AWS Launches AgentCore Gateway to Centralize AI Agent Tool Access and Security Governance
Summary
Updated Sep 15 — AgentCore Identity adds managed Consent Portal, eliminating the need to build custom OAuth session binding infrastructure for AI agent workflows.
- • Amazon Bedrock AgentCore Gateway provides a single secure MCP-based entry point for all AI agent traffic to organizational tools, replacing scattered per-agent credential files.
- • Addresses five structural enterprise security problems from uncontrolled MCP deployments: credential sprawl, policy drift, audit gaps, cost opacity, and shadow IT.
- • Integrates with AgentCore Identity (authentication), AgentCore Policy (security controls), Bedrock Guardrails (safety/privacy), and AWS Agent Registry (tool catalog).
- • Compatible with MCP-enabled AI assistants including AWS Kiro, Claude Code, Cursor, and Amazon Quick.
Updated Sep 3 — AWS published working reference implementations for AI-driven software lifecycle patterns, including automated SQL diagram generation and multi-agent CI/CD security analysis usi…
Updates
AgentCore Consent Portal: managed OAuth consent web experience for agents
AgentCore Identity now offers a Consent Portal — a managed web UI and session binding endpoint for AgentCore Gateway. Eliminates need for customers to build and host their own three-legged OAuth (3LO) session binding infrastructure, including custom HTTPS callbacks and browser session management.
Portal flow: IdP auth → provider consent → token vault storage
Users authenticate with the corporate identity provider, review agent-accessible services, and grant per-provider consent. Portal handles browser redirects and session binding; AgentCore Identity stores resulting OAuth tokens in its token vault for subsequent agent calls.
One portal per gateway; URL follows regional AWS naming pattern
URL format: https://<gateway-name>.consent-portal.bedrock-agentcore.<region>.amazonaws.com. One Consent Portal is allowed per gateway and the gateway association cannot be changed after creation.
Compatible with Kiro, Claude Code, Cursor, VS Code MCP clients
Particularly useful for agents accessed via IDE and MCP clients. Users grant consent once before invoking a tool; subsequent calls reuse the stored token without repeated authorization prompts.
CloudTrail audit log covers all OAuth consent operations
Bedrock AgentCore records GetResourceOauth2Token, CompleteResourceTokenAuth, and GetWorkloadAccessTokenForJWT events in AWS CloudTrail. Sensitive token and state values are redacted in logs.
AI-DLC: AI as collaborative partner across the software lifecycle
The AI-Driven Development Lifecycle (AI-DLC) framework positions AI as a central collaborator handling routine execution — artifact generation, code production, deployment — while humans retain oversight of critical architectural and technical decisions in real time.
Reference impl 1: Automated SQL schema to Mermaid ER diagram generation
An S3-triggered, Lambda-invoked AgentCore runtime workflow parses SQL DDL files (tables, constraints, foreign keys) and auto-generates Mermaid ER diagram files saved back to S3, eliminating manual documentation steps from developer PR workflows.
Reference impl 2: Multi-agent CI/CD code security analysis pipeline
A multi-agent architecture using AgentCore Gateway, AgentCore memory, and external tool integrations performs automated security analysis of code in CI/CD pipelines, producing CVE checks and policy compliance reports for human review.
Human-in-the-loop governance is central to both reference architectures
Both implementations are designed so AI proposes architecture, generates code, and produces artifacts while team members clarify technical decisions — no autonomous deployment proceeds without explicit human sign-off.
Open-source GitHub repos with full deployment instructions provided
Both AWS Samples implementations include complete deployment instructions in public GitHub repositories, giving engineering teams production-ready starting points for adopting AI-DLC construction patterns with AgentCore.
Details
AgentCore Gateway: single MCP entry point
Amazon Bedrock AgentCore Gateway provides a centralized, secure entry point for all AI agent MCP traffic to organizational tools and data, replacing decentralized per-agent credential configurations.
Five structural MCP breakdown patterns
Credential sprawl (secrets in local configs), policy drift (N×M configs diverging silently), audit gaps (no record of who invoked what), cost opacity (spend unattributable to teams), and shadow IT (integrations deployed outside review).
Policy drift: N×M credential sets
A team with 10 AI assistants connecting to 5 internal APIs maintains 50 independent credential sets configured by hand with no oversight — policy drift compounds with each new assistant or API added.
AgentCore component ecosystem
Gateway integrates with AgentCore Identity (auth, authorization, credential management), AgentCore Policy (security controls for agent-tool interactions), Amazon Bedrock Guardrails (safety and privacy), and AWS Agent Registry (centralized tool catalog).
Compatible MCP-enabled AI assistants
Works with MCP-enabled coding and AI assistants including AWS Kiro, Claude Code (Anthropic), Cursor, and Amazon Quick.
Self-hosted alternatives
Kong Gateway, Open Policy Agent, NeMo Guardrails, and LangFuse offer self-hosted alternatives for organizations not using AWS managed services; AWS post notes these explicitly for non-AWS-native teams.
AI agent governance as enterprise security category
AgentCore Gateway's launch positions AI agent access governance as a distinct, production-grade enterprise security product category, separate from general cloud IAM or API gateway products.
Details on AWS AgentCore Gateway's capabilities, the MCP security problems it addresses, and its integration with the broader Bedrock AgentCore ecosystem.
What This Means
As enterprises deploy growing numbers of AI agents that connect to sensitive internal systems, the proliferation of unmanaged MCP credentials has become a genuine security liability. AgentCore Gateway addresses what is effectively shadow IT for AI agents — unauthorized, unmonitored connections accumulating without central visibility or auditability. AWS's decision to build a dedicated managed service around this problem validates that AI agent deployment has matured to the point where governance infrastructure is a requirement, not an afterthought. Organizations running multiple AI coding assistants or autonomous agents should treat the "who has access to what" question as urgent, regardless of whether they use AWS's solution or a self-hosted alternative.