What Amazon Bedrock Agents does
Amazon Bedrock Agents coordinates foundation-model reasoning with action groups, knowledge bases, memory, code interpretation, guardrails, and multi-agent collaboration on AWS.
Amazon Bedrock Agents packages model-led planning and AWS integration into a managed service. Instead of writing every planning loop, a team configures instructions, model access, knowledge, action schemas, Lambda implementations, session behavior, and optional collaboration. The service can decompose a request, choose functions, combine results, and maintain context, while aliases support application integration with a published version. This is useful for AWS-centric support, operations, and business workflows, but a trace of reasoning is not proof that a plan is correct. Action implementations still require ordinary API security, validation, testing, idempotency, monitoring, and accountable ownership.
AWS states that InvokeAgent is not charged separately; the principal charge is for model inference calls the agent makes. Total cost can also include Knowledge Bases embeddings, storage and retrieval, Guardrails text units, code interpretation, Lambda, databases, logs, data transfer, KMS, networking, and other services. On-demand, flex, priority, or provisioned model arrangements vary by model and region. A critical lifecycle note applies in 2026: the original service is now Agents for Amazon Bedrock Classic and will not accept new customers after July 30, 2026, although existing customers can continue. New architectures should compare Amazon Bedrock AgentCore and plan migration rather than create avoidable lock-in.
An agent's execution role can turn malicious retrieved text into a real cloud incident. Limit each action group and Lambda role to exact resources and operations, separate tenants and environments, validate every parameter independently of the model, protect secrets, and filter or label untrusted documents. Guardrails can help with configured content categories but do not replace IAM, prompt-injection defenses, or business authorization. Require a human to approve deletion, money movement, permissions, public communication, or production changes. Inspect traces and CloudTrail without logging secrets, test confused-deputy and indirect-injection scenarios, cap turns and spend, use immutable aliases, monitor downstream effects, and preserve rollback and emergency disable paths.
How Amazon Bedrock Agents works
A builder selects a supported Bedrock foundation model, supplies instructions, and defines action groups using API schemas and typically AWS Lambda functions. Optional Knowledge Bases retrieve enterprise context; memory can carry information across sessions; code interpretation runs generated analysis in an isolated environment; Guardrails can evaluate configured input and output categories. At runtime the model interprets a request, creates an orchestration plan, asks for missing details, retrieves context, and invokes eligible actions until it can answer. Multi-agent collaboration can place specialist agents under a supervisor. Versions and aliases separate drafts from published configurations, and traces expose orchestration steps. IAM roles, resource policies, schemas, Lambda permissions, and downstream services determine the agent's real authority.
Define instructions and orchestration
Select a supported model, write bounded instructions, configure action groups, schemas, knowledge bases, memory, guardrails, collaboration, aliases, timeouts, and explicit completion conditions.
Enforce AWS least privilege
Separate build and runtime roles, restrict Lambda and data access, validate parameters, protect secrets, filter untrusted retrieved instructions, and require approval before irreversible or high-impact API calls.
Inspect traces and failure modes
Test representative and adversarial prompts, citations, tool selection, permissions, injection, code interpretation, multi-agent handoffs, retries, latency, token cost, and actual downstream side effects.
Version, monitor, and migrate
Publish an immutable alias, log invocations and actions, alert on errors, loops, spend, and anomalous access, sample outcomes, preserve rollback, and plan migration because Agents Classic closes to new customers July 30, 2026.
How to set up Amazon Bedrock Agents
Confirm product lifecycle and architecture
Determine eligibility for Agents Classic, evaluate AgentCore for new work, choose regions and models, estimate all connected AWS costs, and assign service and business owners.
Create least-privilege IAM boundaries
Separate build and runtime roles, restrict model, Knowledge Base, Lambda, KMS, logs, and downstream permissions, use private networking where required, and protect secrets.
Define instructions and action groups
Write bounded goals and stop conditions, create narrow OpenAPI or function schemas, validate arguments in Lambda, make retries idempotent, and add approval before consequential calls.
Test orchestration adversarially
Exercise missing data, tool errors, injection in documents and API results, cross-user access, code interpretation, multi-agent handoffs, loops, citations, latency, cost, and side effects.
Publish an alias and monitor
Version the agent, stage application traffic, log safe traces and CloudTrail events, alert on anomalies and spend, sample outcomes, rotate credentials, rehearse rollback, and maintain a migration plan.
Amazon Bedrock Agents FAQs
Is InvokeAgent charged separately?
AWS states that InvokeAgent has no separate fee; model inference and optional Knowledge Bases, Guardrails, Lambda, code, storage, networking, and other AWS services are billed.
What is Agents for Amazon Bedrock Classic?
It is the renamed original Bedrock Agents service launched in 2023. AWS says it stops accepting new customers on July 30, 2026; existing customers may continue.
What should new customers use?
AWS directs customers seeking similar capabilities to evaluate Amazon Bedrock AgentCore. Compare feature, migration, regional, security, operational, and pricing requirements directly.
Do Bedrock Guardrails make actions safe?
No. Guardrails address configured model input and output risks; IAM, validation, injection defenses, human authorization, monitoring, and rollback govern tool execution.
Can agents collaborate with one another?
Yes. Multi-agent collaboration uses a supervisor and specialists, but it can increase tokens, latency, handoff errors, and attack surface, so test against a simpler baseline.
Listing reviewed 2026-07-15. Product details and pricing can change; verify important terms on the provider's website.
Related Developer Tools AI tools
Related AI guides
Reviews
Tell the community what you made, what worked, and what you wish you knew before starting.