AWS sample: a hub-and-spoke agent calling MCP servers across AWS accounts through AgentCore Gateway with Cedar policies
AWS Machine Learning Blog·low signal
AWS published a CDK sample for four accounts. A central account runs the agent on AgentCore Runtime, and each line-of-business account exposes its data through its own MCP server. Gateway fetches OAuth M2M tokens from AgentCore Identity, evaluates the user's Okta JWT claims against Cedar policies, and routes calls to MCP servers that each validate tokens with a custom JWT authorizer. It gives a reusable pattern for letting one agent reach data owned by separate teams without pooling their credentials.
AWS Machine Learning Bloglow signal