Executive summary
AWS has moved Amazon Bedrock AgentCore from preview to general availability (GA). AgentCore is a modular, managed platform for building, running, and operating enterprise AI agents with first-class support for VPC isolation, AWS PrivateLink, CloudFormation/IaC, tagging, identity, memory, observability, a Code Interpreter, a headless Browser runtime, and a Gateway that converts your internal/external APIs into MCP-compatible tools. It works with any agent framework and any model (inside or outside Bedrock), making it unusually flexible for multi-vendor strategies. Amazon Web Services, Inc.+1
1) What AgentCore actually provides
Core services (modular; use à la carte)
- AgentCore Runtime — Serverless, secure execution environment designed for long-running, multi-step agent tasks with built-in observability and isolation. Now supports VPC and PrivateLink for private connectivity. CloudFormation and resource tagging enable IaC and cost governance. Amazon Web Services, Inc.+1
- AgentCore Gateway — Turns OpenAPI/Smithy specs and AWS Lambda into agent-ready tools. It handles auth, routing, and protocol translation and exposes tools via MCP (Model Context Protocol) so agents discover and call them with minimal glue code. Amazon Web Services, Inc.+1
- AgentCore Browser & Code Interpreter — Managed “tools” for web automation (browser runtime) and safe code execution (JS/Python), now VPC-aware. Amazon Web Services, Inc.
- AgentCore Identity — Authentication/authorization primitives so agents can act on behalf of users/services with auditable permissions. Constellation Research Inc.
- Agent Memory — First-party memory to persist/recall context across sessions (design intent documented across the launch materials). Amazon Web Services, Inc.
- Observability — Built-in dashboards/metrics and new Generative AI observability features in CloudWatch to trace agent steps, tool calls, costs, and errors. Constellation Research Inc.+1
- Open-source MCP Server — AWS-maintained MCP server streamlines building MCP tools and integrating IDEs/agents with AgentCore. Amazon Web Services, Inc.+1
Why this matters: In practice, AgentCore removes the boilerplate you’d otherwise build (networking, identity, tool discovery, memory, tracing), shrinking the gap between a notebook prototype and a production agent with least-privilege access, private networking, and full auditability. Amazon Web Services, Inc.
2) What “GA” changes
- Enterprise-grade networking & automation: VPC + PrivateLink are now available across AgentCore services, with CloudFormation and tagging for policy, cost allocation, and drift control. Amazon Web Services, Inc.+1
- Easier tool integration at scale: Gateway is production-ready; doc examples show creating Interface VPC endpoints to expose Gateway privately across accounts. Amazon Web Services, Inc.+1
- Ecosystem readiness: Open-source MCP server landed days before GA to accelerate integration and migration from popular agent stacks. Amazon Web Services, Inc.
3) Architecture patterns (reference)
A. Private, multi-account agent fabric (typical enterprise)
- Per domain account hosts APIs/Lambdas and data stores (RDS, DynamoDB, S3).
- Agent account hosts AgentCore Runtime, Gateway, Identity.
- Connectivity via AWS PrivateLink (Interface VPC Endpoints for Gateway) and VPC peering/Transit Gateway for data access.
- Observability centralizes traces/metrics in CloudWatch with cost tags per agent/team. Amazon Web Services, Inc.+1
B. Tooling via Gateway + MCP
- Publish OpenAPI/Smithy specs of internal services to Gateway, which auto-generates MCP tools.
- Agents (in Runtime or external) discover/call tools with MCP—no custom SDK glue per API. Amazon Web Services, Inc.+1
C. Human-in-the-loop (HITL) & compliance
- Use Identity + Runtime session isolation for approvals, rate limits, and policy checks; emit step-level logs to CloudWatch for review. Amazon Web Services, Inc.+1
4) Comparison: AgentCore vs. alternatives
| Capability | AgentCore (AWS) | Azure + AI Foundry/Agents | Google Vertex AI Agents | Build-Your-Own (K8s + LangGraph) |
|---|---|---|---|---|
| Network isolation | VPC + PrivateLink (GA) | VNet + Private Link (mature) | VPC-SC & PSC | Custom (Istio/Cilium/etc.) |
| Tooling adapter | Gateway → MCP tools | Functions/Skills; no MCP focus | Tools via Extensions; no MCP focus | You build adapters |
| Identity | AgentCore Identity | Entra ID + managed identities | IAM + service accounts | You stitch OIDC/JWT |
| Observability | CloudWatch GenAI obs (GA) | App Insights + OpenTelemetry | Cloud Logging + APM | You assemble |
| OSS protocol | MCP server (open-source) | None official | None official | You pick/build |
| Portability | Works w/ any model & framework | Strong Azure bias | Strong GCP bias | Highest (but highest ops burden) |
(Cells are based on public service descriptions; exact feature parity varies.)
Takeaway: If you want tight AWS security primitives + protocol-level tooling (MCP) without hand-building the plumbing, AgentCore is unusually comprehensive. Amazon Web Services, Inc.+1
5) Security & governance checklist (GA-ready)
- Network:
- Place Runtime/Browser/Interpreter in VPC-only mode; expose Gateway via Interface VPC Endpoints. Amazon Web Services, Inc.+1
- Identity:
- Use AgentCore Identity to mint scoped credentials per agent/task; enforce least privilege IAM to downstream services. Constellation Research Inc.
- Data:
- Encrypt at rest (SSE-KMS) for S3/DynamoDB; use S3 Vectors if you manage embeddings inside AWS. TechRadar
- Observability:
- Enable CloudWatch GenAI Observability; tag everything (
Project,Team,PII) for cost and policy guardrails. Amazon Web Services, Inc.
- Enable CloudWatch GenAI Observability; tag everything (
- Change control:
- Provision with CloudFormation; use StackSets for multi-account rollout; enforce tag policies. Amazon Web Services, Inc.
6) Migration path from existing agents
Starting point: You have agents in notebooks/LangGraph/CrewAI that call a sprawl of APIs.
Plan (2–4 weeks for a first production slice):
- Inventory tools → pick 3–5 highest-value APIs; publish specs to Gateway; verify MCP discovery. Amazon Web Services, Inc.
- Refactor orchestration → keep your existing framework but wrap the entrypoint in AgentCore Runtime (small SDK shim). Amazon Web Services, Inc.
- Harden identity → swap static keys for AgentCore Identity + per-tool IAM roles. Constellation Research Inc.
- Turn on observability → emit step/tool call spans to CloudWatch; add cost/latency SLOs. Amazon Web Services, Inc.
- Network it → move to VPC + PrivateLink, cut public egress, and approve allow-lists for external calls via egress VPC. Amazon Web Services, Inc.+1
7) Cost model (order-of-magnitude)
- Compute: Runtime/Browser/Interpreter are metered serverless services (duration + requests).
- Networking: PrivateLink ENIs + data processing.
- Observability: CloudWatch logs/metrics/traces (GB ingested + retention).
- Data: API calls, storage (S3, DynamoDB), vector storage if used.
The governance unlock (CloudFormation + tagging) makes it feasible to assign costs per agent/team and to implement budget alarms at the “agent” granularity from day one. (Pricing pages vary by region; validate before rollout.) Amazon Web Services, Inc.
8) Risks & mitigations
- Tool sprawl & unsafe actions → Centralize through Gateway, enforce allow-listed tools, require HITL for high-impact actions. Amazon Web Services, Inc.
- Data leakage → VPC-only deployments; redact logs; use scoped identities with short TTLs. Amazon Web Services, Inc.+1
- Observability gaps → Adopt CloudWatch GenAI dashboards; define SLOs (latency, success rate, cost/run). Amazon Web Services, Inc.
- Vendor lock-in → Keep orchestration in a framework like LangGraph; rely on MCP tools (portable spec) to limit tie-in. AWS Documentation
9) Concrete use cases mapped to AgentCore
- Customer-service agents that read order data, initiate refunds, and draft emails:
- Tools: Order API, Payments API exposed via Gateway; Identity per customer service rep; HITL for refunds. Amazon Web Services, Inc.
- Content & SEO ops (Thorsten’s network):
- Browser runtime for SERP analysis, Interpreter for programmatic briefs, Memory for site-specific style; Gateway to access internal keyword db. Amazon Web Services, Inc.
- Data hygiene agents across accounts:
- Runtime jobs scheduled via EventBridge; tools for S3/Dynamo cleanups; observability for audit. Amazon Web Services, Inc.
- Finance ops copilots:
- PrivateLink to ERP; Identity for scoped write actions; CloudWatch alarms on anomalous tool sequences. Amazon Web Services, Inc.
10) Minimal “Day-0 to Day-30” rollout plan
Day 0–5 — Foundations
- Create Agent account; deploy VPC, subnets, security groups; enable CloudWatch GenAI Observability.
- Stand up Gateway (private) + Interface VPC Endpoints. Amazon Web Services, Inc.+1
Day 6–15 — First agent slice
- Publish 3–5 tools to Gateway (OpenAPI/Lambda).
- Wrap your existing agent in AgentCore Runtime; use Identity for tool access. Amazon Web Services, Inc.+1
Day 16–30 — Harden & scale
- Move to VPC-only Runtime/Browser/Interpreter; add budgets/alerts by tag.
- Add HITL for risky flows; publish internal runbooks; expand tool catalog via MCP. Amazon Web Services, Inc.+1
11) Strategic context
AWS is explicitly framing agents as a platform shift and is backing it with ecosystem investments (Marketplace curation, S3 Vectors, and Identity primitives). AgentCore’s GA signals that agentic workloads are leaving the lab and entering regulated, audited environments.
