Secure AI Agents on Amazon EKS

Every team is building AI agents. Far fewer can answer the questions that come right after the demo: What is the agent allowed to do? Who did it act for? Where does the code it writes actually run, and what can that code reach? This workshop is about closing that gap on Kubernetes, using the same open standards and open-source projects you can take home: an AI gateway in front of LLM models, an MCP gateway for tools, end-to-end tracing, microVMs for sandboxing, and identity-aware authorization at every hop.

What You'll Learn:

• Build agents with an open-source agent SDK and run them as standard Kubernetes workloads
• Route model traffic through an AI gateway, so agents get model access without ever holding credentials
• Run coding agents such as Claude Code as workloads on your cluster
• Trace every prompt, tool call, token, and dollar with observability tooling hosted on EKS
• Give agents tools safely through an MCP gateway instead of direct connections
• Execute untrusted, model-written code in air-gapped microVM sandboxes, vended in seconds from warm pools
• Establish agent identity: propagate the user's identity to every tool call and enforce per-tool authorization at the gateway

By the end, you will know how to take an agent from a promising prototype to a governed, observable, production-ready workload, and you will have a reference architecture built entirely from open source and AWS services you already run.