Compute
Lambda · ECS · EKS · Fargate · EC2
Match functions, containers or virtual machines to the workload and the team that will run it.
Build on AWS
Agents that act on AWS,
with the controls built in.
Amazon Bedrock, AgentCore and the AWS foundation you already run, engineered into agents and applications your team can trust with real work.
- Agent platform
- Amazon Bedrock AgentCore, with Strands Agents or the framework your team already uses.
- Models
- Claude, Amazon Nova and other Bedrock models, chosen by evaluation on your tasks.
- Knowledge
- Bedrock Knowledge Bases on S3 Vectors, or the search and databases you already run.
- First step
- One workflow as a Challenge24 prototype, or a review of an agent you already have.
How we see it
AWS made agents a managed service. The decisions are still yours.
AgentCore now gives an agent a runtime, memory, an identity, a policy engine and continuous evaluation as managed parts. That removes a lot of plumbing.
It does not decide which actions an agent may take, which records it may read, or how your team will know it is doing the job well. We work through those decisions with you and build them into the system, from the first prototype to production on your AWS accounts.
Amazon Bedrock AgentCore
AgentCore, one building block at a time.
AgentCore splits an agent platform into managed parts. Here is what each one does, and how we use it in the systems we build.
Runtime
Runs each agent session in its own isolated environment, including long-running work.
We deploy your agent here instead of building a runtime of your own.
Gateway
Turns APIs and Lambda functions into tools an agent can call, and connects to MCP servers.
We expose only the operations an agent needs, each with a clear contract.
Memory
Keeps short-term context within a session and selected facts across sessions.
We decide what is remembered, for how long and who can see it.
Identity
Gives each agent its own identity and handles access to the tools and systems it calls.
We connect it to IAM and your identity provider, scoped per agent.
Policy
Checks an agent’s intended action against written rules before it runs.
We turn your approval rules into policies, so risky actions wait for a person.
Evaluations
Scores agent quality continuously, against your own test cases and live traffic.
We build the evaluation set from real examples and run it on every release.
Observability
Traces every step: model calls, tool calls, latency and failures.
We wire traces into CloudWatch and the dashboards your team already watches.
Code Interpreter
Runs code an agent writes in a sandbox, for analysis and calculation.
We use it where a calculation must be exact rather than estimated.
Browser
A managed browser for agents that must work with websites that have no API.
We use it sparingly, with clear limits on where it may go.
An illustrative design
A field-service agent, end to end.
A technician asks about a fault. The agent finds the approved procedure, checks the asset record and drafts a work order. A supervisor approves it before anything changes.
- Technician asksAmazon Quick or Teams
- Agent plans the stepsAgentCore Runtime · Strands
- Finds the procedureKnowledge Bases · S3 Vectors
- Checks the assetAgentCore Gateway → asset API
- Action checkedAgentCore Policy · Guardrails
- Supervisor approvesApproval in the workflow
- Traced and scoredObservability · Evaluations
What changed on AWS
The platform moved fast this year.
The releases that change how we design and build on AWS, with a link to each announcement.
- Read the announcement (opens in a new tab)
AgentCore became generally available
Runtime, Gateway, Memory, Identity, Observability, Code Interpreter and Browser arrived as managed building blocks, with VPC and PrivateLink support.
- Read the announcement (opens in a new tab)
S3 Vectors, Nova 2 and frontier agents
Vector storage moved into Amazon S3, a new generation of Nova models launched, and AWS introduced agents for development, security and operations.
- Read the announcement (opens in a new tab)
Policy and Evaluations reached GA
Agent actions can be checked against written policy before they run, and quality can be scored continuously instead of once before launch.
- Read the announcement (opens in a new tab)
A Well-Architected lens for agents
The Agentic AI Lens applies the six Well-Architected pillars to agent design, from security to cost.
- Read the announcement (opens in a new tab)
AWS Transform modernizes continuously
Agents scan repositories for technical debt and open pull requests to fix it, instead of waiting for a migration project.
The AWS AI stack
Six layers. We build across all of them.
Open a layer to see the AWS services involved and the part we take on.
ExperienceWhere people ask, review and approve.
- Amazon Quick
- Slack and Teams
- Your web and mobile apps
- AG-UI
What we build. We put the agent where the work already happens and design how it shows its sources, asks for approval and hands off to a person.
AgentsWhere the plan is made and the steps are run.
- AgentCore Runtime
- AgentCore Memory
- Strands Agents
- A2A
What we build. We define the agent’s job, its tools and its limits, then build it with Strands Agents or your existing framework and run it on AgentCore Runtime.
Tools and actionsWhere the agent touches your systems.
- AgentCore Gateway
- MCP servers
- AWS Lambda
- Code Interpreter
- Browser
What we build. We expose selected APIs and Lambda functions as tools through Gateway, each with a clear contract, a permission and a recovery path.
Knowledge and dataWhere answers come from.
- Bedrock Knowledge Bases
- S3 Vectors
- Bedrock Data Automation
- Aurora
- Redshift
What we build. We prepare documents and records, design permission-aware retrieval and keep sources fresh, so every answer can point to its evidence.
ModelsWhere reasoning happens.
- Claude
- Amazon Nova 2
- Intelligent Prompt Routing
- Prompt caching
- Model distillation
What we build. We compare models on your real tasks, then use routing, caching and distillation to hold quality while controlling cost.
Trust and operationsWhere you keep control.
- AgentCore Identity
- AgentCore Policy
- AgentCore Evaluations
- Bedrock Guardrails
- CloudWatch
What we build. We connect agent identity to IAM, write policies for risky actions, add guardrails and set evaluations that run on every release.
Our services on this platform
From first idea to production on AWS.
How each stage of our work maps to AWS. Start at whichever stage fits where you are.
01Start
Decide what is worth doing.
- Challenge24
A working Bedrock prototype on your own examples, in three business days.
Bedrock · Claude · Knowledge Bases
02Build
Build the system.
- Applied AI and agents
Agents on AgentCore Runtime, with your systems exposed as tools through Gateway.
AgentCore · Strands Agents · MCP
- AI-infused software
The application around the agent, serverless or on containers.
Lambda · ECS · EKS · Aurora
03Strengthen
Make it dependable.
- Enterprise AI Hardening
Identity, policy, guardrails and evaluations added before real users arrive.
AgentCore Identity · Policy · Guardrails
- Legacy Modernization
Mainframe, .NET and Java estates moved without losing their business rules.
AWS Transform · Kiro
04Run
Keep it healthy.
- SRE as a Service
Agents watch production and prepare the evidence. Our engineers decide.
CloudWatch · AgentCore Observability
- AI FinOps
Model spend attributed to teams and workloads, then reduced without losing quality.
Inference profiles · CUR 2.0 · Prompt Routing
- AI Governance and Evaluation
An inventory of agents and models, with evaluations on every release.
AgentCore Evaluations · Agentic AI Lens
05Extend
Add capacity.
- Engineering teams
Engineers who know Bedrock, CDK and Terraform, working inside your team.
CDK · Terraform · Kiro
Claude on AWS
Claude in Amazon Bedrock
Anthropic’s current Claude models, including Claude Opus 5.5 and Claude Sonnet 5.5, are available in Amazon Bedrock. They sit behind the same IAM, networking, logging and Guardrails as the rest of your AWS workload, and AgentCore runs agents built on them.
How we build with ClaudeUnder the agents
The cloud foundation we build on.
Data and analytics
S3 · Aurora · DynamoDB · Redshift · SageMaker Unified Studio
Organize application and analytical data with retention, access and recovery in mind.
Events and integration
EventBridge · SQS · SNS · Kinesis · API Gateway
Connect asynchronous work and streaming data with retries and failure handling.
Networking
VPC · PrivateLink · Transit Gateway
Keep model and agent traffic on private paths and plan service boundaries before systems connect.
Security and identity
IAM · IAM Identity Center · KMS · Secrets Manager
Least-privilege access for people, services and agents, with encryption and secret handling.
Delivery
CDK · CloudFormation · Terraform · GitHub Actions · Kiro
Versioned infrastructure and repeatable releases for the agent and everything around it.
Questions
Common questions.
Should we build on AgentCore or run our own agent runtime?
AgentCore gives you session isolation, memory, identity, policy and observability without running them yourself. A self-managed runtime can make sense when you already operate a container platform and need full control. We compare both against your constraints before building.
Do we have to use Strands Agents?
No. AgentCore runs agents built with Strands Agents, LangGraph, CrewAI and other frameworks. We usually start with Strands for new work on AWS and keep your existing framework when it is serving you well.
Which Bedrock model should we use?
The one that does your task well at a cost you accept. We test Claude, Amazon Nova and other candidates on representative inputs, then use prompt routing, caching or distillation where they help.
How do agents get permission to act in our systems?
Each agent gets its own identity through AgentCore Identity, mapped to IAM and to your identity provider. Tools are exposed through Gateway with narrow permissions, and AgentCore Policy checks risky actions before they run. Anything consequential waits for a person.
How do you handle sensitive data?
We map the data involved, keep traffic on private networking, apply Guardrails and design retention and logging rules with your security team before deployment.
How do you control AI costs on AWS?
We attribute model spend with application inference profiles and cost allocation, then look at model choice, context size, caching and routing. Changes are tested against quality before they ship.
We still use Amazon Q Developer. Should we move?
AWS is replacing Amazon Q Developer with Kiro. We can help plan the move and set up spec-driven workflows in Kiro for your teams.
Can you modernize an application we already run on AWS?
Yes. We assess dependencies, data and operations, use AWS Transform where it fits, and plan an incremental move toward managed services, containers or serverless.
Let’s start with the work you want to improve.
Tell us about your application, your AWS environment, or the idea you want to explore.