AWS and Keyfactor Detail X.509 PKI AI Agent Security
A new reference architecture combines Keyfactor EJBCA and AWS services to secure multi-agent AI systems with cryptographic identity, addressing critical zero-trust gaps in enterprise deployments.
Radwan AbdulhadiEditor and technology writer
Addressing Zero-Trust Gaps in Multi-Agent AI Systems
As enterprise deployments increasingly rely on multi-agent architectures to access databases, APIs, and sensitive business operations, establishing robust cryptographic identity via X.509 public key infrastructure (PKI) has become a primary requirement. Traditional methods—such as sharing API keys across components or passing standard OAuth tokens down agent chains—fail to satisfy modern zero-trust standards. These older patterns leave systems vulnerable to credential interception, request forgery, and unauthorized tool invocations.
To help organizations solve these challenges, an official publication on the AWS Machine Learning Blog details a comprehensive reference architecture designed to secure agent-to-agent and tool interactions. Developers looking for more technical background can explore the broader ecosystem context via the Artificial Intelligence portal, while complete source code and implementation examples are maintained in an accompanying GitHub repository.
Securing the Model Context Protocol
Multi-agent frameworks frequently utilize the Model Context Protocol to connect large language model agents to external resources and tools like database queries or email handlers. However, the Model Context Protocol specification is transport-agnostic by design and currently lacks built-in authentication standards. Without proper identity mechanisms, intermediate components could easily impersonate an agent, replay captured credentials, or execute privileged operations without explicit user authorization.
To close this security gap, the reference architecture relies on Keyfactor EJBCA Enterprise combined with managed infrastructure on Amazon Bedrock. Keyfactor provides machine identity governance and certificate lifecycle management across more than 1,500 enterprise customers globally, spanning sectors such as financial services, healthcare, manufacturing, and government.
Four Complementary Security Mechanisms
The joint solution developed by engineering teams from AWS and Keyfactor incorporates four core security layers to protect the agent communication chain. First, signed request envelopes supply cryptographic proof-of-possession on every individual agent call. Second, user-signed delegation assertions authorize downstream agents without requiring the direct sharing of user credentials. Third, RFC 8693 audience-scoped tokens limit the potential blast radius if a single token is ever compromised. Fourth, real-time Online Certificate Status Protocol (OCSP) revocation checking ensures that credential modifications propagate instantly across all participating agents.
For orchestrating agent logic and LLM inference, the architecture integrates the AWS Strands Agents SDK alongside foundational services like Amazon Bedrock. Additional guidance on configuring these frameworks can be found within the Amazon Bedrock User Guide and through dedicated community write-ups regarding open-source agent tooling.
Infrastructure Integration and Token Management
Keyfactor EJBCA Enterprise serves as the foundational Certificate Authority, supporting high-availability deployments, REST API automation, and OCSP validation. It can run on-premises, inside containers, or on Amazon Elastic Compute Cloud instances. By binding AWS compute and inference layers with Keyfactor's cryptographic identity management, enterprises gain verifiable, revocable, and short-lived credentials tailored for multi-agent workflows.
The operational workflow begins with user authentication against an identity provider using an OAuth 2.0 password grant. Subsequently, an RFC 8693 token exchange generates a downscoped token strictly bounded to the Model Context Protocol server audience. Concurrently, a local RSA key pair generates a Certificate Signing Request handled via EJBCA REST APIs, resulting in an X.509 certificate securely stored within AWS Secrets Manager while private keys remain isolated from agent runtimes.
Sources
- AWS Machine Learning BlogSecuring AI agent identity with X.509 PKI on AWS
Continue chronologically
Related entity coverage
Related stories
Amazon Bedrock Adds Structured Outputs for Anthropic Claude
Amazon Bedrock now provides schema-compliant JSON responses for all Anthropic Claude models using constrained decoding and strict tool use.
Building AI Agents That Transact with Anchor Browser and AgentCore
Discover how Anchor Browser and Amazon Bedrock AgentCore payments enable AI agents to autonomously handle x402-protected web resources.
MoEngage Integrates 400 APIs With AgentCore Gateway
Discover how MoEngage scaled agentic workflows by converting 400 private REST APIs into secure tools using Amazon Bedrock AgentCore Gateway.
Amazon Bedrock Prompt Caching for OpenAI Models
Discover how prompt caching patterns on Amazon Bedrock help AI agents cut input costs and reduce latency by eliminating redundant context processing.
