Solution Overview
Amazon Bedrock AgentCore Gateway and MCP are utilized to build a multi-account AI agent. This architecture enables agents to execute queries centrally while keeping data in each line of business (LOB) account. (Source: aws.amazon.com)
Architecture Details
The multi-account model consists of a three-layer structure: platform accounts, distributed LOB accounts, and AgentCore Gateway. The platform account runs the AgentCore Runtime to execute agents, and LLM inference is performed via Amazon Bedrock. LOB teams publish data through MCP servers, which are integrated by AgentCore Gateway to provide a consistent endpoint. (Source: aws.amazon.com)
Setup Procedures and Implementation Examples
- MCP Server Setup: Configure MCP servers in each LOB account and register them with AgentCore Gateway.
- Authentication Configuration: Utilize AgentCore Identity and Okta to implement fine-grained access control.
- Endpoint Construction: Set up real-time and asynchronous endpoints through AgentCore Gateway to integrate data access across multiple accounts. (Source: aws.amazon.com)
Performance and Governance
AgentCore Gateway supports traffic routing and rate limiting by model provider and team, ensuring cost management and security in large deployments. Additionally, Amazon Bedrock Guardrails provide safeguards to improve the reliability of the inference process. (Source: aws.amazon.com)
Summary
- AgentCore Gateway can centralize data access across multiple AWS accounts
- Combining MCP servers and AgentCore Identity enables fine-grained access control
- Setting up real-time and asynchronous endpoints allows for flexible AI agent construction
- Amazon Bedrock Guardrails provide safeguards to ensure the reliability of the inference process
- Centralized management in the platform account is possible for agent deployment