Govern MCP Tools at Scale with Kiro and AgentCore Gateway

aws bedrock-agentcore-control create-gateway \
  --name company-gateway \
  --role-arn arn:aws:iam::123456789012:role/GatewayRole \
  --protocol-type MCP \
  --authorizer-type CUSTOM_JWT \
  --authorizer-configuration '{
    "customJWTAuthorizer": {
      "discoveryUrl": "https://idp.company.internal/.well-known/openid-configuration",
      "allowedAudience": ["agentcore-gateway-client"],
      "allowedClients": ["agentcore-gateway-client"],
      "allowedScopes": ["bedrock:invoke"],
      "customClaims": [
        {
          "inboundTokenClaimName": "groups",
          "inboundTokenClaimValueType": "STRING_ARRAY",
          "authorizingClaimMatchValue": {
            "claimMatchValue": {
              "matchValueStringList": ["dev-team-a", "docs-team"]
            },
            "claimMatchOperator": "CONTAINS_ANY"
          }
        }
      ]
    }
  }' \
  --policy-engine-configuration '{
    "arn": "arn:aws:bedrock-agentcore:us-west-2:123456789012:policy-engine/PlatformPolicyEngine-abc123",
    "mode": "LOG_ONLY"
  }'

aws bedrock-agentcore-control create-gateway-target \
  --gateway-identifier company-gateway \
  --name AuroraQueryTool \
  --target-configuration '{
    "mcp": {
      "mcpServer": {
        "endpoint": "https://postgres-mcp.internal:8080/mcp"
      }
    }
  }'

aws bedrock-agentcore-control create-gateway-target \
  --gateway-identifier company-gateway \
  --name ExternalDocsTool \
  --target-configuration '{
    "mcp": {
      "mcpServer": {
        "endpoint": "https://external-docs.internal/mcp"
      }
    }
  }'

# Option B example: Lambda wrapper for external Jira API
# The Lambda handles authentication, input validation,
# and response filtering before returning results.
aws bedrock-agentcore-control create-gateway-target \
  --gateway-identifier company-gateway \
  --name JiraIssueLookup \
  --target-configuration '{
    "mcp": {
      "lambda": {
        "lambdaArn": "arn:aws:lambda:us-west-2:123456789012:function:jira-issue-lookup"
      }
    }
  }'

// Cedar policy: tool-level access control with parameter conditions.
// Default-deny: only invocations matching a permit statement are allowed.
permit (
    principal,
    action,
    resource
)
when {
    // Scope to this Gateway instance
    resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:us-west-2:123456789012:gateway/company-gateway"
    &&
    principal.hasTag("groups")
    &&
    (
        (
            // dev-team-a can deploy, but only to staging
            action == AgentCore::Action::"DeployCI___invoke"
            &&
            principal.getTag("groups").contains("dev-team-a")
            &&
            context.input.environment == "staging"
        )
        ||
        (
            // docs-team can use external documentation tool
            action == AgentCore::Action::"ExternalDocsTool___invoke"
            &&
            principal.getTag("groups").contains("docs-team")
        )
    )
};

// Policy 1: payments-service repository
// Members of repo-payments-service group can invoke payment
// processing and database tools, but ONLY in staging environment.
// This prevents accidental production changes by the payments team.
permit (
    principal,
    action,
    resource
)
when {
    // Scope to this Gateway instance
    resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:us-west-2:123456789012:gateway/company-gateway"
    &&
    // Check group membership from IdP claims (mapped in Step 1).
    // Uses .contains() because IdP sends groups as an array.
    principal.hasTag("groups") &&
    principal.getTag("groups").contains("repo-payments-service")
    &&
    // Allow only these three tools for this team
    action in [
        AgentCore::Action::"PaymentAPI___invoke",
        AgentCore::Action::"DatabaseQuery___invoke",
        AgentCore::Action::"DeployCI___invoke"
    ]
    &&
    // Restrict all three tools to staging environment only
    context.input.environment == "staging"
};

// Policy 2: web-app repository
// Frontend team can use design and documentation tools.
// No environment restriction — these tools are safe for any context.
permit (
    principal,
    action,
    resource
)
when {
    resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:us-west-2:123456789012:gateway/company-gateway"
    &&
    principal.hasTag("groups") &&
    principal.getTag("groups").contains("repo-web-app")
    &&
    action in [
        AgentCore::Action::"DesignSystem___invoke",
        AgentCore::Action::"DocsSearch___invoke",
        AgentCore::Action::"ComponentLib___invoke"
    ]
};

// Policy 3: infra-core repository
// Platform team has broader access including deployment and ops tools.
// Note: DeployCI appears here AND in Policy 1 — shared tools can have
// different conditions per team (staging-only for payments, unrestricted
// for platform).
permit (
    principal,
    action,
    resource
)
when {
    resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:us-west-2:123456789012:gateway/company-gateway"
    &&
    principal.hasTag("groups") &&
    principal.getTag("groups").contains("repo-infra-core")
    &&
    action in [
        AgentCore::Action::"DeployCI___invoke",
        AgentCore::Action::"CloudOps___invoke",
        AgentCore::Action::"MonitoringDashboard___invoke"
    ]
};

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyS3DeleteViaAnyMCP",
      "Effect": "Deny",
      "Action": [
        "s3:DeleteBucket",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion"
      ],
      "Resource": [
        "arn:aws:s3:::amzn-s3-demo-bucket",
        "arn:aws:s3:::amzn-s3-demo-bucket/*"
      ],
      "Condition": {
        "Bool": {
          "aws:ViaAWSMCPService": "true"
        }
      }
    },
    {
      "Sid": "DenyS3DeleteViaSpecificMCP",
      "Effect": "Deny",
      "Action": [
        "s3:DeleteBucket",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion"
      ],
      "Resource": [
        "arn:aws:s3:::amzn-s3-demo-bucket",
        "arn:aws:s3:::amzn-s3-demo-bucket/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:CalledViaAWSMCP": "aws-mcp.amazonaws.com"
        }
      }
    }
  ]
}

package mcp.tools

import rego.v1

default allow := false

# Read-only tools: allow for any authenticated user
allow if {
    startswith(input.tool, "read_")
    input.claims.sub != ""
}

# Write tools: admin role only, during business hours (UTC)
allow if {
    input.tool == "db_write"
    input.claims.role == "admin"
    

clock := time.clock(time.now_ns())
    clock[0] \>= 9
    clock[0] \< 17
}

# For payload content inspection (such as SQL injection detection),
# use a dedicated input validation library or a web application firewall (AWS WAF).
# See OWASP Input Validation Cheat Sheet for recommended approaches.