---
sourceDocument: Brazil Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Add an AWS Bedrock or AWS Bedrock Agent Core connection

# Add an AWS Bedrock or AWS Bedrock Agent Core connection {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Connect AWS Bedrock or AWS Bedrock Agent Core to AI Control Tower
so policies and AI agent containment using kill switch protocol can reach and act on agents running on AWS.

## Before you begin

Confirm the following:

* You have an AWS Identity and Access Management (IAM) service account with the permissions required for the connector you're configuring:
  * For **AWS Bedrock Agent Core** , in the `bedrock-agentcore:` namespace on `runtime/*` resources: `GetResourcePolicy`, `PutResourcePolicy`, `DeleteResourcePolicy`.
  * For **AWS Bedrock Agent** (classic), in the `bedrock:` namespace on `agent/*` and `agent-alias/*` resources: `ListAgentAliases`, `UpdateAgentAlias`, `TagResource`, `UntagResource`, `ListTagsForResource`.
* The AWS access key ID and secret access key for that service account are available.

Role required: sn_ai_governance.ai_steward

## About this task

Adding this connection has two parts: first you create a Connection \& Credential
Alias that stores your AWS credentials, then you attach that alias to the security
connector in AI Control Tower.

## Procedure

1. Navigate to Connection \& Credential Aliases (`sys_alias.list`).
2. Select New, set Type to Credential, and select Submit.
3. In the resulting alias record, create a credential and fill in the fields.  
   {#aict-configure-aws-bedrock-connection__table_aws_bedrock_credential_fields__entry__2}

   | Field | Description |
   |-|-|
   | Credential type | Select AWS Credentials. |
   | AWS Access Key | Access key ID for the AWS service account. |
   | Secret Key | Secret access key for the AWS service account. |
   | Auth algorithm | Select Amazon Bedrock AgentCore AICT-AiSP if you're configuring AWS Bedrock Agent Core, or Amazon Bedrock Agent AICT-AiSP if you're configuring AWS Bedrock Agent (classic). |
   [Table 1. AWS Bedrock credential fields]

   {#aict-configure-aws-bedrock-connection__table_aws_bedrock_credential_fields}
4. Select Submit.  
   The Connection \& Credential Alias record now has this credential attached.
5. Navigate to AI Control TowerSettingsIntegrationsControl Enforcement Points.
6. On the Available connectors sub-tab, select AWS Bedrock Agent Core or AWS Bedrock, matching the auth algorithm you selected earlier.
7. Fill in the fields.  
   {#aict-configure-aws-bedrock-connection__table_aws_bedrock_connector_fields__entry__2}

   | Field | Description |
   |-|-|
   | Name | Unique, descriptive name for this connection. |
   | Connection Alias | The Connection \& Credential Alias record you created in the previous steps. |
   | Active | Select this option. |
   [Table 2. AWS Bedrock security connector fields]

   {#aict-configure-aws-bedrock-connection__table_aws_bedrock_connector_fields}
8. Select Submit.
{#aict-configure-aws-bedrock-connection__steps_aws_bedrock}

## Result

The connector appears on the Established connections sub-tab. AI Control Tower can now use this connection to
enforce policies and apply AI agent containment using kill switch protocol to agents running on the connected AWS Bedrock or AWS Bedrock Agent Core service.

*[\>]: and then