In-depth analysis · About 5 min read
Eon puts multi-cloud investigations behind one MCP gateway, with separate human and agent permissions
An AWS–Eon case study explains centralized access, Cedar policy and tool-discovery trade-offs; its two-minute figure measures onboarding.
- Published here
- Source published
- Source checked
Eon describes an internal investigation platform that connects engineers and an autonomous SRE agent to operational tools through Amazon Bedrock AgentCore. The October 20 AWS guest post explains how identity, authorization and remote hosting replace per-developer integrations. Its contribution is a production account of those boundaries and their compatibility problems, rather than a new consumer feature or an independent benchmark.
Listen to the news
Read this article aloud or keep listening to the news.
Preparing the reader…
Device voice
Speech is handled by your browser or device. AISubHub does not send the text to an audio API. Voice availability and playback with a locked screen vary by device.
Resuming may repeat a short phrase.
At a glance
- Eon reports access for more than 100 developers and roughly 10,000 sessions; onboarding to the toolset fell from about two days to two minutes.
- Production tools remain read-only, while particular agent identities can perform limited collaboration writes. DYNAMIC discovery reduces indexed policy size but sacrifices semantic search.
One address still contains several identity boundaries
Engineers using Claude Code, Cursor or Codex connect to one MCP endpoint; Eon’s SRE agent uses Claude through Bedrock. Human access federates corporate SSO through Cognito, with an API Gateway entry point proxying the OAuth session. Agents instead use Cognito client-credentials grants and their own identities. The gateway then routes requests to separately hosted tools. This distinction prevents a convenient shared address from implying a shared account or equal authority. The results table’s zero per-developer credential sets means developers no longer configure each service’s token locally. It does not mean credentials disappear: the example Runtime retrieves a downstream service credential from AgentCore Identity. Our reading is that credential consolidation relocates maintenance and trust, rather than eliminating them.
Authorization depends on the principal and the action
Cedar policies run in ENFORCE mode before tools/call requests reach their targets. Selected human groups receive read access; production access is read-only, approved just in time and audited. Specific agent identities can receive explicit permission for low-impact collaboration, such as commenting on a GitHub pull request or ticket. That is not authority to modify production. The source’s example explicitly forbids humans from invoking mutation tools, and policies are reviewed through version-controlled pull requests. AISubHub analysis: teams should test an unauthorized call even when a client knows the tool’s name. Listing a capability and being permitted to execute it are separate conditions; a helpful model response cannot supply the missing permission.
Cross-account IAM is narrower than cross-cloud access
AgentCore Runtimes sit in multiple AWS accounts. A Runtime account trusts the Gateway execution role in another account, allowing IAM role assumption instead of the VPC-peering and per-account PrivateLink setup described in Eon’s previous arrangement. This is the AWS hosting connection, not evidence that one AWS trust policy automatically authorizes every GCP or Azure operation. Individual tools still need their destination-specific access. Most targets use Runtime with IAM; selected remote MCP services are wrapped when their tool surface needs filtering or credential translation. Runtime also exposes originally local stdio MCP servers through Streamable HTTP. The architecture centralizes the connection path while retaining these downstream boundaries.
Large catalogs expose a search and compatibility trade-off
Pre-indexing many tool schemas pushed Eon toward a Cedar policy-size quota. For large targets, DYNAMIC mode forwards tools/list at request time instead of pre-indexing schemas, but semantic tool search is unavailable for those targets. Smaller targets requiring per-user OAuth remain in DEFAULT mode. A Runtime wrapper can filter an excessive catalog while keeping DEFAULT behavior. Eon also built an API Gateway shim because standard clients expect OAuth state-based session protection while AgentCore uses session-URI binding. These are implementation adaptations, not reasons to disable authentication or CSRF protection. Our analysis is to test search quality, consent and invocation together: reducing catalog size or indexing can change what an investigator finds.
Read the time saving as access onboarding, not incident resolution
The team reports several months in production, more than 100 developers and approximately 10,000 sessions. Its clearest comparison is roughly two days to two minutes for configuring access to investigation tools. The table also reports ten local MCP processes per machine falling to zero. Neither comparison measures how quickly every incident is solved, and the post does not provide a controlled accuracy experiment. Eon says its internal agent accounts for most time saved, but gives no independently validated total. We would evaluate role-appropriate access, denied operations and downstream availability alongside setup time. A centralized gateway also concentrates a dependency that needs monitoring; the article does not quantify that availability or a complete operating bill.
Why it matters
AISubHub analysis: a shared endpoint can simplify connection management while preserving different authority for people and agents. The useful acceptance test is whether each identity can discover and invoke only its intended tools, including denied and just-in-time production paths.
Limits and availability
We read the complete AWS–Eon account, including author roles, but did not deploy the system or reproduce its results. The figures are customer-reported; the article establishes no universal incident-resolution speed, security guarantee, free service or AI-subscription entitlement.
Sources and evidence
Source published: · Source checked:
AI-assisted editorial articles checked against linked primary sources. Vendor claims are attributed; inclusion is not endorsement.