AMAZON BEDROCK / SERVICE DETAIL S04
AGENTCORE GATEWAY
CHAPTER 11 / 36
IN ONE LINE turns your APIs into agent tools
REV 2026.07
Agents need tools (functions and APIs) to do real work. Wiring each one up by hand is slow. Gateway does it for you: point it at an API or an AWS Lambda function and it becomes a tool the agent can use, behind one secure address, with the login and permissions handled.
New to these words? Read chapter 02 "Key terms" (tool, MCP, Lambda, OAuth).
[ 1 ] WHAT GATEWAY IS
Gateway is a single front door between your agent and your tools. It takes things you already have, your APIs and AWS Lambda functions, and exposes them as tools the agent can call using MCP (the standard way agents talk to tools). It is the only fully managed AWS service that handles security on both sides: who may use the gateway (inbound), and how the gateway logs in to your services (outbound).
YOU PLUG IN
OpenAPI (a description of a REST API), Smithy, Lambda functions, or existing MCP servers.
THE AGENT GETS
One address with all your tools in a single list, plus search to find the right one.
[ 2 ] THE MAIN WAYS TO PLUG THINGS IN (A THIRD, INFERENCE TARGETS, ROUTES LLM TRAFFIC ACROSS MODEL PROVIDERS)
COMBINE MANY INTO ONE aggregation
Add several backends: Lambda, OpenAPI, Smithy, MCP servers.
Gateway merges them into one tool list the agent sees.
Includes search so the agent can find the right tool among many.
PASS STRAIGHT THROUGH proxy
For a web service such as an AgentCore Runtime agent.
Traffic goes directly to it, with no merging.
Each is reached on its own path.
[ 3 ] WHAT HAPPENS WHEN THE AGENT CALLS A TOOL
STEP 01
FIND
The agent reads the tool list, or searches it by meaning to pick the right tool.
==>
STEP 02
CHECK CALLER
Gateway checks who is calling (inbound auth) before letting the request through.
==>
STEP 03
TRANSLATE
It turns the tool call into a real API request or a Lambda run.
==>
STEP 04
LOG IN
It adds the right credentials to reach your service (outbound auth).
==>
STEP 05
RETURN
It hands the result back to the agent as a tool answer.
[ 4 ] SECURITY ON BOTH SIDES
INBOUND who may use the gateway
OAuth (a login token), or AWS SigV4 (AWS identity).
Check only: confirm the token, let the tool decide the rest.
None: open, for quick testing only.
OUTBOUND how the gateway reaches your service
For Lambda: an AWS role you grant it (Smithy: a role, or OAuth).
For OpenAPI and MCP servers: a stored API key or OAuth login.
Or AWS SigV4, or none for public services.
[ 5 ] WHY TEAMS USE IT
ONE ADDRESS
Many APIs and functions behind a single secure endpoint.
FIND THE TOOL
Search lets an agent use thousands of tools without a giant prompt.
READY-MADE
One-click links to Salesforce, Slack, Jira, Asana, Zendesk.
NO SERVERS
Fully managed, scales itself, with built-in logging.