Implementing defense-in-depth authorization for MCP tools on Amazon Quick
Amazon Web Services Anneline Sibanda
AWS shows how to stop MCP tools from trusting a token alone. Its Quick setup adds four checks, so a signed-in user still may not touch the wrong tool or data.
Based on reporting by Amazon Web Services, Anneline Sibanda — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Amazon Quick’s MCP setup is getting a harder shell. AWS is showing a defense-in-depth authorization pattern for tool calls, not just login, so a valid token becomes only the first gate instead of the whole story.
The problem is simple enough. MCP can connect apps to internal tools, databases, and APIs, which is handy until those tools sit on sensitive data. Then “authenticated” and “allowed” stop being the same thing. AWS says a single misconfigured permission can let a caller slip past the controls an organization needs for compliance, especially when access has to be checked at the tool and parameter level.
The walkthrough uses Microsoft Entra ID as the identity provider and Amazon Bedrock AgentCore Gateway as the bridge in front of the tools. A REQUEST interceptor on the gateway evaluates OpenID Connect JWT claims through four gates: MFA, country restriction, group-to-role mapping, and tool permission checks. The first two are optional and driven by environment variables; the RBAC and tool allowlist checks are always on. A failed request gets a 403 and never reaches business logic.
AWS frames the example around a fictional company, AnyCompany Global Services, with a multi-tenant risk register on DynamoDB. Readers can query risks but not create, update, or delete them. Administrators can bypass some conditional gates for operational reasons, and every successful mutation writes an immutable audit record. That audit trail is part of the point: the company wants a path that is both enforceable and explainable after the fact.
The identity setup is the fiddly part, as usual. AWS walks through two Entra app registrations, setting an Application ID URI and v2.0 token version through Microsoft Graph, then exposing delegated scopes such as mcp, mcp:stream, stream, and invoke. Amazon Quick uses PKCE and RFC 8707 resource indicators so the token is bound to a specific MCP server, and the gateway validates that token before the interceptor starts its sequence of checks.
My take — AI-written commentary, not fact-checked reporting
This is the right instinct. Once an AI tool can reach real data, “we checked the login” is office folklore with a security budget. The dull part here is also the useful part: more gates, more claims, more audit trail, less drama when compliance asks awkward questions.
Read more about this at: Amazon Web Services