October 22, 2026

How Eon Built Multi-Cloud Investigation with an MCP Gateway on Amazon Bedrock AgentCore

← AI for Your Work

WebCrimp analysis and practical explanation. AI-assisted; reviewed before publication.

Quick Summary

Eon reported how it used Amazon Bedrock AgentCore, including the AgentCore Gateway, Cedar-based policies, AgentCore Runtime, and AgentCore Identity, to connect developers and an autonomous site reliability engineering agent to investigation tools across AWS, Azure, and Google Cloud.

What Happened?

The post described Eon, co-written with Roei Zavida, and its internal engineering incident response needs. Eon used Amazon Bedrock AgentCore to replace per-tool credentials and local Model Context Protocol processes with a single authenticated gateway. The gateway used corporate single sign-on through Amazon Cognito, Amazon API Gateway as an OAuth entry point, Cognito client credentials for agents, Cedar policies, and AgentCore Runtimes across multiple AWS accounts. Cedar policies in ENFORCE mode controlled which principals could invoke which tools. Read operations were limited to selected groups, while write operations were limited to low-impact actions such as pull request comments and were audited. The architecture supported cross-account access through IAM role assumption instead of VPC peering or PrivateLink. Eon reported that developer onboarding time fell from about two days to about two minutes, local MCP processes went to zero, credential sets per developer went to zero, and cross-account networking moved to IAM-only.

Why It Matters

This matters because AI agents and humans increasingly need access to many operational tools. Across multiple clouds, each tool can have different authentication, network boundaries, and policies. A centralized gateway may reduce integration and credential overhead, but it also requires careful identity separation, least privilege, policy management, and auditing. Teams should treat gateway design as a governance and security exercise, not only a technical integration.

Who Can Use It?

Cloud · DevOps · Software Development · Cybersecurity · Data Analytics · AI/ML

How Can I Use This?

If you work in Cloud, DevOps, Software Development, Cybersecurity, Data Analytics, AI/ML

  • For cloud, DevOps, cybersecurity, and data analytics teams, start with a proof of concept using a small read-only tool set. Actionable tip: use dynamic listing mode for high-tool-count targets to avoid Cedar policy size growth. Trick: use Runtime plus IAM for cross-account tool access instead of VPC peering or PrivateLink when suitable. Workflow: inventory tools, define identity groups, choose Runtime attachment pattern, configure identity federation, write Cedar policies, test access, and audit changes. Workflow suggestions need verification. Copyable prompt: Act as an AI agent gateway architect. Design a least-privilege Model Context Protocol gateway for [tool inventory] across [cloud providers]. Use [identity provider] and [policy engine]. Keep production tools read-only and route human and agent access through [gateway]. Return policy examples for [principal] and tool groups.

AI Tip

Use Cedar policies in ENFORCE mode for tool-level authorization and combine DEFAULT mode for OAuth-sensitive or smaller targets with DYNAMIC mode for large tool catalogs.

AI Trick

Use a Runtime wrapper to filter tool manifests and use DYNAMIC listing mode when policy size or tool count makes pre-indexing impractical.

Example Workflow

  1. 1. Inventory investigation tools. 2. Define human groups and agent identities. 3. Choose gateway and runtime attachment pattern. 4. Configure identity federation. 5. Write Cedar policies. 6. Test access. 7. Audit. Workflow suggestions need verification.

Copy This Prompt

Act as an AI agent gateway architect. Design a least-privilege Model Context Protocol gateway for [tool inventory] across [cloud providers]. Use [identity provider] and [policy engine]. Keep production tools read-only and route human and agent access through [gateway]. Return policy examples for [principal] and tool groups.

Recommended Tools

  • Amazon Bedrock AgentCore
  • Model Context Protocol
  • Amazon Cognito
  • Amazon API Gateway
  • AWS IAM
  • Cedar

Check official documentation, availability and pricing before using these suggestions.

Difficulty

Intermediate

Estimated Time Saved

Not measured; validate with your own workflow.

Source

AWS AI
How Eon built multi-cloud investigation with an MCP Gateway on Amazon Bedrock AgentCore
Original publication date: 2026-10-20T15:57:57+00:00