AWS AgentCore Gateway Policy Only Gates MCP Tools, Leaves resources/read Always Allowed
rahulladumor · reddit · 2026-10-20
A Reddit post reads the AWS docs to show that AgentCore Gateway's Cedar policy engine, even in ENFORCE mode, only evaluates MCP tools (tools/call and filtered tools/list). MCP prompts and resources — prompts/list, prompts/get, resources/list, resources/read, resources/templates/list — are always allowed regardless of policy mode; inbound auth is the only gateway check described for them.
Why it's easy to miss
- The Policy concepts page says policies are evaluated for every tool invocation and maps each tool to an action; resources and prompts have no action, so no rule can target them.
- The MCP server target page says prompts and resources sync automatically when the server advertises them, so adding or re-syncing a target can widen readable data with no policy change.
- Per the MCP spec, resources are URI-addressed data (files, DB schemas); any client with a valid token can send resources/read through the gateway.
Test: with a lowest-privilege token and ENFORCE on, call resources/templates/list then resources/read on a sensitive URI; if content returns, Cedar isn't the protection.
Options: disable resources/prompts on the MCP server if unneeded; authorize inside the server using user-bound outbound credentials rather than shared gateway role credentials; or use a gateway REQUEST interceptor (docs don't confirm it covers resources/read — test it). Non-MCP targets (Lambda, API Gateway, OpenAPI, Smithy) aren't affected. The author notes this is doc-derived, not tested.
More from coding & agent
- OpenAI launches team tasks in ChatGPT to automate recurring engineering updates — OpenAIDevs · 2026-10-20
- Delhi's DevDay Exchange community hackathon set for Nov 1, a full-day Codex build sprint — gabrielchua · 2026-10-20
- Underrated OpenAI DevDay combos: pairing Live API, Decisions API, MCP Events and Codex app server — gabrielchua · 2026-10-20
- Cloudflare teases generative UI stack: rendering 5-10 components in ~1 second — ritakozlov · 2026-10-20
- Ex-OpenAI exec Bob McGrew's Arda exits stealth with $1.5B valuation, cuts Anduril workflow from 30h to 2.5h — pxd · 2026-10-20
- HERA: co-evolving agent harnesses and environments for reliable abstention — UW · 2026-10-20