Tagged
Three identities, not one token. The workload role, the shopper or associate, and the downstream API account. A shared admin credential fails the split. AgentCore Identity does not replace your order-system scopes.
On Aug 7, 2026, AWS shipped aws-auth as a core Cognito skill in the Agent Toolkit—603 installs on skills.sh within days, 9 reference packs under skills/core-skills/aws-auth, and a hard warning that update-user-pool-client is a full replace.
After Cognito multi-Region replication (June 2026), a B2B API platform (~18k RPS peak) cut auth-related 5xx during a regional drill from 4.2% → 0.1% — but a missing WAF rate rule still let a scraper burn $1.8k in a weekend.