Amazon Bedrock AgentCore - Amazon Bedrock AgentCore is a set of managed AWS services for deploying, securing, and operating AI agents and their supporting tools.

Deploy agent code and dependencies to AgentCore Runtime rather than managing an agent-serving fleet. Configure workload permissions, authentication, and session handling to match the application's execution requirements.

Store interaction events and use configured strategies to extract longer-term information for subsequent conversations. Use stable actor and session identifiers, and retrieve only the memories relevant to the current request.

Expose supported APIs and Lambda functions as tools through AgentCore Gateway. This provides a consistent tool interface while leaving business validation and resource-level authorization in the underlying implementation.

Use AgentCore Identity to manage agent identities and access to downstream services, including supported OAuth and API-key authentication flows. Keep user authorization distinct from the agent workload's own permissions.

Run browser interactions in managed sessions for tasks that require navigating web applications. Add explicit checks before submitting forms, publishing content, or taking other actions with external effects.

Use Code Interpreter to execute code for calculations, analysis, and file-processing tasks without running generated code inside the agent application's process. Validate inputs and outputs and apply appropriate controls to sensitive files.

Use AgentCore Observability and Amazon CloudWatch to investigate agent execution, model calls, and tool activity. Add application instrumentation and correlation identifiers to connect failures across the agent and its downstream dependencies.

Use AgentCore infrastructure with different agent frameworks and model providers. Model invocation, orchestration logic, and tool-selection policies remain application design choices rather than being prescribed by the runtime.

Deploy an assistant that answers internal questions and invokes approved business tools. Combine Runtime, Gateway, and downstream authorization so actions such as opening a support ticket use narrowly scoped permissions.

Use Memory to retain relevant preferences and conversation context across support sessions. Keep account records in authoritative systems and verify the customer's identity before retrieving or changing account-specific information.

Use Code Interpreter to calculate metrics, transform supplied datasets, or generate analytical outputs. Store source data and results separately from conversation memory, and validate important calculations before using them in business decisions.

Use Browser for workflows involving applications without suitable APIs, such as collecting information from an internal portal. Handle authentication explicitly and require approval before irreversible submissions.

Expose operational APIs through Gateway so an agent can inspect incidents, retrieve diagnostics, and propose remediation. Keep destructive operations behind explicit authorization or human approval, and make retryable actions idempotent.

Budget separately for foundation model inference and services used by the application, such as Lambda, Amazon S3, and CloudWatch. Logging, tracing, data transfer, and external API charges can contribute materially to total workflow cost.

Browser and Code Interpreter are metered separately according to their execution resource usage. Control session duration and terminate sessions when work finishes to avoid unnecessary consumption.

Gateway and Identity have component-specific usage pricing. Estimate tool discovery and invocation traffic, authentication activity, and credential-access patterns, and review any pricing exceptions for use with other AgentCore components.

AgentCore Memory charges depend on the memory operations used, such as storing short-term events and extracting or retrieving long-term memory. Estimate costs from conversation volume, configured extraction strategies, and retrieval frequency.

AgentCore Runtime uses consumption-based pricing for compute resources, including CPU and memory. CPU charging distinguishes active processing from supported waiting periods, while memory consumption depends on allocation and duration; consult current pricing for precise metering rules.

Amazon CloudWatch

AgentCore Observability uses CloudWatch capabilities to help operators inspect agent telemetry. For example, correlate a slow response with model latency, tool execution time, and application errors using emitted traces and logs. Configure instrumentation, retention, alarms, and access controls, and prevent credentials or sensitive conversation content from being logged unnecessarily.

Amazon Cognito

Amazon Cognito can provide OAuth access tokens for JWT-authenticated access to AgentCore endpoints configured with the appropriate issuer and client settings. For example, a signed-in web application can obtain a token and invoke an agent on behalf of its user. Endpoint authentication does not automatically authorize access to every downstream record, so enforce tenant and resource permissions separately.

AWS Lambda

AgentCore Gateway can expose Lambda-backed functionality as MCP tools. For example, a function can validate a customer identifier and retrieve an order status from an internal system. Configure the required invocation permissions and enforce business authorization inside the tool rather than trusting model-generated arguments.

Amazon S3

Agent application code can use Amazon S3 for input documents, datasets, and generated artifacts through AWS SDK calls. For example, an analysis agent can read an approved CSV object and write a report to a separate output prefix. Scope the execution role to the required objects and use controlled download access rather than embedding unrestricted object links in responses.

Agent applications hosted in AgentCore Runtime can invoke foundation models through Amazon Bedrock using AWS SDKs or supported framework integrations. For example, an agent can use a Bedrock model to decide which Gateway tool to call, then summarize the tool's response. Grant the runtime execution role only the required model invocation permissions and account for model inference charges separately.