These mappings describe target-state architecture patterns for scaling agent platforms on AWS. They are not required prerequisites for a first prototype. Start with the services relevant to your immediate use case and expand incrementally.
Platform Powered by Bedrock AgentCore
Builders exploring which AgentCore capabilities apply to their agent design — understanding which platform layer maps to which managed service before committing to an architecture.
Every layer of the agent platform stack maps to managed services in Amazon Bedrock AgentCore and the broader AWS ecosystem. This eliminates undifferentiated heavy lifting and lets platform teams focus on governance, developer experience, and business value.
Labels used throughout this page:
- AgentCore-native - behavior provided directly by an AgentCore service
- Preview - available in public preview; subject to change (AgentCore docs)
- Adjacent AWS - a separate AWS service that integrates with AgentCore
- Customer-built - a pattern you assemble on top of AgentCore capabilities
Platform Layer Mapping
| Platform Layer | AgentCore / AWS Service | What It Provides | Label |
|---|---|---|---|
| AI Gateway | AgentCore Gateway | Unified entry point, MCP tool federation, JWT auth, per-tenant throttling, routing | AgentCore-native |
| Registry & Discovery | AWS Agent Registry + Bedrock Model Catalog | Agent catalog, versioning, capability discovery, model selection | Preview |
| Agent Runtime | AgentCore Runtime | Sandboxed containers, micro-VM isolation, long-running tasks, auto-scaling (how it works) | AgentCore-native |
| Agent Runtime (extended compute) | AgentCore Runtime Instances | AWS-managed EC2 in your account for long-running, GPU-backed, or persistent-disk workloads that exceed micro-VM session limits | AgentCore-native |
| Memory & Context | AgentCore Memory + OpenSearch + S3 Vectors + Knowledge Bases | Short/long-term memory, vector search, RAG, session context | AgentCore-native + Adjacent AWS |
| Observability | AgentCore Observability | OTLP traces, metrics, logs, online evaluation, guardrail events | AgentCore-native |
| AgentOps | AgentCore Evaluations + AgentCore A/B Testing + CI/CD tools | Offline/online evals, quality gates, drift detection; native A/B testing with Gateway-driven weighted traffic splitting (see A/B testing and Agent Ops) | AgentCore-native + Adjacent AWS |
Security & Governance Mapping
| Platform Pillar | AgentCore / AWS Service | What It Provides | Label |
|---|---|---|---|
| Security - Identity | AgentCore Identity + IAM | Agent identity, OAuth/OIDC brokering, token management (identity docs) | AgentCore-native |
| Security - Guardrails | Bedrock Guardrails | Input/output filtering, PII redaction, topic denial, grounded-response enforcement (probabilistic scoring) | Adjacent AWS |
| Security - Policy | AgentCore Policy + Cedar | Fine-grained access control, declarative authorization policies (gateway docs) | AgentCore-native |
| Security - Access | IAM + AWS Organizations SCPs | Role-based access, service control policies, permission boundaries | Adjacent AWS |
| Governance - Registry | AWS Agent Registry | Lifecycle management, approval workflows, version history | Preview |
| Governance - Audit | CloudWatch + CloudTrail | Immutable audit logs, API activity recording, compliance evidence | Adjacent AWS |
| Governance - Compliance | AWS Organizations + SCPs | Organizational guardrails, preventive controls, detective controls | Adjacent AWS |
Platform Ops Mapping
| Platform Capability | AWS Service | What It Provides | Label |
|---|---|---|---|
| Infrastructure-as-Code | AWS CDK / CloudFormation | Reusable constructs for platform deployment | Adjacent AWS |
| Cost Tracking | AWS Cost Explorer + Cost Allocation Tags | Per-agent, per-team cost attribution | Adjacent AWS |
| Multi-Account | AWS Organizations + Control Tower | Account vending, baseline guardrails, centralized governance | Adjacent AWS |
| CI/CD | CodePipeline + CodeBuild + GitHub Actions | Pipeline orchestration for agent deployments | Adjacent AWS |
| Monitoring | CloudWatch Alarms + Dashboards | Operational alerts, SLA tracking, fleet health | Adjacent AWS |
Supported Protocols
AgentCore is protocol-native, supporting open standards for interoperability across frameworks and ecosystems.
- MCP - Tool federation and discovery. Agents connect to MCP servers through the Gateway without managing individual tool integrations.
- A2A - Cross-framework agent collaboration. Agents built with different frameworks communicate via the open A2A protocol.
- AG-UI - Agent User Interface protocol for rich, interactive agent-to-human interfaces with structured UI components and streaming responses.
- x402 / MPP - HTTP-native payment protocols enabling agents to pay for services and APIs autonomously. AgentCore Payments, which implements both protocols for agent-to-agent and agent-to-service transactions, is generally available. A curated set of vetted pay-per-use endpoints is discoverable through the x402 Bazaar MCP Server, accessible via Gateway.
- OTEL - Standardized observability. Traces, metrics, and logs flow via OpenTelemetry to AgentCore Observability and CloudWatch.
Supported Frameworks
AgentCore Runtime is framework-agnostic. Bring your preferred orchestration framework - the platform handles infrastructure, security, and operations.
Strands Agents SDK
AWS-native agent framework with first-class AgentCore integration. Built for production-grade agents with minimal boilerplate.
Native IntegrationLangGraph
Graph-based orchestration from LangChain. Supports stateful, multi-step agent workflows with conditional branching.
SupportedLlamaIndex
Data-centric agent framework optimized for RAG workflows and knowledge-intensive applications.
SupportedCrewAI
Multi-agent collaboration framework with role-based agents and task delegation patterns.
SupportedOpenAI Agents SDK
OpenAI's agent framework for building tool-using agents with built-in handoff and guardrail patterns.
SupportedClaude Agent SDK
Anthropic's SDK for building Claude-powered agents with native tool use and extended thinking.
SupportedStrands Agents SDK offers the deepest AgentCore integration with zero-config deployment to AgentCore Runtime. Other frameworks require a container image but benefit from the same platform services (Gateway, Memory, Observability, Identity). See Use any agent framework for integration guides and code examples for each supported framework.
Further Reading
- AgentCore Runtime — How It Works — sandboxed containers, versioning, and scaling
- AgentCore Identity — OAuth/OIDC brokering and workload identity
- AgentCore Memory — short and long-term memory, session context
- AgentCore Gateway — MCP tool federation, JWT auth, per-tenant throttling
- A/B Testing Overview — native Gateway-driven weighted traffic splitting