What happened
AWS announced (July 9, 2026) OAuth support for the AWS MCP Server, letting agents (Claude Code, Kiro, Codex, Gemini) authenticate via existing IAM/IAM Identity Center credentials and AWS Sign-In, with new governance tooling: global condition keys, token introspection/revocation, dynamic client registration, headless OAuth API, and new CloudTrail audit events.
Why it matters
Removes a major adoption blocker for agentic AWS access by reusing existing enterprise identity/governance rather than requiring separate credential management, and gives administrators auditable, revocable control over agent-to-cloud access at scale — directly addressing the 'ungoverned AI gateway' blast-radius risk highlighted elsewhere this week.
Applicability
Any organization connecting coding/ops agents to AWS accounts should adopt OAuth-based sign-in over static credentials immediately; security teams should configure new CloudTrail/condition-key controls.