Configuring Amazon Bedrock AgentCore Gateway for secure access to private resources

Amazon AWS AI Blog / 5/1/2026

💬 OpinionDeveloper Stack & InfrastructureTools & Practical Usage

Key Points

  • The post explains how to configure Amazon Bedrock AgentCore Gateway to reach private resources inside a customer VPC using a managed Resource Gateway that creates ENIs per subnet.
  • It covers two deployment/implementation modes—managed and self-managed—so readers can choose the level of control and operational responsibility.
  • Three practical scenarios are demonstrated, including access to a private Amazon API Gateway endpoint and integration with an MCP server running on Amazon EKS.
  • The guide also shows how to connect to a private REST API, illustrating end-to-end connectivity patterns for secure internal access.
In this post, you will configure Amazon Bedrock AgentCore Gateway to access private endpoints using Resource Gateway, a managed construct that provisions Elastic Network Interfaces (ENIs) directly inside your Amazon VPC, one per subnet. You will explore two implementation modes (managed and self-managed) and walk through three practical scenarios: connecting to a private Amazon API Gateway endpoint, integrating with a MCP server on Amazon Elastic Kubernetes Service (Amazon EKS), and accessing a private REST API.