Govern AI Agent Tool Access with Amazon Bedrock AgentCore Gateway

Amazon Bedrock AgentCore Gateway is generally available and already used in multi‑tenant SaaS back‑ends to enforce per‑agent IAM controls.

Production‑ready pattern
- Define a resource‑based policy on the AgentCore ARN using bedrock:AgentId and bedrock:Action condition keys. Example:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"AWS": "arn:aws:iam::123456789012:role/AgentConsumer"},
    "Action": "bedrock:InvokeAgent",
    "Resource": "arn:aws:bedrock:us-east-1:123456789012:agent/AgentCore/*",
    "Condition": {"StringEquals": {"bedrock:AgentId": "my‑agent-id"}}
  }]
}

- Attach the policy to the AgentCore via the AWS CLI: aws bedrock update-agent --agent-id my-agent-id --resource-policy file://policy.json.
- Pair with IAM Access Analyzer to verify no broader access is granted.

Recent changes
- Late‑2025 update added bedrock:CallerAccount condition key, enabling cross‑account delegation without a separate trust policy.
- Early‑2026 introduced native federation with GCP Service Accounts via IAM Identity Center, allowing gcp.serviceAccount.email as a condition key.

When to adopt
- Use when you need per‑agent least‑privilege enforcement across multiple AWS accounts or a hybrid AWS‑GCP environment.
- Avoid for single‑account, single‑agent prototypes where the overhead of a gateway adds latency and cost.

Gotcha
- The gateway incurs an extra $0.000015 per 1 000 tokens processed and adds ~30 ms latency; high‑throughput workloads should benchmark token volume against the added cost before scaling.