AgentCore Gateway Private CA TLS: A UK Production Gate for VPC MCP Targets

What changed

On 2 October 2026 AWS announced that Amazon Bedrock AgentCore Gateway can use TLS certificates signed by your private certificate authority when calling MCP, OpenAPI and HTTP proxy (passthrough) targets. The gateway pulls a PEM-encoded CA from Amazon S3 or AWS Secrets Manager and uses it as the trust anchor for outbound TLS to private endpoints powered by Amazon VPC Lattice.

For UK estates that refused to put an Application Load Balancer in front of every internal MCP server just to present a public CA cert, this removes a real friction. It does not remove the need for a production gate.

Why UK platform teams care

Typical pattern before this launch:

• Internal tools (CMDB sync, ITSM adapters, finance APIs) live on private DNS with corp PKI.
• AgentCore Gateway could not natively trust that PKI → teams inserted an ALB with ACM public certs, or worse, disabled verification in a custom proxy.
• Both paths create audit noise and an extra blast radius.

Private CA support lets the gateway speak native TLS to Lattice-backed private endpoints. Regions: wherever both AgentCore Gateway and VPC Lattice are available.

Production gate

Gate 0 — Decide the trust-anchor store

Pick one store per environment and document it:

Never mix stores for the same target across accounts. Never put the CA PEM in the agent prompt, container env of a public agent, or Parameter Store as plaintext shared across accounts.

Gate 1 — Least-privilege fetch

• Gateway execution role: secretsmanager:GetSecretValue or s3:GetObject on that one secret/object only.
• Deny s3:ListBucket / secretsmanager:ListSecrets where you can — discovery is half of lateral movement.
• Separate roles for non-prod vs prod trust anchors. A compromised dev agent must not read the prod CA secret.

Pair this with the post-AgentCorruption hardening baseline (IMDSv2 default, narrowed AgentCore execution roles, no cross-agent invoke by default). Private CA trust without role hygiene just moves the blast radius.

Gate 2 — Target registration checklist

For each MCP / OpenAPI / HTTP proxy target:

1. Endpoint is VPC Lattice private, not a random ENI DNS name you found in Confluence.
2. Server cert chains to the registered private CA (intermediate included if your PKI requires it).
3. Hostname matches what the gateway will present (SNI / SAN discipline).
4. Health check and timeout match the backend SLO — Lattice 5xx should page the owning team, not retry forever in the agent loop.
5. Tool allowlist on the gateway matches the MCP methods you actually approved (see earlier AgentCore Gateway HTTP passthrough gate).

Gate 3 — Still use an ALB when…

Private CA on Gateway does not replace an ALB when you need:

• Public or partner-facing ingress
• WAF / Shield in front of the service
• Path-based routing across many backends with different certs
• Mutual TLS with client certs the gateway does not terminate for you today

If your only reason for the ALB was "AgentCore cannot trust corp PKI", you can retire that ALB after Gate 2 passes in non-prod.

Gate 4 — Rotate and revoke

• CA rotation runbook: dual-trust window (old + new PEM) → cutover → remove old.
• Compromised intermediate: revoke at the CA, publish CRL/OCSP as your PKI requires, and rotate the gateway trust-anchor secret/object immediately.
• Alert on AccessDenied fetching the trust anchor and on TLS handshake failures to Lattice targets — both are pageable for SRE.

Reference wiring (conceptual)

AgentCore Runtime agent
  → AgentCore Gateway (MCP / OpenAPI / HTTP proxy target)
      → trust anchor: PEM from Secrets Manager or S3
      → TLS to VPC Lattice private endpoint
          → internal MCP / OpenAPI service (corp PKI cert)

No ALB in the middle unless Gate 3 says you still need one.

Verification before PROD

1. Register a throwaway MCP target in non-prod with a private-CA cert.
2. Confirm gateway fetch of PEM succeeds (CloudTrail on GetSecretValue / GetObject).
3. Confirm successful TLS + one allowlisted tool call.
4. Flip the CA secret to a wrong PEM → expect clean failure, not fallback to system trust store.
5. Confirm prod role cannot read non-prod secret and vice versa.

Only then migrate a real internal tool off its temporary ALB.

Bottom line

Private CA support on AgentCore Gateway is the right fix for corp-PKI backends on VPC Lattice. The UK production gate is boring on purpose: one trust-anchor store, least-privilege fetch, Lattice-only targets, keep ALBs where ingress controls still matter, and rotate like you mean it.