From the source
Amazon Bedrock AgentCore Identity now supports Private Key JWT client authentication, allowing agents to authenticate to identity providers using a signed JWT client assertion instead of a shared client secret, with the private key stored in AWS KMS.