Amazon Bedrock AgentCore Memory now supports fine-grained access control

Amazon Bedrock AgentCore Memory now supports fine-grained access control (FGAC), enabling you to enforce per-user and per-tenant memory isolation through AgentCore Gateway without building custom authorization logic.
With FGAC, you can front your Memory resource with an AgentCore Gateway configured for OAuth (JWT) authentication and attach Cedar policies that restrict access based on the authenticated caller’s identity. You can enforce that each user only accesses their own actor’s data, restrict memory records to namespaces derived from the user’s token claims, and allow or deny specific Memory operations per caller. This lets you move access control enforcement from application code to the infrastructure layer using cryptographic proof of identity. FGAC for Memory is built on the AgentCore Memory connector, a managed gateway connector that wires a gateway target to the Memory data plane and exposes 12 Memory operations as Cedar actions with their request attributes available for policy conditions.
To get started, see Fine-grained access control for Memory in the Amazon Bedrock AgentCore Developer Guide.
Quelle: aws.amazon.com

Amazon Bedrock AgentCore Memory now supports flexible namespace variables

Amazon Bedrock AgentCore Memory now lets developers define flexible namespace variables to scope long-term memories along any application-specific dimension – such as organization, tenant, team, or environment – without creating duplicate strategies or overloading built-in variables. This gives multi-tenant and complex-hierarchy applications fine-grained control over how memories are organized, isolated, and accessed. Define keys on the memory resource, reference them in a strategy’s namespace template, and supply values at runtime through the CreateEvent API. The service substitutes them into namespace templates during long-term memory extraction. Up to five keys can be defined per memory resource, each referenceable across multiple strategies. Flexible namespace variables are available today in all AWS Regions where Amazon Bedrock AgentCore Memory is generally available, at no additional cost. To get started, see Specify long-term memory organization with namespaces in the Amazon Bedrock AgentCore Developer Guide.
Quelle: aws.amazon.com