Authentication and security

Two authentication methods are available for both MCP and A2A endpoints:

Create an access token

Prerequisites

Enable access tokens

Create a token

After creating a token, the web app displays a configuration example that you can copy directly into your client.

Use SigV4 authentication

SigV4 authentication uses your AWS credentials instead of an access token. The Kiro power and Claude Code plugin include built-in SigV4 support through mcp-proxy-for-aws, which signs requests using your local AWS credentials.

When SigV4 is used

Prerequisites

Example configuration

To configure an MCP client to use SigV4 instead of an access token, run the server through mcp-proxy-for-aws. Replace {region} with your Agent Space's Region (for example, us-east-1):

{
  "mcpServers": {
    "aws-devops-agent": {
      "command": "uvx",
      "timeout": 120000,
      "args": [
        "mcp-proxy-for-aws@latest",
        "https://connect.aidevops.{region}.api.aws/mcp",
        "--service", "aidevops",
        "--region", "{region}"
      ]
    }
  }
}

The proxy signs each request with your local AWS credentials, so no access token is required.

Multi-Agent-Space routing

In SigV4 mode, pass agent_space_id on each tool call to specify which Agent Space to use. This makes it possible to route across multiple Agent Spaces from a single client.

Security considerations

Token scoping

IP allowlist

When creating an access token, you can optionally specify an IP allowlist. When configured, the token can only be used from the specified IP addresses or CIDR ranges. Requests from other IPs are rejected with an access denied error.

Token rotation and revocation

Chat history and token rotation

Each token has its own chat history. When you rotate a token, AWS DevOps Agent treats the new token value as a new identity. Chats that you created with the previous token no longer appear through the remote server.

Responding to a compromised token

If you suspect a token has been compromised, follow these steps:

Revoking tokens programmatically

You can also revoke tokens programmatically using awscurl. The following commands use SigV4 authentication. Replace the Region (us-east-1) with the Region where your Agent Space is created.

Step 1: List your Agent Spaces

aws aidevops list-agent-spaces --region us-east-1

Step 2: List access tokens for an Agent Space

awscurl --service aidevops --region us-east-1 \
  -H "Accept: application/json" \
  "https://cp.aidevops.us-east-1.api.aws/v1/agentspaces/{agentSpaceId}/access-tokens"

Step 3: Revoke a token

awscurl --service aidevops --region us-east-1 -X POST \
  -H "Accept: application/json" \
  "https://cp.aidevops.us-east-1.api.aws/v1/agentspaces/{agentSpaceId}/access-tokens/{accessTokenId}/revoke"

Replace {agentSpaceId} and {accessTokenId} with the values from the previous responses.

Traceability

AWS DevOps Agent records remote server activity in AWS CloudTrail. Use these records to trace who invoked a remote server and what the agent did as a result. AWS DevOps Agent delivers CloudTrail events to the AWS account that hosts the Agent Space.

Access token authentication events

Each time AWS DevOps Agent authenticates an access token for an MCP or A2A endpoint, it emits an AuthenticateAccessToken event to CloudTrail. AWS DevOps Agent records both successful and failed authentications. Use these records to audit legitimate use and detect rejected attempts. Examples include expired or revoked tokens, and requests blocked by an IP allowlist.

The event has the following characteristics:

The event includes the following key fields:

Downstream action events

When you use an access token, AWS DevOps Agent assumes a role on your behalf to perform actions. AWS DevOps Agent logs this AssumeRole call in CloudTrail with session tags that identify the token and caller:

Each action that the agent takes on your behalf has a corresponding downstream AWS API call that CloudTrail logs. The role session name uses the format token_{spaceId}_{timestamp}_{tokenName}. This session name matches the roleSessionName in the AuthenticateAccessToken event. Use it to trace from an authentication to the specific actions that followed it.

SigV4 invocations

Invocations that use AWS SigV4 authentication instead of an access token do not produce AuthenticateAccessToken events. AWS DevOps Agent attributes SigV4 requests to your AWS Identity and Access Management (IAM) identity. You can trace the actions the agent performs through the downstream AWS API calls they trigger.

VPC endpoint policy limitation

The remote server endpoints do not support VPC endpoint policies. Calls using either access tokens or SigV4 authentication cannot be restricted by VPC endpoint policies.

Disabling access tokens

The access tokens feature is off by default. To disable it after enabling:

Disabling immediately blocks all token-based access. Existing tokens are not deleted but cannot be used until the feature is re-enabled.

To prevent users in your organization from enabling access tokens, create a Service Control Policy (SCP) that denies the access token API actions and the UpdateAgentSpace action (which controls the access tokens toggle):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyAccessTokenOperations",
      "Effect": "Deny",
      "Action": [
        "aidevops:UpdateAgentSpace",
        "aidevops:CreateAccessToken",
        "aidevops:GetAccessToken",
        "aidevops:ListAccessTokens",
        "aidevops:RotateAccessToken",
        "aidevops:RevokeAccessToken"
      ],
      "Resource": "*"
    }
  ]
}

Troubleshooting