Why AI Agents Keep Breaking IAM Security (And the Fix)
Autonomous AI agents shouldn't use static IAM roles. Learn how dynamic session policies protect production AWS workloads from accidental over-privileged actions.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
# Securing AI Agents on AWS: Runtime Scoped IAM Policies
**Description:** Stop AI agents from breaking production. Learn how to use dynamic STS session policies to enforce least-privilege permissions on autonomous workloads.
**Tags:** `#generative-ai` `#iam` `#security` `#bedrock` `#architecture`
Deterministic applications touch known resources, making static IAM policies straightforward. AI agents (like Bedrock or MCP runners) choose API actions dynamically based on user prompts. Giving them broad, static IAM roles creates an immediate blast-radius risk if a model hallucinates destructive actions.
The solution is **Just-in-Time Session Downscoping**: minting temporary, per-run credentials via AWS STS that restrict permissions at runtime.
### Architecture: Session Policies as an Intersection Filter
Instead of using static credentials, your execution wrapper assumes the agent role on demand with an attached session policy. The effective permissions are strictly the intersection of the base role **AND** the session policy.
```text
[Task Dispatched] ──► [STS AssumeRole + Session Policy] ──► [15-Min Scoped Token] ──► [Agent Runs]
Step 1: Define a Restrictive Session Policy (session-policy.json)
Create a policy that allows only required actions (e.g., read-only diagnostics) and explicitly denies state changes:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:Describe*",
"s3:Get*",
"s3:List*",
"cloudwatch:GetMetric*",
"logs:FilterLogEvents"
],
"Resource": "*"
},
{
"Effect": "Deny",
"Action": [
"*:Delete*",
"*:Terminate*",
"*:Put*",
"*:Update*"
],
"Resource": "*"
}
]
}
Step 2: Mint Ephemeral Credentials via AWS STS
Assume the base role and pass the downscoped policy:
1
2
3
4
5
aws sts assume-role \
--role-arn "arn:aws:iam::123456789012:role/AI-Agent-Base-Role" \
--role-session-name "AgentRun-$(date +%s)" \
--duration-seconds 900 \
--policy file://session-policy.json
Pass the resulting
AccessKeyId, SecretAccessKey, and SessionToken to your agent. Even if the agent attempts an unapproved write or delete operation, AWS IAM rejects it at the control plane.3 Production Rules for Agent IAM
- Tag Agent Sessions: Pass session tags (e.g.,
Owner=AIAgent,TaskID=<UUID>) to distinguish agent actions in AWS CloudTrail logs. - Cap Durations: Restrict temporary credentials to short lifespans (such as 15 minutes) to avoid stale tokens.
- Keep Humans in the Loop: Require human sign-off before executing destructive commands or applying CloudFormation/CDK templates.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article