Deploy and scale AI agents on AWS Bedrock AgentCore

AWS Bedrock AgentCore is a community expert skill for deploying and managing AI agents at scale on Amazon Bedrock AgentCore, a platform of nine core services. It covers service selection, deployment patterns and integration workflows using the AWS CLI, and is published under the MIT license by the zxkane/aws-skills project. The working method is to identify which service or services the user needs, read that service's README before responding, check the cross-service resources for shared patterns such as credentials, security and registry integration, and verify AWS-specific details with documentation tools. AWS facts should always be verified through MCP documentation tools before answering, preferring the AgentCore-specific docs server (with search and fetch tools) and falling back to general AWS documentation servers.

The nine services are:

• Gateway: converts REST APIs into MCP tools.
• Runtime: deploys and scales agents.
• Memory: manages conversation state.
• Identity: handles credentials and access management.
• Code Interpreter: runs code securely in sandboxes.
• Browser: web automation and scraping.
• Observability: tracing and monitoring.
• Agent Registry: catalogs, discovers and governs agents and tools. It is in Preview and available in us-east-1, us-west-2, eu-west-1, ap-northeast-1 and ap-southeast-2.
• Evaluations: automated agent quality assessment using an LLM as a judge.

Five common workflows are described, each starting with reading the relevant README because the details vary by use case:

1. Deploying a gateway target: upload an OpenAPI schema to S3, create a credential provider and store the API key (API key auth only), create a gateway target linking the schema and credentials, then verify target status and test connectivity. A credential provider is needed only for API key authentication; Lambda targets use IAM roles and MCP servers use OAuth.
2. Managing credentials: use Identity service credential providers for all API keys, link providers to gateway targets by ARN, rotate credentials quarterly through provider updates and monitor usage with CloudWatch metrics. Patterns differ across services, and mistakes cause hard-to-debug authentication failures.
3. Discovering agents and tools: create a registry for the organization's AI resources, register MCP servers, agents, skills and custom resources with descriptive metadata, submit records for approval (auto-approve for development, manual for production), and search approved resources by CLI or MCP endpoint.
4. Evaluating agent quality: instrument the agent with OpenTelemetry (ADOT) for traces, create evaluators (built-in such as Builtin.Helpfulness, or custom), set up online evaluation with a sampling rate and data source, and watch scores in CloudWatch dashboards to investigate low-scoring sessions.
5. Monitoring agents: enable observability, configure CloudWatch dashboards, set alarms for error rates and latency, and use X-Ray for distributed tracing.

Use it when working with any of the platform's nine services (gateway, runtime, memory, identity, code interpreter, browser, observability, registry or evaluations), including agent deployment and MCP integration. It should be used only when the task clearly matches its upstream source and project context. Verify commands, generated code, dependencies, credentials and external service behavior before applying changes, and do not treat examples as a substitute for environment-specific tests, security review, or user approval for destructive or costly actions.

Inputs are the AgentCore service and task, AWS account and region details, and the agent or API to be deployed. Outputs are CLI-based deployment steps, credential and IAM guidance, and configuration for registries, evaluations and monitoring. Deep-dive references cover OAuth integration (a three-layer architecture of inbound JWT, an outbound credential provider and Gateway OAuth, with Cognito configuration and CDK examples), the Runtime container contract and MicroVM session model, CDK deployment with L1 and L2 constructs and multi-Runtime architecture, and the HTTP, MCP, A2A and AG-UI protocol specifications with a selection guide.

Runnable templates cover common patterns: an ARM64 multi-stage Dockerfile for AgentCore Runtime, a FastAPI Runtime with SSE streaming and an MCP client, an MCP server with Streamable HTTP transport, an A2A server with Agent Card discovery, an AG-UI server with the standard event stream, and a CDK custom resource Lambda for the Gateway lifecycle. Cross-service guides cover unified credential management and rotation, registry integration with Gateway, Identity and Runtime, resource-based policies with cross-account access and VPC or IP restrictions, and deploying Strands Agents, OpenClaw and the Claude Agent SDK on AgentCore with S3 Files and session storage.

It works with the AWS CLI (bedrock-agentcore-control commands), Amazon S3, IAM, CloudWatch, X-Ray, OpenTelemetry, Cognito, AWS CDK, Lambda, and the aws-mcp-setup skill for documentation tools.