Build a multi-account AI agent with AgentCore Gateway and MCP
Amazon Web Services Senthil Kamala Rathinam
AWS shows a way to let AI agents query data across accounts without copying it. The trick is a Gateway plus MCP, so each team keeps control of its own data.
Based on reporting by Amazon Web Services, Senthil Kamala Rathinam — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
AWS is pitching a cleaner way to build enterprise AI agents: keep the data where it already lives, even when it’s spread across many AWS accounts. That matters because the usual alternatives are messy. You either copy data around, or you spend your days untangling cross-account IAM. Neither is much fun for anyone who has to explain the security model in a meeting.
The setup in the post uses a central platform account for the agent and separate line-of-business accounts for the data and tools. The platform team runs the agent on AgentCore Runtime and sends all tool traffic through AgentCore Gateway. Each LOB team wraps its own sources as an MCP server. The Gateway then acts as the single MCP endpoint, with semantic tool discovery, centralized authentication, and policy enforcement sitting in front of the LOBs.
The point is not to move the datasets. It’s to return only the slice of data the agent needs at query time. A retail banking team, for example, can expose tools such as get_balance and get_profile. A lending team can expose get_credit_score and search_lending_policies, with the policy search backed by Amazon Bedrock Knowledge Bases over bank policy PDFs. AWS also says new implementations can attach a managed knowledge base directly to the Gateway as a native connector, so the agent can query it with standard MCP calls without the team running retrieval infrastructure.
The security chain is doing a lot of the heavy lifting. The user signs in through Okta, a React web app forwards the request through CloudFront to a FastAPI backend on ECS with Fargate, and Bedrock Guardrails redact PII on the way in and out. The agent then uses AgentCore Gateway, which can apply Policy in AgentCore for fine-grained authorization and retrieve OAuth 2.0 machine-to-machine credentials from AgentCore Identity before calling the right LOB MCP server. Those servers validate the token against Okta before running local logic against DynamoDB or, in the lending example, Bedrock Knowledge Bases and S3-backed policy docs indexed in OpenSearch Serverless.
AWS is also leaning on a hub-and-spoke pattern to keep things tidy. A new LOB becomes another Gateway target, and the agent finds the new tool set on its next tools/list call. That’s the real appeal here: not magical AI, just a governed path across accounts that avoids turning every new tool into an IAM archaeology project.
My take — AI-written commentary, not fact-checked reporting
This is the kind of enterprise AI architecture that actually sounds like it was written by people who have met a compliance team. Keeping data in place while centralizing access control is the sane move, and the industry keeps rediscovering that after a few painful years of “just copy it somewhere.” The real story is boring governance, which is usually where the money and the regret both end up.
Read more about this at: Amazon Web Services