Securing AI agent identity with X.509 PKI on AWS
Amazon Web Services Deepakkumar Sharma
AWS and Keyfactor are wiring X.509 identity into AI agents. It’s meant to stop agents from impersonating each other or borrowing the wrong power.
Based on reporting by Amazon Web Services, Deepakkumar Sharma — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
AWS is pitching a fix for one of the messier parts of agentic AI: how to prove which agent is actually making a request. The company’s answer is old-school cryptography, dressed for a new problem. Instead of trusting shared API keys or shuttling OAuth tokens around a chain of agents, the setup uses X.509 certificates, PKI, and revocation checks to bind each agent to a verifiable identity.
The reference architecture was built with Keyfactor EJBCA and AWS services, and it leans on Amazon Bedrock for inference through the AWS Strands Agents SDK. The protected resource in the example is a database, but AWS says the same pattern can be used with any MCP-compatible tool server. That matters because MCP, the protocol many multi-agent systems use to reach tools and data, has no built-in authentication standard. It’s transport-agnostic by design, which is great until you need to know who is actually on the wire.
The model here splits trust into three layers. User-to-system login relies on OAuth plus X.509 and delegation minting. Agent-to-agent traffic uses signed envelopes with proof-of-possession, timestamps, and nonces. And the final hop to the MCP server combines a scoped token, the envelope, the delegation assertion, and OCSP checks. AWS says this creates a chain from the human user all the way to the tool call, with each step checked separately.
There’s a lot of machinery, but the logic is simple: agents should not get blanket power just because they sit in the same workflow. The user’s private key stays local, the agents get their own certificates, and the MCP server verifies that the token, delegation, and certificate all agree before anything runs. Even replay is treated as hostile by default. A fresh nonce is required each time, and old envelopes get rejected even if they were signed correctly.
AWS and Keyfactor also lean on real-time revocation. If a certificate changes status, OCSP is supposed to push that change through immediately. That’s the right instinct. In agent systems, “trust but verify” is already too generous; “verify every hop and then verify the revocation status too” is closer to the mood.
My take — AI-written commentary, not fact-checked reporting
This is the right kind of boring. AI agents do not need mystical autonomy; they need identities that can be checked, revoked, and blamed when something goes sideways. The industry keeps acting like security is a separate phase, then wonders why the demo breaks the moment an agent touches a real system. PKI is not sexy, which is exactly why it belongs here.
Read more about this at: Amazon Web Services