AgentCore Gateway Runtime Targets GA: A UK Production Gate for Fronting Agents

Runtime targets on Gateway are a production gate — not just another MCP aggregation trick

In the June 2026 AgentCore wave (now documented as generally available), Amazon Bedrock AgentCore Gateway can attach an AgentCore Runtime agent as a target. The gateway forwards requests and responses without aggregation or protocol translation. That is different from MCP targets that merge tools into one virtual MCP server.

For UK platform, SRE and security leads, GA matters because you can finally put policy, Guardrails, interceptors and observability outside the agent process — and enforce that callers cannot bypass the gateway to hit the runtime directly (IAM SigV4 or OAuth JWT).

Cloud architecture and agent gateway

What AWS made generally available

Why UK estates should care

Classic pattern: agents call each other or expose HTTP/MCP endpoints; auth and Guardrails live inside the agent. That fails audits when someone invokes the runtime ARN directly.

GA Runtime targets let you:

1. Put a single governed entry point in front of one or more runtimes.
2. Apply Cedar/policy, Bedrock Guardrails, and observability at the gateway.
3. Use interceptor Lambdas to redact, enrich or block in buffered mode.
4. Stamp source so the runtime rejects non-gateway callers.

Target configuration (CAB-readable)

Minimum shape:

{
  "http": {
    "agentcoreRuntime": {
      "arn": "arn:aws:bedrock-agentcore:eu-west-2:111122223333:runtime/RUNTIME_ID",
      "qualifier": "DEFAULT",
      "schema": {
        "source": {
          "s3": {
            "uri": "s3://example-bucket/agent-schema.yaml"
          }
        }
      }
    }
  }
}

• arn (required) — Runtime agent ARN.
• qualifier (optional) — defaults to DEFAULT.
• schema (optional) — S3 URI or inlinePayload; auto-detected OpenAPI or Smithy.

Invoke example:

curl -X POST https://gateway-id.gateway.bedrock-agentcore.eu-west-2.amazonaws.com/my-target/invocations \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{"input": {"prompt": "Hello"}}'

Prefer eu-west-1 / eu-west-2 for UK data-residency programmes unless your DPIA already names another Region.

Enforce traffic through the gateway (do not skip)

Fronting a runtime is worthless if clients still call InvokeAgentRuntime on the raw ARN.

Gate: prove a direct runtime invoke fails after enforcement, then prove the gateway path succeeds, in non-prod before CAB.

Outbound authorization options

Runtime target vs MCP target — choose deliberately

Wrong choice symptom: teams expect one aggregated tool catalogue and get path-routed isolation instead.

UK pre-production gate

1. Pick Region (eu-west-2 / eu-west-1) and confirm AgentCore Gateway + Runtime availability.
2. Create/use a gateway without MCP protocol type if attaching Runtime targets.
3. Attach Runtime target with ARN + qualifier; add schema for HTTP agents that need Guardrails.
4. Configure outbound auth (prefer IAM role locked to gateway).
5. Enable gateway-only inbound on the runtime (SigV4 RBP or JWT workload allowlist).
6. Add buffered interceptor Lambdas if you need PII redaction / allowlists.
7. Dual-run: direct invoke must fail; gateway invoke must succeed; SSE path tested if used.
8. Wire CloudWatch / Transaction Search; name alarm owners.
9. Update DPIA / AI inventory: gateway as processing hop; Guardrails as control.
10. CAB pack: architecture diagram, failure modes, rollback (detach target / relax RBP — with expiry).

GDPR and UK ops language

CAB checklist (print this)

1. Gateway is non-MCP-protocol type for Runtime targets.
2. Runtime ARN + qualifier documented; schema present for HTTP + Guardrails.
3. Outbound auth mode chosen and least-privilege reviewed.
4. Bypass blocked (SigV4 SourceArn or JWT allowedWorkloadConfiguration).
5. Direct-invoke negative test attached to the change.
6. SSE vs buffered interceptor limitations understood.
7. Region / DPIA / inventory updated.
8. Rollback owner and expiry for any temporary bypass.

Risks if you skip the gate

Closing

AgentCore Runtime targets GA turn the gateway into a real control plane for whole agents — not only MCP tool mash-ups. UK production value is the combination of path-routed forward, policy/Guardrails outside the agent, and hard bypass prevention. Treat that as a CAB programme with dual-run evidence, not a console click.

If you want a structured AgentCore Gateway / Runtime-target readiness pass for your UK estate — Region, IAM, Guardrails schema and bypass tests — AIATS offers a Free Evaluation: practical, UK-enterprise, no theatre.

Questions for the platform / security agenda

1. Which runtimes must be reachable only via Gateway?
2. IAM SigV4 or JWT inbound on each runtime — and is bypass locked?
3. Do we need Guardrails (schema ready for HTTP agents)?
4. Buffered interceptors: what must be redacted before the model/tools see it?
5. Are clients path-routed correctly, or were they built for MCP aggregation?
6. Which Region is named in the DPIA?
7. Who owns the direct-invoke negative test in every release?