AWS Publishes X.509 PKI Reference Architecture to Secure AI Agent Identities
AWS demonstrates how to secure AI agents that access databases, APIs, and other business operations by using X.509 public key infrastructure. The reference design combines Keyfactor EJBCA with AWS services and four security mechanisms: signed request envelopes, user‑signed delegation assertions, RFC 8693 audience‑scoped tokens, and real‑time OCSP revocation checks. The architecture, built on Amazon Bedrock and the AWS Strands Agents SDK, protects any MCP‑compatible tool server from impersonation, credential replay, and unauthorized tool use.
The solution gives AI‑driven enterprises a zero‑trust, PKI‑based identity framework that prevents agent spoofing and credential misuse, which is critical for secure deployment of AI agents in finance, healthcare, and other regulated sectors.
Source: AWS Machine Learning Blog · aws.amazon.com