@deployfoundation/foundation-deploy 0.2.28 → 0.2.29

package/dist/bin/app.js

@@ -8,7 +8,7 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-fmg6awrp.js";
+} from "../chunk-vmjptheh.js";
 import {
   adminsFor,
   instanceNames,

package/dist/{chunk-fmg6awrp.js → chunk-vmjptheh.js}

@@ -2342,6 +2342,11 @@ class FoundationNetwork extends cdk5.Stack {
         "bedrock-agentcore",
         new ec2.InterfaceVpcEndpointService(`com.amazonaws.${this.region}.bedrock-agentcore`, 443)
       ],
+      [
+        "BedrockAgentCoreGatewayEndpoint",
+        "bedrock-agentcore-gateway",
+        new ec2.InterfaceVpcEndpointService(`com.amazonaws.${this.region}.bedrock-agentcore.gateway`, 443)
+      ],
       [
         "SecretsManagerEndpoint",
         "secretsmanager",

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-fmg6awrp.js";
+} from "../chunk-vmjptheh.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.28",
+  "version": "0.2.29",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/stacks/network-stack.ts

@@ -268,6 +268,19 @@ export class FoundationNetwork extends cdk.Stack {
         "bedrock-agentcore",
         new ec2.InterfaceVpcEndpointService(`com.amazonaws.${this.region}.bedrock-agentcore`, 443),
       ],
+      // The bedrock-agentcore endpoint's private DNS answers for the whole
+      // bedrock-agentcore.<region>.amazonaws.com namespace inside the VPC,
+      // but holds no records for `*.gateway.…`, so every gateway host (the
+      // web-search tool's MCP gateway) failed with ENOTFOUND from the agent.
+      // AgentCore Gateway has its own endpoint service for exactly that name.
+      [
+        "BedrockAgentCoreGatewayEndpoint",
+        "bedrock-agentcore-gateway",
+        new ec2.InterfaceVpcEndpointService(
+          `com.amazonaws.${this.region}.bedrock-agentcore.gateway`,
+          443,
+        ),
+      ],
       [
         "SecretsManagerEndpoint",
         "secretsmanager",