Deploy an AWS Bedrock AgentCore Agent: 12 Steps [2026]

Amazon rebuilt the plumbing under its agent platform twice in the past six weeks. On September 18, 2026, AWS pushed the next-generation AgentCore Runtime to general availability, swapping in a faster microVM boot path. Three weeks later, AgentCore Evaluations followed it out the door with 13 built-in graders for checking whether an agent actually did what it was told. If you tried AgentCore in the spring and walked away confused about quotas, pricing, or which framework to pick, the service underneath you has changed enough to be worth a second look.

Every step uses the actual commands and file formats AWS ships today, not a simplified stand-in. By the end you will have a working agent running on AWS infrastructure, not just a local script that happens to call a model.

Why Agent Infrastructure Suddenly Matters

Six months ago, deploying an agent to production meant stitching together Lambda, Step Functions, a vector database, and a homegrown logging layer, then hoping none of those pieces drifted out of sync with each other. That do-it-yourself approach is still common, but it’s losing ground fast to managed runtimes built specifically for agent workloads instead of generic compute.

McKinsey survey data puts the shift in context. Sixty-two percent of surveyed organizations report that they are at least experimenting with AI agents, while 39 percent say they’ve started experimenting but haven’t moved to production. Only 23 percent report scaling an agentic system in at least one business function, and no more than 10 percent report scaling agents in any single function specifically. That gap between experimentation and scaling is exactly where managed infrastructure like AgentCore is trying to insert itself: teams that already proved an agent works in a demo need a faster path to a hardened, monitored, quota-managed production deployment than hand-rolled infrastructure can offer.

That’s also why AWS, Microsoft, and Google all shipped competing agent-runtime products within months of each other. None of them are first to the idea of “run an LLM-driven agent on managed cloud infrastructure.” What’s new is the amount of plumbing each vendor now handles for you: session isolation, tool-call authentication, context persistence, and automated quality grading, all as managed services instead of application code you write and maintain yourself.

What AWS Bedrock AgentCore Actually Is

AgentCore is not one product. AWS built it as seven separable services that you can mix and match: Runtime, Gateway, Identity, Memory, Observability, Browser, and Code Interpreter. You can adopt Runtime alone to host an agent’s compute and skip everything else, or you can lean on all seven if you’re building something that needs tool access, persistent memory, and audit trails from day one.

Runtime is the compute layer. It launches your agent code inside an isolated microVM per session, so one user’s conversation never shares memory or state with another’s. The next-generation Runtime that went GA in September replaced the original launch-time architecture with a faster microVM boot sequence, cutting cold-start latency for sessions that spin up and tear down quickly.

Gateway turns existing APIs, Lambda functions, and OpenAPI specs into Model Context Protocol (MCP) tools an agent can call without custom glue code. Memory handles both short-term conversational context and longer-term facts the agent should retain across sessions. Identity manages OAuth-based authentication for both the agent itself and the tools it reaches out to. Observability streams OpenTelemetry traces and metrics so you can watch token usage, latency, and tool calls in near real time. Browser and Code Interpreter give the agent a sandboxed headless browser and a sandboxed code execution environment, respectively, for tasks that need either.

AWS designed Runtime to be framework-agnostic. It officially supports CrewAI, LangGraph, LlamaIndex, Google’s Agent Development Kit, the OpenAI Agents SDK, the Claude Agents SDK, and AWS’s own Strands Agents SDK, plus custom frameworks that don’t fit any of those labels. Model access runs through Amazon Nova, Anthropic Claude, OpenAI, and Google Gemini. Two protocols matter here: MCP for tool connectivity and the Agent-to-Agent (A2A) protocol for letting independently built agents talk to each other.

Demand for this kind of infrastructure is not hypothetical. McKinsey research found that more than 78 percent of companies report using generative AI in at least one business function, a figure that explains why AWS, Microsoft, and Google are all racing to ship managed agent runtimes rather than leaving every team to hand-roll its own deployment pipeline on raw EC2 or Lambda. You can read the full McKinsey agentic AI research here.

Prerequisites: What You Need Before You Start

Get these in place before touching the deploy commands. Skipping any one of them is the fastest way to burn an afternoon on an error message that has nothing to do with your actual agent code.

• An AWS account with billing enabled and permission to create IAM roles
• AWS CLI version 2.15 or later, configured with credentials (aws configure)
• Python 3.10 or later (3.12 recommended, matches the default container base image)
• Docker or a compatible container runtime, for building the Runtime image
• The bedrock-agentcore-starter-toolkit and strands-agents Python packages
• boto3 version 1.35 or later, since older releases predate the AgentCore control-plane API calls
• Model access enabled in the Amazon Bedrock console for at least one foundation model (Amazon Nova Pro is a reasonable default for testing)
• An account in one of the nine regions where AgentCore is generally available: US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Frankfurt), Europe (Ireland), Asia Pacific (Mumbai), Asia Pacific (Singapore), Asia Pacific (Sydney), or Asia Pacific (Tokyo)

Budget about 90 minutes for the full walkthrough on a first attempt, including the time Docker spends building the container image and AWS spends provisioning the Runtime endpoint.

Step 1: Set Up Your AWS Account and IAM Permissions

Create an IAM user or role with permissions for bedrock-agentcore:*, bedrock:InvokeModel, ecr:* for pushing container images, and iam:CreateRole if you plan to let the CLI provision the execution role for you. Avoid attaching AdministratorAccess out of convenience. Scope the policy to the actions above plus CloudWatch Logs write access, since Runtime streams logs there by default.

Confirm your CLI identity before moving on:

aws sts get-caller-identity
aws configure set region us-east-1

If that command fails or returns the wrong account, fix it now. Every later step assumes the CLI is already pointed at the right account and region.

Step 2: Install the AWS CLI, boto3, and the Strands Agents SDK

Create a clean virtual environment and install the toolkit AWS maintains for AgentCore deployments. The starter toolkit bundles the agentcore CLI, which handles the configure-and-launch workflow without you hand-writing CloudFormation.

python3 -m venv .venv
source .venv/bin/activate
pip install --upgrade pip
pip install bedrock-agentcore-starter-toolkit strands-agents boto3 awscli

Verify the CLI installed correctly:

agentcore --version

AWS shipped the AgentCore CLI’s general-availability release at version 0.4.0. If you installed the toolkit months ago, reinstall it now. Earlier beta versions used different flag names for configure and will fail silently against the current control-plane API.

Step 3: Write Your First Strands Agent

Strands is the agent framework AWS built and open-sourced, and it’s the path of least resistance for a first AgentCore deployment because the entrypoint decorator maps directly onto how Runtime expects to invoke your code. Create agent.py:

from bedrock_agentcore.runtime import BedrockAgentCoreApp
from strands import Agent
from strands.models import BedrockModel

app = BedrockAgentCoreApp()

model = BedrockModel(model_id="amazon.nova-pro-v1:0")
agent = Agent(
    model=model,
    system_prompt="You are a concise research assistant. Answer in two sentences or fewer."
)

@app.entrypoint
def invoke(payload):
    prompt = payload.get("prompt", "")
    result = agent(prompt)
    return {"response": str(result)}

if __name__ == "__main__":
    app.run()

The @app.entrypoint decorator is what Runtime calls on every invocation. Everything above it, the model binding and system prompt, runs once at container startup and gets reused across requests inside the same session, which keeps per-request latency down.

Step 4: Test the Agent Locally Before Deployment

Never deploy an agent you haven’t run once on your own machine. The starter toolkit can run the exact same entrypoint locally, hitting Bedrock over your existing AWS credentials without touching Runtime at all.

agentcore configure --entrypoint agent.py --name research-agent --local
agentcore launch --local

Send it a test prompt in a second terminal:

curl -X POST http://localhost:8080/invocations \
  -H "Content-Type: application/json" \
  -d '{"prompt": "What changed in AWS Bedrock AgentCore this quarter?"}'

A healthy local run returns something like this within a few seconds:

{
  "response": "AgentCore shipped a next-gen Runtime with faster microVM
  boot times and a dedicated Evaluations service with 13 built-in
  graders for checking agent output quality."
}

If the request hangs instead of returning that kind of payload, check that Bedrock model access is actually enabled for Amazon Nova Pro in your account’s console, not just requested. A request stuck in a pending state for more than 15 to 20 seconds on a simple prompt almost always traces back to a model-access approval that never finished processing.

Step 5: Containerize the Agent for AgentCore Runtime

Runtime supports two deployment paths: a direct code upload for simple agents, or a container image for anything with system dependencies. Containers give you more control, so build one here. Create a requirements.txt listing bedrock-agentcore, strands-agents, and boto3, then write the Dockerfile:

FROM public.ecr.aws/docker/library/python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY agent.py .
EXPOSE 8080
CMD ["python", "agent.py"]

Keep the final image under AWS’s 2 GB ceiling for Runtime containers. A slim Python base plus a handful of agent dependencies rarely gets close to that limit, but it adds up fast if you pull in a full data science stack by accident. Build and confirm the size before pushing:

docker build -t research-agent:latest .
docker images research-agent --format "{{.Size}}"

Step 6: Create the AgentCore Execution Role

Runtime assumes an IAM role to call Bedrock, write logs, and emit traces on the agent’s behalf. If you’re not letting the CLI create this automatically, define the trust policy yourself:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Service": "bedrock-agentcore.amazonaws.com" },
      "Action": "sts:AssumeRole"
    }
  ]
}

aws iam create-role \
  --role-name AgentCoreExecutionRole \
  --assume-role-policy-document file://trust-policy.json

aws iam attach-role-policy \
  --role-name AgentCoreExecutionRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonBedrockFullAccess

Swap the broad managed policy for a scoped one once the agent is working. Full Bedrock access is fine for a first deployment and wrong for anything that touches production data.

Step 7: Deploy to AgentCore Runtime

With the role in place, reconfigure the CLI for a real deployment instead of the local test mode, then launch:

agentcore configure \
  --entrypoint agent.py \
  --name research-agent \
  --execution-role AgentCoreExecutionRole

agentcore launch

The CLI builds the container, pushes it to a managed ECR repository, and provisions a Runtime endpoint. This step is the one most likely to surface quota or permission errors, covered in the troubleshooting section below. On a clean account with no prior throttling, launch typically completes in two to four minutes.

Step 8: Invoke Your Deployed Agent

Once launch finishes, grab the agent runtime ARN from the CLI output or from the console, then call it directly through boto3:

import boto3

client = boto3.client("bedrock-agentcore")

response = client.invoke_agent_runtime(
    agentRuntimeArn="arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/research-agent",
    payload=b'{"prompt": "Summarize AgentCore Runtime in one sentence."}'
)

print(response["response"].read().decode("utf-8"))

Expect output similar to this on a cold-started session against the new Runtime:

{"response": "AgentCore Runtime hosts agent code inside isolated,
per-session microVMs so each conversation gets its own compute
boundary instead of sharing state with other callers."}

Each invocation runs inside its own microVM session, isolated from every other caller. That isolation is the entire point of Runtime versus running agents on shared Lambda concurrency, where a noisy neighbor can bleed into another request’s execution context under the wrong conditions. In practice, the first call against a freshly created session takes noticeably longer than a follow-up call on that same still-open session, since the follow-up skips the microVM boot entirely. Measure that gap yourself with a simple timestamp around the boto3 call rather than assuming a fixed number, since it shifts with model choice, payload size, and region.

Step 9: Connect Tools With AgentCore Gateway

An agent that can only talk is a chatbot. Gateway turns your existing APIs into callable MCP tools without writing a translation layer by hand. Define a target pointing at an existing API or Lambda function:

{
  "name": "internal-ticket-lookup",
  "protocol": "MCP",
  "target": {
    "lambdaArn": "arn:aws:lambda:us-east-1:123456789012:function:ticket-lookup"
  },
  "rateLimit": {
    "requestsPerSecond": 10
  }
}

Register it with Gateway through the CLI, then reference the resulting tool name inside your Strands agent’s tool list. Gateway’s built-in rate limits matter here. Setting a cap on requests, tokens, or connection duration per target stops one runaway agent loop from hammering a downstream API into a 429 storm.

Step 10: Add Persistent Context With AgentCore Memory

Memory splits into short-term session context and longer-term facts the agent should carry between conversations. Enable it on your Runtime configuration and the SDK handles the read and write calls automatically inside the agent loop, so you don’t manage a separate database connection yourself.

Pay attention to the billing change here. As of October 2026, Memory charges ingestion, retrieval, and storage as three separate line items instead of one bundled rate. An agent that re-reads the same long-term facts on every turn, instead of caching them in the session’s short-term context, will show up as a retrieval-cost outlier on your bill well before it shows up as a latency problem.

Step 11: Secure Access With AgentCore Identity

Identity manages OAuth tokens for two directions at once: the credentials a user presents to call your agent, and the credentials your agent presents when it reaches out to a third-party tool or API on the user’s behalf. Configure an identity provider through the console or CLI, then reference it in the agent’s Gateway target configuration so outbound tool calls carry a scoped, short-lived token instead of a long-lived static API key.

Skipping Identity and hardcoding a static token into your Gateway target works in a demo. It becomes a liability the moment that agent reaches a real user base, since a leaked static token has no expiry and no per-session scope to limit the blast radius.

Step 12: Turn On Observability and Evaluations

Observability streams OpenTelemetry traces out of Runtime automatically once enabled, no manual instrumentation required inside your agent code. Point the trace exporter at CloudWatch or your existing OpenTelemetry collector, then watch token counts, tool-call latency, and session duration per invocation.

Evaluations reached general availability on October 15, 2026, with 13 built-in evaluators covering response quality, safety, task completion, and tool usage. Run them against a batch of recorded invocations before you ship a prompt change, not just the handful of manual test prompts you happened to try. A prompt tweak that improves one test case can quietly regress tool-selection accuracy on a dozen others, and the built-in evaluators catch that faster than eyeballing transcripts.

Running a Smoke Test Before You Call It Done

Before pointing real traffic at the deployed agent, run a batch of recorded prompts through Evaluations and look at the scored output, not just whether the HTTP call succeeded. A deployment that returns 200 on every request can still be quietly giving wrong answers, calling the wrong tool, or leaking a system prompt into its response.

aws bedrock-agentcore-control start-evaluation-run \
  --agent-runtime-arn YOUR_RUNTIME_ARN \
  --evaluators response_quality,task_completion,tool_usage,safety \
  --dataset-uri s3://your-bucket/test-prompts.jsonl

Check the current AWS CLI reference for the exact evaluation command and flag names in your installed CLI version before running this against production, since Evaluations is a newly GA service and command syntax can still shift between releases. The shape of the response below is representative of what a completed run returns:

{
  "evaluationRunId": "eval-7f2a9c",
  "status": "COMPLETED",
  "results": {
    "response_quality": 0.91,
    "task_completion": 0.88,
    "tool_usage": 0.95,
    "safety": 1.0
  },
  "sampleCount": 25
}

Treat any evaluator that drops below roughly 0.8 as a signal to read the failing transcripts directly rather than tuning the prompt blind. A low tool_usage score, specifically, often points back to a Gateway target misconfiguration rather than anything wrong with the prompt itself, since the agent may be choosing not to call a tool it can’t actually see.

AWS Bedrock AgentCore Components and Status

Component	What it does	Status as of October 2026
Runtime	Serverless microVM compute, isolated per session	Next-gen version GA September 18, 2026
Gateway	Converts APIs and Lambda functions into MCP tools	GA, supports rate limiting per target
Memory	Short-term session context and long-term facts	GA, consumption billing since October 2026
Identity	OAuth token management for agents and tools	GA
Observability	OpenTelemetry traces and metrics	GA
Browser	Managed headless browser sessions	GA
Code Interpreter	Sandboxed code execution for agents	GA
Evaluations	Automated grading across 13 built-in evaluators	GA October 15, 2026
CLI	Command-line configure and launch workflow	GA at version 0.4.0

AWS Bedrock AgentCore Pricing: What It Actually Costs

AWS prices AgentCore on consumption, with no upfront commitment or minimum monthly fee across any of the seven services. Runtime bills on active CPU and memory consumption during the time your code is actually executing, not on pre-allocated capacity sitting idle between requests. That model favors bursty agent workloads over steady always-on ones, since you stop paying the instant a session finishes.

AWS’s own pricing documentation indicated a committed-baseline option for Runtime, offering a discount against on-demand consumption rates, was targeted to launch by October 2026. If your workload runs predictably enough to forecast baseline usage, check whether that option has landed in your account before committing to on-demand pricing indefinitely.

Service	Billing model	What to watch
Runtime	Active CPU and memory consumption, no upfront fee	Committed-baseline discount targeted for October 2026
Memory	Separate charges for ingestion, retrieval, and storage	Changed from bundled pricing in October 2026
Gateway	Usage-based, optional per-target rate limits	Rate limits cap requests, tokens, and connection duration
Identity	Usage-based, included in consumption pricing	No separate minimum reported
Browser / Code Interpreter	Usage-based per session or execution	Sandbox session length drives cost

Common Pitfalls When Deploying to AgentCore

Most first deployments stumble on the same handful of limits. Here’s what trips people up and how to avoid it.

• Environment variable size. Runtime V2 caps environment variables at 1.5 KB for direct code deployments and 2.5 KB for container agents, down from 4 KB under the original V1 runtime. Stuffing a JSON config blob into an env var that worked fine six months ago will now throw a ValidationException.
• Container image size. The 2 GB ceiling on Docker images is easy to blow past if you install a full ML framework for a dependency you only use once. Strip unused packages before building.
• New-session creation throttling. The shared 25 TPS per-account limit on new sessions is far lower than the 1,000 TPS invocation quota. A load test that opens hundreds of fresh sessions per second will hit this ceiling long before it touches the invocation limit.
• Treating Memory like a free cache. Re-fetching long-term memory on every single turn instead of carrying it in short-term session context runs up retrieval charges under the October 2026 consumption-based Memory pricing.
• Skipping Identity for “internal only” tools. A static API key hardcoded into a Gateway target has no expiry. Treat every tool connection as if it will eventually face an external user, because agent scope tends to expand faster than its security review does.
• Ignoring the 2 vCPU / 8 GB per-session ceiling. Browser automation and local dependency-heavy tooling can exceed this without warning until the session starts throttling mid-execution.

Troubleshooting AgentCore Deployment Errors

These are the errors most likely to stop a deployment cold, along with what usually causes them.

• ValidationException on launch. Almost always an oversized environment variable or payload field exceeding the V2 runtime limits. Trim configuration data and move large blobs into Memory or an S3 reference instead.
• AccessDeniedException calling invoke_agent_runtime. The execution role is missing bedrock-agentcore:InvokeAgentRuntime or the caller’s IAM identity lacks permission on the specific agent ARN.
• ThrottlingException during load testing. Check which quota you’re hitting first. New-session creation throttles at 25 TPS per account well before the 1,000 TPS shared invocation ceiling, so spreading load across fewer, longer-lived sessions usually fixes it.
• Agent hangs with no response locally. Confirm model access is actually enabled in the Bedrock console for the model ID in your code, not just requested. Requested-but-not-granted access fails silently in some SDK versions instead of raising a clear error.
• Container build succeeds but launch fails on image size. Run docker images and check against the 2 GB cap before pushing. A multi-stage Dockerfile that discards build-time dependencies in the final layer usually solves this.
• Gateway target returns no tools to the agent. Confirm the target’s MCP protocol configuration matches what the agent framework expects. A target configured for raw Lambda invocation without the MCP wrapper will register but return an empty tool list.
• Evaluations run but scores look inconsistent. Confirm you’re running against a representative batch of recorded invocations rather than a handful of cherry-picked examples. The 13 built-in evaluators are sensitive to sample size for task-completion scoring specifically.
• CLI version mismatch errors. Older beta installs of the starter toolkit use different flag names for agentcore configure. Reinstall to pick up CLI version 0.4.0 or later if commands that used to work now throw unrecognized-argument errors.

AgentCore vs Azure AI Foundry Agent Service vs Vertex AI Agent Builder

AgentCore is not the only managed agent runtime on the market. Microsoft’s Azure AI Foundry Agent Service and Google’s Vertex AI Agent Builder occupy the same general space, each tied tightly to its own cloud’s model catalog and billing system. The practical difference is less about raw capability and more about which cloud already holds your data, your IAM structure, and your existing framework investment.

Feature	AWS Bedrock AgentCore	Azure AI Foundry Agent Service	Google Vertex AI Agent Builder
Compute isolation	Per-session microVMs (Runtime)	Managed agent compute	Managed agent compute
Framework support	Strands, LangGraph, CrewAI, LlamaIndex, Google ADK, OpenAI Agents SDK, Claude Agents SDK, custom	Microsoft-native plus open frameworks	Google-native plus open frameworks
Tool protocol	MCP and A2A	MCP support	MCP support
Pricing model	Consumption-based, per-service billing	Consumption-based	Consumption-based
Model access	Amazon Nova, Anthropic Claude, OpenAI, Google Gemini	Azure OpenAI catalog plus partner models	Google Gemini plus partner models

If your organization is already deep into Bedrock for model access, AgentCore removes an entire layer of custom Lambda-and-Step-Functions glue code you’d otherwise maintain yourself. If you’re starting fresh with no cloud commitment, the framework support list matters more than the brand name, since Strands, LangGraph, and CrewAI all run on more than one of these platforms with minor code changes.

Advanced Tips: Scaling, Multi-Framework Agents, and Cost Control

Once the basic deployment works, a few less obvious moves separate a demo from something that holds up under real traffic.

Watch the gap between the shared account-level invocation quota and the per-agent quota. AWS raised the shared InvokeAgentRuntime ceiling to 1,000 TPS per account and the per-agent ceiling to 200 TPS per agent per account. Running five agents that each need 200 TPS at peak will saturate the shared account quota well before any single agent hits its own cap, so request a quota increase proactively if you’re running more than two or three production agents in one account.

Mixing frameworks inside one account is a legitimate pattern, not a migration half-measure. Since Runtime treats CrewAI, LangGraph, and Strands agents as interchangeable deployment targets, it’s reasonable to run a Strands agent for a latency-sensitive customer-facing path and a LangGraph agent for a batch research pipeline, both on the same Runtime infrastructure and the same Gateway tool registry.

For cost control, lean on Gateway’s per-target rate limits as a cost circuit breaker, not just a reliability feature. Capping requests-per-second on an expensive downstream tool call limits your maximum exposure if an agent gets stuck in a reasoning loop that keeps calling the same tool. Combine that with Evaluations run on a schedule against production traffic samples, since a quality regression that goes undetected for a week tends to cost more in wasted tool calls than the evaluation run itself.

Finally, don’t treat the nine-region GA footprint as fixed. AWS has expanded AgentCore’s region list before and will likely do it again. If your workload has a latency-sensitive regional requirement outside the current nine regions, check the release notes before building a workaround around it.

Security and Audit Considerations Before You Go Live

An agent that can call tools and remember past conversations is also an agent that can leak data if you don’t scope it carefully. Treat the execution role you built in Step 6 as the single most important access boundary in the whole deployment, since every Gateway target, every Memory read, and every Bedrock model call ultimately runs under that role’s permissions.

Three habits catch most of the avoidable problems. First, scope the execution role down from the broad managed policy used in this tutorial to a custom policy listing only the specific Bedrock model ARNs, Gateway targets, and Memory resources the agent actually needs, and revisit that list every time you add a new tool. Second, route every outbound tool call through Identity instead of a static credential, so a compromised agent session can’t be replayed indefinitely with a token that never expires. Third, keep Observability traces flowing to a log store with retention and access controls that match whatever compliance regime your organization already follows for other production services, since an agent’s trace log often contains the same sensitive data that shows up in its conversations.

None of this is unique to AgentCore. The same discipline applies whether you’re running on AWS, Azure AI Foundry Agent Service, or Vertex AI Agent Builder. What AgentCore changes is how much of the enforcement is built into the platform itself, through Identity’s token scoping and Gateway’s rate limits, versus how much you’d otherwise have to bolt on yourself with custom IAM policies and a hand-rolled API gateway.

The Complete Working Project

Here’s the full project laid out as it should sit on disk, combining every piece from the steps above into one deployable unit.

research-agent/
├── agent.py
├── requirements.txt
├── Dockerfile
├── trust-policy.json
└── gateway-target.json

# requirements.txt
bedrock-agentcore
strands-agents
boto3

With those five files in place, the full deployment sequence from a clean checkout is:

# 1. Install dependencies
pip install bedrock-agentcore-starter-toolkit strands-agents boto3

# 2. Create the execution role
aws iam create-role --role-name AgentCoreExecutionRole \
  --assume-role-policy-document file://trust-policy.json
aws iam attach-role-policy --role-name AgentCoreExecutionRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonBedrockFullAccess

# 3. Configure and deploy
agentcore configure --entrypoint agent.py --name research-agent \
  --execution-role AgentCoreExecutionRole
agentcore launch

# 4. Invoke the deployed agent
aws bedrock-agentcore invoke-agent-runtime \
  --agent-runtime-arn YOUR_RUNTIME_ARN \
  --payload '{"prompt": "What is AgentCore Gateway used for?"}'

That four-step sequence is the minimum path from an empty directory to a live agent endpoint. Everything else in this tutorial, Gateway tools, Memory, Identity, Observability, layers on top of this same base without changing the core deployment flow. The full announcement behind the Runtime GA that makes this possible is in AWS’s September 2026 release notes.

Frequently Asked Questions

What is AWS Bedrock AgentCore?

AgentCore is a set of seven separable AWS services, Runtime, Gateway, Identity, Memory, Observability, Browser, and Code Interpreter, that together handle hosting, tool access, authentication, context, monitoring, and sandboxing for AI agents. You can adopt one service or all seven depending on what your agent needs.

Is AgentCore the same thing as Amazon Bedrock?

No. Amazon Bedrock is AWS’s managed access point for foundation models like Amazon Nova and Anthropic Claude. AgentCore sits on top of Bedrock, providing the infrastructure to deploy, run, and manage agents that call those models, rather than providing model access itself.

Which agent frameworks does AgentCore support?

AWS lists official support for CrewAI, LangGraph, LlamaIndex, Google’s Agent Development Kit, the OpenAI Agents SDK, the Claude Agents SDK, and AWS’s own Strands Agents SDK, plus custom frameworks that implement the Runtime entrypoint pattern.

How much does AWS Bedrock AgentCore cost?

AgentCore uses consumption-based pricing across all seven services with no upfront commitment. Runtime bills on active CPU and memory usage during execution. Memory separately bills ingestion, retrieval, and storage as of an October 2026 pricing update. AWS has not published flat per-second dollar rates publicly at the time of writing, so check AWS’s own AgentCore pricing page for your region’s current rates before estimating a production budget.

What is the maximum compute allocation per agent session?

Runtime caps each session at 2 vCPUs and 8 GB of RAM. Workloads involving Browser automation or heavy local dependencies can approach this ceiling faster than expected.

Can I deploy a non-Strands agent, like one built with LangGraph or CrewAI, to AgentCore Runtime?

Yes. Runtime is framework-agnostic and officially supports LangGraph and CrewAI alongside Strands. The deployment mechanics, containerizing the code and defining an entrypoint, stay the same regardless of which framework wrote the agent logic.

What happens if I exceed the environment variable size limit?

Runtime V2 throws a ValidationException if environment variables exceed 1.5 KB for direct code deployments or 2.5 KB for container-based agents. Move large configuration blobs into Memory, Parameter Store, or an S3 reference instead of an environment variable.

Does AgentCore work with models outside of Amazon Bedrock, like OpenAI’s models?

AWS lists OpenAI and Google Gemini alongside Amazon Nova and Anthropic Claude as supported model providers for AgentCore, meaning Runtime can host agents that call out to those providers’ APIs even though the compute and orchestration still run on AWS infrastructure.