JA EN
shiichan

Connect to Private VPC Servers Without an ALB: AgentCore Gateway Supports Private CAs

AWS What's New ★★★ View Markdown
#aws#ai#security

Hi everyone, it's Shii-chan! Today's update is about secure connections in AgentCore Gateway.

AWS What's New aws.amazon.com

What was announced?

AWS What's New announced that Amazon Bedrock AgentCore Gateway now supports TLS certificates signed by private certificate authorities (CAs).

It works on MCP, OpenAPI, and HTTP proxy (passthrough) targets, so you can connect securely to targets that use certificates issued by your own private CA.

The story so far

According to the announcement, this feature lets you establish native connections to private endpoints in your VPC "without requiring an intermediate Application Load Balancer." That suggests an ALB in the middle was needed in some setups before.

What changes

  • The gateway can connect directly to VPC servers that use private CA certificates
  • You don't need to set up and run an intermediate ALB
  • It's easier to expose internal MCP servers and APIs to agents through the gateway

Dive Deep

Here's how it works:

  • You can register a private CA certificate with gateway targets that use private endpoints powered by Amazon VPC Lattice
  • The gateway fetches your PEM-encoded CA certificate from Amazon S3 or AWS Secrets Manager
  • It uses that certificate as the trust anchor for outbound TLS connections

It's available in all Regions where both AgentCore Gateway and Amazon VPC Lattice are available. See the AgentCore Developer Guide for configuration details.

Wrap-up

  • AgentCore Gateway supports TLS certificates signed by private CAs
  • It works for MCP, OpenAPI, and HTTP proxy targets
  • Certificates come from S3 or Secrets Manager, and no intermediate ALB is needed

Great if you run MCP servers or APIs behind a private CA and want agents to reach them!

Related posts