Building a Private Amazon Bedrock AgentCore to Meet Enterprise Security Requirements

The most critical consideration for enterprise customers adopting AI Agents is ensuring that internal assets are not exposed to the internet. Customers in regulated industries such as finance, public sector, and manufacturing require an environment that maintains security while leveraging their existing sLLM, Keycloak (IdP), and MCP servers.

Amazon Bedrock AgentCore provides the following core components to meet these requirements:

• AgentCore Runtime: Deployed in VPC mode, it can invoke vLLM-based models hosted on-premises.
• AgentCore Identity: Handles CUSTOM_JWT authentication using the internal Keycloak, and retrieves JWKS from the private network via VPC egress capabilities.
• AgentCore Gateway: Targets MCP servers located on-premises, integrating them into a single endpoint.

While traditional AWS PrivateLink focuses on traffic egressing from your VPC to AWS services, the core of this configuration is controlling 'Egress' traffic via VPC Lattice Resource Gateway. This enables AgentCore, an AWS service, to access the customer's private network to query IdP endpoints or invoke MCP servers.

As a result, clients can securely invoke Agents using JWTs issued by the internal IdP, with all communications routed through the private network connected via Direct Connect or VPN, ensuring no external exposure.