bedrock-agentcore:GetWorkloadAccessTokenForJWT is a Write access-level action in the bedrock-agentcore service. Grants permission to retrieve an Workload access token for agentic workloads acting on behalf of user with JWT token
ARNs that bedrock-agentcore:GetWorkloadAccessTokenForJWT can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants bedrock-agentcore:GetWorkloadAccessTokenForJWT.
Filters access by the audience claim (aud) in the JWT passed in the request
Filters access by the client_id claim in the JWT passed in the request
Filters access by the issuer (iss) claim present in the JWT passed in the request
Filters access by the scope claim in the JWT passed in the request
Filters access by the subject claim (sub) in the JWT passed in the request
Filters access by having actions based on the tag value associated with the resource
A minimal policy that allows bedrock-agentcore:GetWorkloadAccessTokenForJWT. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowBedrockagentcoreGetWorkloadAccessTokenForJWT",
"Effect": "Allow",
"Action": "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
"Resource": "*"
}
]
}