Building a serverless A2A gateway for agent discovery, routing, and access control

This article describes how to build a serverless Agent-to-Agent (A2A) gateway on AWS that centralizes agent discovery, routing, and access control across distributed AI agents.

• Gateway provides single entry point for agents running on ECS, Lambda, Bedrock, or hybrid environments using path-based routing
• Three-layer architecture: management layer with agent registry and semantic search, control layer with JWT-based access control, execution layer with OAuth authentication and SSE streaming
• Lambda authorizer validates JWTs and generates IAM policies; DynamoDB stores agent registry, permissions, and rate limit counters
• Supports A2A protocol specification with JSON-RPC and HTTP+JSON/REST bindings for agent communication
• Terraform deployment includes Cognito OAuth, Secrets Manager for credentials, and optional private VPC mode for secure infrastructure
• Includes example Weather and Calculator agents; demonstrates agent registration, permission management, and message routing through gateway

The gateway eliminates point-to-point agent connections, centralizes access control, and enables semantic discovery, reducing operational complexity as agent deployments scale.