Agentic AI FactoryGitHub

Reference

Support envelope

Validated regions, status and the known limitations each project documents, collected in one place for four samples centered on Amazon Bedrock and Amazon Bedrock AgentCore.

The support envelope applies to the exact tested implementation: the reference implementations, regions and configurations each project names. Replacements and other regions require independent validation (root README). The limitation bullets below are quoted from the project files without paraphrase.

1. LearnBuilding an Enterprise Agentic AI Platform

Project page
Workshop: validated regions and status
FactValueSource
Validated regionsAWS-run events: us-west-2. Self-paced: us-west-2 (default), us-east-1, or eu-west-1. Other regions are not supported. The contentspec.yaml deployableRegions list is us-west-2, us-east-1 and eu-west-1. Workshop Studio events provision the account in us-west-2 (content/introduction/getting-started/aws-event.en.md).contentspec.yaml
Default regionus-west-2README.md: Quick start (self-paced)
StatusPublished on AWS Builder Center (Workshop Studio); last published 2026-08-18 Publication state and date come from the Workshop Studio catalog entry, not from the repository, which holds no publish record to quote.Workshop Studio catalog
Versionnot documented The workshop has no version badge, tag or CHANGELOG. contentspec.yaml declares only the Workshop Studio schema version 2.0.none

Known limitations, as documented

2. BuildAgentCore Visual Workflow Platform

Project page
Self-Service: validated regions and status
FactValueSource
Validated regionsOne of seven selected release Regions: us-east-1, us-east-2, us-west-2, eu-central-1, eu-west-1, eu-west-2 or eu-west-3; us-east-1 is the default Every other value of AWS_REGION is refused by deploy.sh, by the CDK app at synth, and by the deploy API. Outside us-east-1 the WAF web ACL is REGIONAL on the Cognito user pool and the CloudFront distribution runs without an edge ACL. eu-central-1 and eu-west-2 run without managed Web Search; eu-west-3 also has no AWS Agent Registry.README.md: Prerequisites
Default regionus-east-1README.md: Quickstart
StatusVersion 0.1.0 released 2026-07-17, with unreleased changes recorded in CHANGELOG.mdCHANGELOG.md
Version0.1.0 plus unreleased changesCHANGELOG.md

Known limitations, as documented

  • WAF outside us-east-1
    The same rule set as a REGIONAL WebACL on the Cognito user pool. The distribution runs without an edge ACL

    Source: README.md: Deploying to another region

  • Seven-Region release envelope
    Production deploys to exactly one of seven selected Regions: us-east-1, us-east-2, us-west-2, eu-central-1, eu-west-1, eu-west-2 or eu-west-3. deploy.sh, the CDK app and the deploy API refuse every other Region, including us-west-1 and every APAC Region. eu-central-1 and eu-west-2 run without managed Web Search; eu-west-3 also has no AWS Agent Registry. Expanding the set requires the Region matrix, feature gates, tests and live certification to change together.

    Source: README.md: Deploying to another region

  • RBAC enforcement can be switched off
    Scope-based RBAC (services/rbac.py) ships enforcing by default (RBAC_ENFORCE=true). RBAC_ENFORCE=false ./scripts/deploy.sh allows every request and logs RBAC advisory (would-deny): ... instead; it exists to size the blast radius of an upgrade, not as a long-term posture.

    Source: RBAC_ROLLOUT.md: The advisory escape hatch

  • Control plane has no VPC egress
    The proxy must be reachable from the deploy Lambda. The control plane has no VPC egress, so a VPC-private LiteLLM cannot be probed and the deploy will fail at step 3 even though a VPC-mode Runtime could reach it at invoke time.

    Source: README.md: As the gateway itself, per agent

3. GovernEnterprise MCP Governance Gateway

Project page
MCP Gateway: validated regions and status
FactValueSource
Validated regionsus-west-2 by default; configurable; no tested-regions list is publishedREADME.md
Default regionus-west-2README.md: Deploy
StatusSample and demonstration stack; not hardened for productionREADME.md: Security notes
Versionnot documented No version badge, tag or CHANGELOG in the project folder.none

Known limitations, as documented

4. ScaleEnterprise Agentic AI Platform Blueprint

Project page
Blueprint: validated regions and status
FactValueSource
Validated regionsValidated in eu-west-1; SCP allow-list us-west-2, us-east-1, eu-west-1 The SCP region allow-list comes from PLATFORM_APPROVED_REGIONS in packages/platform-baselines/src/approved-regions.ts. A different Region is a new validation target, not a configuration-only substitution.README.md: 5. Prerequisites
Default regioneu-west-1README.md: 6.1 One-time setup
StatusVersion 1.0.0 (README badge)README.md
Version1.0.0README.md

Live-validated reference envelope

What Blueprint states it has validated, quoted from its README (source). Anything outside this list is covered by the limitations below.

  • Platform and Workload pipelines through production.
  • AWS Agent Registry record resolution and governance.
  • Generated agents using LiteLLMModel and MCPClient.
  • AgentCore Identity, Runtime, Memory, Inference Gateway, and Tool Gateway.
  • Benign and adversarial Guardrail calls with exact admitted and blocked outcomes.
  • Exact HTTP 429 behavior for an unallocated model.
  • Direct cross-account Runtime denial.
  • Runtime update cancellation, rollback, and re-run while sampled sessions remained available.
  • Evaluation gates for regression, quality, tool success, refusal, latency, and cost.
  • Management queries across linked Platform and Workstream logs and metrics.
  • Gateway application-log and OTEL span correlation after regional propagation.
  • Dependency-ordered teardown and direct zero-residual inventories across all three account roles.

Known limitations, as documented

Security controls for each project are compared on the Security page. Costs and teardown procedures are on Costs and cleanup.