Thanks — I’m responding to your question about migrating the LiveKit Server and SIP Server to LiveKit Cloud while keeping a self‑hosted LiveKit Agent and whether that Agent can connect to your AgentCore in an AWS VPC.
Short answer: Yes — that setup can work. LiveKit Cloud does not prevent your self‑hosted Agent from making outbound connections into your VPC. The Agent maintains outbound-only registration to LiveKit Cloud and can initiate connections to services inside your network.
What you need to check / configure:
• Ensure the self‑hosted Agent has network reachability to the AWS VPC (via public endpoints, VPC peering, Transit Gateway, AWS PrivateLink, VPN, etc.).
• Allow inbound traffic on the AgentCore ports in the VPC (security groups, NACLs, and any firewalls) from the Agent’s IPs/subnets.
• If you use public endpoints for AgentCore, ensure TLS and IP restrictions are configured as needed.
• The Agent’s connection to LiveKit Cloud is outbound-only, so you don’t need to open inbound ports on the Agent for the Cloud registration.
If you want, tell me:
• How the Agent currently connects to your VPC (public IP, VPN, peering, PrivateLink), and
• Whether AgentCore is exposed via private IPs only or also a public endpoint.
With that I can suggest specific networking steps or ports to verify.
Sources:
Self-hosted deployments | LiveKit Documentation |
Introduction | LiveKit Documentation |
Security Overview | LiveKit, with interactive elements