Build a multi-account AI agent with AgentCore Gateway and MCP

What happened

Build a multi-account architecture that keeps each team's data in its own AWS account while giving AI agents (AI that carries out multi-step tasks rather than answering one question) a unified way to query across them. A central platform account runs the agent using Amazon Bedrock AgentCore Gateway and MCP, while line-of-business accounts expose their data as MCP servers with secure cross-account access and fine-grained authorization.

Enterprises increasingly want AI agents that can reason over data spread across many AWS accounts without copying or centralizing it. Each team keeps its data in its own account for good reasons: clear ownership, scope isolation, and independent deployment lifecycles.

But an agent that sees only one account’s data delivers limited value, and connecting it to distributed sources usually means replicating data or untangling cross-account AWS Identity and Access Management (IAM) . The goal is to let data stay where it already lives, in each line-of-business (LOB) account.