated workspace and a restricted operating-system identity. Limit network destinations, filesystem paths, package installation, process creation, and execution time. Keep deployment credentials separate from runtime credentials.
AgentCore’s microVM can isolate command execution, but AWS’s shared-responsibility guidance states that customers remain responsible for the security of commands executed in their runtime sessions. A microVM does not make a destructive command acceptable, prevent data exfiltration through an allowed network path, or decide whether a downloaded script is trustworthy.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteUse command allowlists for routine automation, block shell metacharacters where they are not required, scan uploaded files, and require approval for destructive or externally visible operations. Capture output selectively; command output can contain tokens, personal data, or proprietary source code.
Logging, monitoring, and review checklist
Record enough context to reconstruct a decision without collecting secrets. A useful event contains:
- Authenticated caller identity and tenant or user context.
- Agent, alias, runtime, and tool identifiers.
- Sanitized arguments and the policy or approval decision.
- Correlation or request ID, timestamp, source IP where available, and result status.
- Whether the operation was read-only, simulated, approved, rejected, or completed.
AgentCore command-execution documentation states that request ID, input command, caller identity, timestamp, source IP, and response status are sent to CloudWatch Logs. Redact credentials, authorization headers, full payment data, and unnecessary prompt or document contents before storage. Set retention, access, and deletion controls on customer-managed log stores, and alert on repeated denials, unusual destinations, privilege changes, or tool calls outside normal hours.
Pre-production security test plan
- Invoke the agent with a valid request and verify the expected model, retrieval, guardrail, and tool permissions.
- Attempt access to an unrelated resource and confirm an IAM denial.
- Send malformed, oversized, out-of-range, and extra arguments to every action group.
- Place an instruction in a retrieved document that asks the agent to ignore policy or exfiltrate data.
- Attempt a purchase, deletion, or account change without confirmation and verify that no side effect occurs.
- Replay a timed-out request and verify idempotent behavior.
- Inspect logs for secrets and ensure correlation IDs connect caller, agent, tool, and result events.
- Terminate or expire a session and verify that its credentials, files, and network access are no longer usable.
Re-run these tests after changing models, prompts, action schemas, policies, network routes, or credential providers. Security controls can regress when an apparently minor tool change expands the reachable API surface.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
