AWS 发布身份感知 AI 数据代理方案
Start here
AWS 安全博客介绍了一种身份感知 AI 数据智能体方案：数据智能体查询 Lake Formation 治理的湖仓数据时，按真实用户身份授权，无需改写现有治理策略。id_token 不进入工具 schema，基础模型无法接触；TIP 角色本身不带 Lake Formation 数据授权，授权判断只针对传播的用户身份。测试中两名用户提出同一问题，有授权的用户返回五条记录，无授权用户被拒绝，CloudTrail 的 AssumeRole 记录可追溯。
Generated by AI from reports · Updated 4 days ago
Progress timeline
- AWS SecuritySelectedAWS releases an identity-aware AI data agent solution, using Lake Formation and trusted identity propagation to achieve per-user authorization
The AWS security blog introduces an identity-aware AI data agent solution that authorizes data agents based on the real user identity when querying Lake Formation-governed lakehouse data, without rewriting existing governance policies. The id_token does not enter the tool schema, and the base model cannot access it; the TIP role itself has no Lake Formation data permissions, and authorization decisions are made only for the propagated user identity. In testing, two users asked the same question; the authorized user received five records, while the unauthorized user was denied, and CloudTrail's AssumeRole events record the real user via onBehalfOf.
Related discussion
Attention trend
New sources per day
- Oct 7New1 sources (1 outlets,0 accounts)
- Oct 8New0 sources (0 outlets,0 accounts)
- Oct 9New0 sources (0 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)