Amazon Bedrock is a stack, not one agent product. The layer that matters for teams building agents now is AgentCore — production substrate, not a chatbot wizard. Keep your framework; AWS owns isolation, the tool gateway, identity plumbing, and the ops plane.
Agents Classic was the managed, config-driven agent: instructions, action groups, Knowledge Bases, guardrails. AWS owned the loop. As of July 30, 2026 it is closed to new customers. Existing tenants keep running. For similar capabilities, AWS says explore AgentCore.
| Layer | What it is | Who owns the loop |
|---|---|---|
| Bedrock | Models, Knowledge Bases, Guardrails | You, or a product on top |
| Agents Classic | Managed config-driven agents — closed to new customers | AWS |
| AgentCore | Runtime, Gateway, Memory, Identity, Policy, Observability, Evaluations, built-in tools | Your framework; AWS owns the substrate |
Strands is AWS’s code-first harness (harness-sdk). It is not AgentCore. Same for LangGraph or CrewAI: clients of the substrate, not replacements for it. SDK: bedrock-agentcore-sdk-python.
The useful question is not “Bedrock: yes/no.” It is where the loop lives. On AWS, new agent work lives on AgentCore. (Cipher has the same split.)
What you actually buy
Docs: what is AgentCore · samples: amazon-bedrock-agentcore-samples
Runtime — each session is a microVM: CPU, memory, filesystem. Reuse runtimeSessionId to keep state across invocations; when the session ends, the VM is gone. That isolation is the point — Cohere Health used it for multi-tenant health-plan work. It is not durable application logic. Retries, idempotency, and “the tool ran twice” stay yours. (Runtime troubleshooting.)
Gateway — OpenAPI, Smithy, and Lambda become MCP tools; existing MCP servers can sit behind it. Ingress and egress auth are first-class: OAuth in, credential brokering out, so agents are not carrying long-lived third-party secrets in prompts. This is the paved path for an internal agent platform: approve a tool once, many agents use it, you can audit who called what.
Memory — short- and long-term memory as a service. You can front it with Gateway if you need per-user isolation instead of one SigV4 backend that sees everyone’s memory.
Identity — workload identities for agents, IdP integration (Cognito, Okta, Entra, Auth0), credentials meant for automated work, not humans in a console.
Policy — deterministic gates on tool calls (Cedar, or natural-language authoring in the docs). The model does not get to “pinky-promise” a refund. The platform can refuse the call.
Observability and Evaluations — OTEL into CloudWatch, plus trajectory-level evals (sample live traffic, run the same checks in CI). AWS’s own silent-failure write-up is the line: green dashboards and wrong answers coexist. Isolation helps you debug one agent. It does not invent a control plane for fifty.
Code Interpreter and Browser — sandboxed code and browser automation without you standing up Firecracker.
When to use it
Agents Classic is closed to new customers. Existing tenants keep what they have. New work → AgentCore.
Use AgentCore + a framework if you are already on AWS and you want session isolation, a governed MCP tool path, identity/policy as platform concerns, and OTEL/evals next to the runtime — without rebuilding that substrate for every team.
- Strands + AgentCore — least conceptual friction on AWS.
- LangGraph + AgentCore — when you already trust graphs, checkpointing, and HITL; AgentCore hosts and gates.
- Other frameworks work. Image size and cold start are your problem.
Do not pick AgentCore to paper over missing evals, missing tool owners, or no on-call model. The platform will host the mess at scale. Hybrid is normal: Bedrock models + Knowledge Bases + Guardrails under any loop; AgentCore for the fleet; Step Functions (or your own workflow) when the business process must not be improvised. (Agentic AI Lens.)
AgentCore will not write a correct agent for you. It will stop you from rebuilding isolation and tool auth while you still fight tool semantics, session lifetime, IAM, cost shape, and silent wrongness — the same gap every serious agent stack hits.
Primary docs
- What is AgentCore?
- Runtime · Gateway · Memory · Identity · Policy
- Observability · Evaluations
- Agents Classic maintenance mode (closed to new customers)
- Agentic AI Lens · Prescriptive Guidance
- Strands · samples · Python SDK