Building an MCP-Based Cloud Policy Agent with Amazon MWAA and Bedrock AgentCore

As cloud infrastructure scales, managing vast amounts of resource data—such as IAM policies, security groups, and network configurations—spread across multiple accounts and regions has become increasingly difficult. Existing approaches have limitations in that each team uses different data collection methods, making cross-analysis difficult.

To address this, we propose an architecture that automates policy collection with Amazon MWAA and implements semantic search through Amazon S3 Vectors. In particular, by leveraging the MCP (Model Context Protocol) standard to standardize the data access layer, the design allows the same tools to be reused across various AI tools without being tied to a specific framework.

The system consists of three layers.

• Data Collection Layer: MWAA collects policies and stores them in S3, then vectorizes them with Amazon Bedrock Titan Embed v2 and stores them in S3 Vectors.
• AI Agent Layer: The Strands Agent runs serverlessly on Amazon Bedrock AgentCore Runtime, providing 6 MCP standard-based tools (search, detailed lookup, comparison, etc.).
• Consumer Layer: Various AI tools, such as a Streamlit dashboard or Kiro, access the agent to respond to user queries.