Amazon BedrockAgentCore

AWS lifecycle notice (June 30, 2026) — Amazon Bedrock Agents is now Bedrock Agents Classic, in maintenance for new customers after July 30, 2026. Net-new agent builds should use Bedrock AgentCore. Full matrix: lifecycle roundup.

Definition

Amazon Bedrock AgentCore is AWS’s managed agent runtime and infrastructure layer for production AI agents. It separates agent logic (your code, LangGraph, CrewAI, Strands, or custom frameworks) from agent operations: session-isolated execution, memory, tool gateways, browser automation, sandboxed code interpretation, identity, observability, Managed Harness (GA June 17, 2026), and Payments (GA August 18, 2026 — opt-in microtransactions, not a checkout replacement). AgentCore reached general availability in 2025 and, as of September 2026, is the recommended path for net-new agent builds when a Bedrock prototype needs scaling, audit trails, and compliance-friendly isolation. You still choose underlying foundation models (Claude Sonnet 5, Opus 5.5 with Opus 5 as the prior pin, Haiku 5.5 (Haiku 4.5 remains the prior pin), Fable 5.1 for long-horizon jobs after Covered Model sign-off, Nova 2 Lite, GPT-6 Astra / Sol / Luna with GPT-5.6 as the prior OpenAI pins, Grok 4.6, Llama) for reasoning — AgentCore is not a model.

When to use it

• Production deployment of multi-step agents after local prototyping — need concurrency, session isolation, and managed scaling.
• Framework portability — keep LangGraph/CrewAI/Strands orchestration but offload memory, tools, and traces to AWS-managed primitives.
• Compliance-sensitive agents (HIPAA, SOC 2) requiring auditable tool calls, identity per agent action, and CloudWatch/OpenTelemetry traces.
• Long-running sessions with AgentCore Memory — short-term conversation state and long-term semantic recall without custom vector-plus-summary pipelines. Multi-tenant isolation belongs in Memory FGAC (Cedar via Gateway, August 28, 2026) plus flexible namespace variables, not in agent code.
• Tool-rich agents exposing existing REST APIs, Lambda functions, and AWS services through AgentCore Gateway with auth, Cedar Policy, and customer-configurable rate limits.
• Grounded web answers through Web Answer (generally available 5 November 2026, us-east-1 only, $10 per 1,000 tool calls). It attaches as a Gateway target, is called over MCP with IAM, and returns one cited answer. Domain include lists, deny lists, and publish-date filters scope the search. It is not AgentCore Web Search ($7 per 1,000 queries) and not the Bedrock Responses API Web Search tool.
• Pay-per-use tool calls through AgentCore Payments when the agent must settle APIs, MCP servers, or content inside a session budget — not when the shopper already has a checkout.

When not to use it

• Single-turn Bedrock Converse calls — invoke the model API directly; AgentCore adds latency and cost overhead.
• Read-only RAG Q&A — Bedrock Knowledge Bases alone is simpler.
• Hard sub-second latency SLAs — serverless agent runtime cold starts are measured in seconds; warm pools and design matter.

Tips

• Scope AgentCore Identity IAM roles per tool — never attach broad * policies to the agent execution role.
• Use AgentCore Gateway to wrap legacy APIs with consistent auth, Cedar Policy, customer-configurable rate limits, and CloudTrail logging instead of embedding credentials in agent code.
• Front Memory with Gateway OAuth + Cedar FGAC for per-user or per-tenant isolation. Batch Memory APIs are not covered by FGAC.
• Set a TTL on long-term memory records (recordExpirySpecification, minimum 31 days, since October 13, 2026). Records never expire by default.
• Enable Observability and Evaluations early — traces tell you what happened; batch/online evals (GA June 2026) tell you whether it was good.
• Treat Browser and Code Interpreter tools as high-risk — restrict to trusted prompts and sandbox networks.
• Keep business logic in your framework; use AgentCore for cross-cutting runtime concerns only.

Gotchas

Serious

• Over-privileged agent roles — a compromised agent with wide IAM access becomes an automated lateral movement tool.
• Skipping human approval on write tools — agents that mutate production data need confirmation steps or policy gates.
• Treating Payments GA as checkout — AgentCore Payments settles agent-to-API microtransactions with a session budget. Card capture, refunds, and unbounded purchase stay on your existing processor.

Regular

• Building custom memory on DynamoDB when AgentCore Memory fits — reinvents summarization, recall ranking, and retention policies.
• Confusing AgentCore with Bedrock Agents Classic — Agents Classic (maintenance for new customers July 30, 2026) is the November 2023 orchestration model; AgentCore is the managed runtime for net-new custom agent builds.
• Mixing the three web rates — Bedrock Responses API Web Search, AgentCore Web Search ($7 per 1,000 queries), and AgentCore Web Answer ($10 per 1,000 calls, us-east-1 only as of 5 November 2026) are different meters.
• Ignoring cold start in UX — first message in a session may lag; set user expectations or keep sessions warm where cost allows.

Official references

• What is Amazon Bedrock AgentCore?
• AgentCore Runtime
• AgentCore Memory
• Fine-grained access control for Memory
• AgentCore Gateway
• AgentCore Payments

Related FactualMinds content

• Amazon Bedrock Consulting
• Generative AI on AWS
• Amazon Bedrock