"English-to-Infrastructure": Securing AI Agents with Bedrock AgentCore & Cedar

📺 Short on time? Watch the 5-minute explainer video instead

Giving an AI agent the ability to read your knowledge base is a feature. Giving an AI agent the ability to execute an issue_refund API or mutate a database table is a massive operational risk.

Large Language Models (LLMs) hallucinate. They are susceptible to prompt injections. Because they do not execute a fixed code path, traditional Identity and Access Management (IAM) is no longer sufficient.

An AWS IAM role can answer: "Is this Lambda function allowed to invoke this API?" But IAM cannot answer: "Is this specific AI agent allowed to call issue_refund with an amount of $2,000 during a weekend?"

To solve this, startups usually spend months writing complex authorization middleware to intercept AI tool calls, parse the JSON arguments, and enforce business rules before the API executes. It is brittle, slow, and hard to audit.

With the release of Amazon Bedrock AgentCore Gateway and its native integration with AWS Cedar, AWS has completely changed this paradigm.

Stop writing custom authorization code for your AI agents. Write your policies in plain English, and let AWS compile them into mathematically provable infrastructure.

The Pivot: What is English-to-Infrastructure?

Amazon Bedrock AgentCore Gateway acts as a secure proxy between your AI
reasoning engine and the actual tools (APIs, Lambda functions, databases) it wants to use. It intercepts every single tool call.

Instead of writing a Python interceptor to validate the agent's actions, you leverage Policy in AgentCore. This system uses AWS Cedar an open-source,mathematically verifiable authorization language.

But the true magic lies in the NL2Cedar (Natural Language to Cedar) capability.

You write a natural language boundary:

"Agents can only access Customer Data during business hours, and can never issue refunds over $50."

A neuro-symbolic AI engine translates your English rule into a deterministic Cedar policy. When your agent hallucinates and tries to refund $100 because a malicious user prompt-injected it, the AgentCore Gateway deterministically blocks the action at the network edge.

The CTO’s Reaction

When I map this out for engineering leaders, the reaction is a mix of relief and
disbelief: "Are you telling me we can completely replace our custom
authorization middleware by just writing plain English rules, and AWS will automatically convert it to deterministic Cedar policies that block AI hallucinations at the network edge?"

Yes. And because the enforcement happens outside of the LLM's reasoning loop, it is completely immune to prompt injection.

The Architecture: How AgentCore Gateway Intercepts Threats

Here is the exact AWS architecture for a secure, default-deny AI agent workflow:

1. The Gateway Interception Layer

You register your tools (e.g., your Lambda functions or Model Context Protocol servers) behind the AgentCore Gateway. The LLM never talks to your database directly; it only talks to the Gateway.

1. The Cedar Policy Engine

Attached to the Gateway is the Policy Engine. Cedar evaluates requests in sub-milliseconds. It checks the Principal (the user/agent), the Action (the tool being called), and the Context (the JSON parameters the LLM is trying to pass,such as "amount": 500).

1. The Enforcement

Because Cedar operates on a Default-Deny and Forbid-Overrides-Permit logic, if the agent attempts an action that isn't explicitly permitted, or breaches a "Forbid" rule, the Gateway drops the request. The underlying API is never triggered.

Grounded Engineering: Tradeoffs and Realities

Translating English into infrastructure sounds like magic, but as an architect, I must point out the engineering realities you need to design around.

1. NL2Cedar is for Authoring, Not Enforcement

The Natural Language translation happens once, at deployment time. AWS uses an LLM to generate the Cedar code, but it uses automated mathematical reasoning to validate that the generated Cedar code is structurally sound and doesn't contain logical contradictions. At runtime, the Gateway is evaluating raw, compiled Cedar not English. This guarantees sub-millisecond latency.

1. You Must Still Review the Cedar Code

While the "English-to-Infrastructure" generation is incredibly accurate, you cannot blindly deploy security policies to production without review. Your DevSecOps team must read the generated Cedar code to ensure it perfectly matches your compliance requirements. Fortunately, Cedar was explicitly designed by AWS to be highly human-readable.

1. IAM and Cedar are Complementary

Do not throw away your AWS IAM roles.

• AWS IAM controls who can invoke the AgentCore Gateway.
• Cedar Policies control what the agent can do once inside the workflow. You need both to achieve true defense-in-depth.

The Bottom Line

As we push multi-agent systems into production, we have to stop treating Large Language Models as trusted compute environments. No matter how much you tune your system prompts, an LLM is a probabilistic engine.

Security requires determinism.

By leveraging Amazon Bedrock AgentCore Gateway and AWS Cedar, you extract authorization logic entirely out of the AI's "brain" and push it into the infrastructure layer where it belongs. You gain the ability to express complex business boundaries in plain English, while backing them up with mathematically provable security.

Stop hoping your agent behaves. Start knowing it will.

Has your team started migrating custom authorization middleware to Cedar or AgentCore? Let's discuss your security architectures in the comments!