AWS Announces Multi-Account AI Agent Architecture with AgentCore Gateway and MCP
AWS has introduced a new architecture for multi-account AI agents that allows data to remain in its original line-of-business (LOB) accounts while enabling agents to query across them.
Enterprises increasingly want AI agents that can reason over data spread across many AWS accounts without copying or centralizing it. Each team keeps its data in its own account for clear ownership, scope isolation, and independent deployment lifecycles. AWS has introduced a new architecture for multi-account AI agents that allows data to remain in its original line-of-business (LOB) accounts while enabling agents to query across them, using Amazon Bedrock AgentCore Gateway and Model Context Protocol (MCP).
In this architecture, a central platform account hosts the agent tier and large language model (LLM) inference through Amazon Bedrock. LOB teams expose their data and tools as MCP servers, and the platform account’s AgentCore Gateway provides a single endpoint for tool discovery and invocation across registered LOBs. This setup ensures that only the specific data a request needs flows out at query time, so the underlying datasets do not leave their owning account.
The architecture follows a multi-account model with three layers: a central platform account, distributed LOB accounts, and AgentCore Gateway as the integration layer that connects them. Each LOB deploys a standalone MCP server (the spoke) using MCP over Streamable HTTP, while AgentCore Gateway (the hub) aggregates them behind a single endpoint. When the agent invokes a tool, the Gateway retrieves OAuth 2.0 machine-to-machine (M2M) credentials from AgentCore Identity, attaches them to the outbound request, and routes it to the right LOB MCP server, which authenticates the token against Okta’s OpenID Connect (OIDC) endpoint before processing the request locally.
This pattern scales naturally: to onboard a new line of business, the platform team adds a Gateway target and the agent discovers the new tools on its next invocation. For more details, refer to the accompanying repository and deploy the four-account reference implementation.
Source: aws-ml
