Skip to content

README: embed the agentcore_gateway model-access diagram #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
odinwang merged 1 commit into from
Oct 1, 2026
Merged

README: embed the agentcore_gateway model-access diagram #47

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,14 +26,16 @@ ways to get there:
with per-session STS credentials (revoked by an IAM Deny on the session
tag); runtime → gateway can stay on PrivateLink and gateway → LiteLLM on a
managed VPC Lattice path, so LiteLLM needs no public endpoint.
[How it works](docs/architecture.md#how-the-agentcore_gateway-backend-reaches-a-private-litellm).
[Walkthrough of every hop](docs/architecture.md#how-the-agentcore_gateway-backend-reaches-a-private-litellm).
- **`llm-edge`** (`litellm`). A platform-side service holds the key and
forwards session-scoped calls; runtimes egress through a NAT Gateway with a
**fixed EIP** you can put on the gateway's source-IP allow-list.

Direct Bedrock access (cross-region inference) is supported as an
alternative.

![agentcore_gateway backend: AgentCore Gateway in front of a private LiteLLM](docs/images/agentcore-gateway-litellm.svg?v=1)

![portal overview](docs/images/portal-overview.png)

<!-- ?v= bumps the URL so GitHub's image cache serves the current diagram
Expand All @@ -47,10 +49,7 @@ that carry the security story: the
traffic) and the
[customer-owned MCP hub chains](docs/images/mcp-hub-chains.svg)
(how production applications and the Dev Workbench reach a self-hosted tool
backend with per-application HMAC signatures and a forwarded user token). A third, the
[agentcore_gateway model path](docs/images/agentcore-gateway-litellm.svg),
shows how a kernel reaches a private LiteLLM through AgentCore Gateway over
PrivateLink and VPC Lattice.
backend with per-application HMAC signatures and a forwarded user token).

## What's inside

Expand Down
Loading