cyber.hendryadrian.com
Security Insights · aws.amazon.com

AWS Details Per-User Identity Propagation for AI Data Agents

· Original article ↗

Summary

AWS describes a Bedrock AgentCore pattern that carries users’ identity tokens in HTTP headers to Lambda, where server-side token exchange lets Lake Formation authorize Athena queries as the user while CloudTrail records the human identity; the token stays outside the AI

Key points

  • The pattern sends the user’s identity token through HTTP headers, not prompts or tool arguments, keeping it outside the foundation model’s context.
  • AgentCore Runtime and Gateway are configured to allow and propagate the custom identity-token header to a Lambda target.
  • Lambda validates the token, exchanges it through IAM Identity Center, and assumes a role with the resulting identity context.
  • The assumed role has service API permissions but no Lake Formation data grants; Lake Formation evaluates the propagated user’s grants.
  • Athena queries are authorized according to the user’s access, and CloudTrail’s onBehalfOf record identifies the human user.
  • The walkthrough tests two users making the same query: one with a Lake Formation grant receives results, while the other without a grant is denied.

Article Details

Topic
Identity-aware AI data agents using trusted identity propagation to enforce per-user Lake Formation access controls and audit queries.

Vendors

Amazon Web ServicesThe tool runs under its own AWS Identity and Access Management (IAM) role, so AWS Lake Formation sees the tool’s credentials, not the person behind the request.

Products

Amazon AthenaLambda to the data layer: Lambda validates the id_token, exchanges it for an identity context, assumes a role with that context, and runs the Amazon Athena query under the user’s identity.Amazon Bedrock AgentCoreyour lakehouse without rewriting your existing Lake Formation governance policies by configuring Amazon Bedrock AgentCore to carry each user’s identity through trusted identity propagation (TIP).Amazon CognitoThis post uses Amazon Cognito, but you can use any OIDC provider, such as Okta.Amazon S3An Athena workgroup and an Amazon Simple Storage Service (Amazon S3) bucket for query results.AWS CloudTrailYour application code makes no authorization decisions, existing Lake Formation policies work without modifications, and AWS CloudTrail records the actual person who accessed the data.AWS Glue Data CatalogLake Formation governing your AWS Glue Data Catalog, with grants already assigned to users or groups.AWS IAM Identity CenterThe building blocks in this post, OAuth 2.0 token delegation, AWS IAM Identity Center, Lake Formation, and Lambda are well-documented individually.AWS Lake FormationThe tool runs under its own AWS Identity and Access Management (IAM) role, so AWS Lake Formation sees the tool’s credentials, not the person behind the request.AWS LambdaEnsure auditability and compliance by performing a server-side token exchange inside AWS Lambda that converts the identity token into Lake Formation credentials scoped to the real user, with CloudTrail recording every

Related Articles