AGENTSEC06-BP01 Encrypt and sign inter-agent messages

Transport-level encryption stops protecting the payload the moment a message lands in a queue or event bus. Message-level signing and encryption keyed per trust zone gives receiving agents cryptographic proof of sender identity and content integrity no matter how many hops the message made.

Desired outcome:

Common anti-patterns:

Benefits of establishing this best practice:

Level of risk exposed if this best practice is not established: High

Implementation guidance

Two distinct properties are at stake: who sent the message (covered by AGENTSEC03-BP01 for authentication) and whether the content is what the sender actually sent. Transport-level encryption provides the second property only while the message is in transit. The moment the message lands in an Amazon SQS queue, Amazon EventBridge bus, or AWS Step Functions state machine, there is no transport to protect it, and any modification between delivery and consumption is invisible. Message-level signing provides cryptographic proof that a specific message was sent by a specific agent and has not been modified, regardless of how many intermediary services it passed through.

Scope matters. For direct agent-to-agent communication within a single trust zone, the transport-level security and authentication provided by Amazon Bedrock AgentCore Runtime (TLS 1.2+ with OAuth 2.0 or SigV4) is typically sufficient. Layer message signing on top when payload integrity needs to persist beyond the transport, or when a receiving agent needs cryptographic proof of which specific agent sent an instruction.

AWS KMS asymmetric keys are the mechanism. The sending agent signs the message payload through the KMS Sign API, and the receiving agent verifies the signature through the KMS Verify API before acting on the message. This gives end-to-end integrity verification that is independent of the transport layer: even if a message passes through multiple intermediary services (load balancers, queues, event buses), the signature proves it was created by the claimed sender and has not been modified. Separate keys per trust zone limit the scope affected by a single key exposure.

For asynchronous agent messaging through Amazon SQS, enable server-side encryption using AWS KMS customer-managed keys. Configure separate keys for different agent trust zones so a key exposure in one zone doesn't affect messages in other zones, and use SQS message attributes to carry the message signature alongside the encrypted payload so receiving agents verify both authenticity and integrity at consumption time.

AgentCore Runtime provides session isolation and built-in authentication for agents using the Agent-to-Agent (A2A) protocol. A2A handles authentication for inter-agent interactions, but for messages that cross trust boundaries, carry sensitive data, or pass through intermediary services, message-level signing layers on top of the protocol's built-in protections.

AWS PrivateLink routes inter-agent communications through private network endpoints, keeping traffic off the public internet. That complements message-level encryption by reducing the network exposure of inter-agent traffic. Store signing key ARNs in Parameter Store, a capability of AWS Systems Manager, configure automatic key rotation in AWS KMS with a rotation period matching your security requirements, and configure Amazon CloudWatch alarms for key usage anomalies (unexpected signing operations from agents that should only be verifying, signing volume spikes suggesting a runaway loop).

Implementation steps

Resources

Related best practices:

Related documents:

Related services: