Top 100+ AWS Bedrock AgentCore Interview Questions and Answers for 2026
The definitive interview prep guide for Amazon Bedrock AgentCore — covering architecture, Strands Agents SDK, Runtime, Gateway, Memory, Identity, Guardrails, Knowledge Bases, multi-agent orchestration, observability, and production deployment. Updated for AgentCore GA and Strands Agents 1.x (2026).
- Section 1 — AgentCore Fundamentals & Architecture (Q1–Q15)
- Section 2 — Strands Agents SDK & Agent Creation (Q16-Q28)
- Section 3 — AgentCore Runtime & Deployment (Q29-Q40)
- Section 4 — Gateway & Tool Integration (Q41-Q52)
- Section 5 — Memory Management (Q53-Q65)
- Section 6 — Identity, Security & Guardrails (Q66-Q78)
- Section 7 — Knowledge Bases & RAG (Q79-Q88)
- Section 8 — Multi-Agent Orchestration (Q89-Q98)
- Section 9 — Observability, Evaluation & Production (Q99-Q110)
- Section 10 — Scenario-Based & System Design (Q111-Q115)
- Frequently Asked Questions
- Key Takeaways
Amazon Bedrock AgentCore is AWS’s purpose-built infrastructure layer for deploying and operating AI agents at enterprise scale. Announced at re:Invent 2024 and reaching general availability in 2025–2026, AgentCore replaces the older “Bedrock Agents” (now Bedrock Agents Classic, entering maintenance mode July 30, 2026) with a complete re-architecture: serverless Runtime, managed Gateway, persistent Memory, Cedar-based policy engine, and OpenTelemetry observability — all framework-agnostic and model-agnostic.
Whether you’re interviewing for an AI/ML Solutions Architect, Agentic AI Engineer, or Cloud Platform Lead role, this guide gives you 115+ questions with detailed answers, production-grade code snippets, comparison tables, and system-design scenarios. For complementary coverage, see our LangGraph Interview Questions, Google ADK Interview Questions, and Claude & Anthropic Interview Questions guides.
Section 1 — AgentCore Fundamentals & Architecture (Q1–Q15)
Q1. What is Amazon Bedrock AgentCore and why did AWS build it?
Answer: Amazon Bedrock AgentCore is a fully managed infrastructure layer that sits between foundation models and your application, providing everything needed to deploy, operate, and govern AI agents at scale.
It offers seven managed services — Runtime, Gateway, Memory, Identity, Observability, Evaluations, and Policy.
AWS built it because the original Bedrock Agents service was a monolithic, single-agent system with session-scoped memory and direct API calls. AgentCore re-architects the stack into composable, independently scalable services so teams can run multi-agent systems with persistent memory, centralized tool routing, Cedar-based guardrails, and OpenTelemetry tracing — all without managing infrastructure.
Interview tip: Emphasize the shift from monolithic to composable. AgentCore is seven independently deployable services, not a single product.
Q2. What are the core components of AgentCore?
Answer: AgentCore consists of seven managed services:
1. Runtime — Deploys and auto-scales agent code (serverless, Docker-based). Supports hot reload during development.
2. Gateway — Managed MCP server that converts REST APIs, Lambda, and OpenAPI specs into agent-usable tools with auth pass-through and rate limiting.
3. Memory — Short-term (session events) and long-term (semantic, summary, user-preference) persistent context across sessions.
4. Identity — Inbound JWT validation for callers; outbound OAuth2 three-legged flows for acting on user behalf (Slack, Zoom, Google Workspace).
5. Observability — OpenTelemetry-based distributed tracing for tool calls, LLM invocations, memory ops, and reasoning steps. CloudWatch integration.
6. Evaluations — Automated quality scoring and regression tests — built-in and custom evaluators.
7. Policy — Cedar-based policy engine for guardrails, content filtering, and fine-grained authorization on every tool call.
Q3. How does AgentCore differ from Bedrock Agents Classic?
Answer:
Agent model: Classic supports single agent per app. AgentCore supports multi-agent orchestration.
Memory: Classic has session-scoped only. AgentCore has persistent memory across sessions (short + long-term).
Tool integration: Classic uses direct API calls. AgentCore uses Gateway with protocol translation and auth pass-through.
Evaluation: Classic requires manual testing. AgentCore has a built-in evaluation suite.
Foundation models: Classic supports Bedrock models only. AgentCore supports Bedrock + SageMaker custom models.
Scaling: Classic scales per-agent. AgentCore uses infrastructure-managed auto-scaling (serverless).
Guardrails: Classic uses Bedrock Guardrails (separate service). AgentCore uses Cedar policy engine, inline per-request.
Frameworks: Classic uses AWS-only orchestration. AgentCore supports Strands, LangGraph, CrewAI, LlamaIndex, ADK, OpenAI Agents.
Key fact: Bedrock Agents Classic enters maintenance mode July 30, 2026 — no new customers, no new features. AWS provides an Import-Agent toolkit on GitHub for migration.
Q4. What is the request flow through AgentCore’s architecture?
Answer: A typical request flows through five layers:
Step 1: The user call hits Runtime, which hosts the agent code.
Step 2: Identity validates the JWT and establishes caller context.
Step 3: Memory loads short-term session context and any relevant long-term records.
Step 4: The agent reasons and calls tools via Gateway, which translates protocols, enforces Policy (Cedar guardrails), and routes to Lambda, REST APIs, MCP servers, or Knowledge Bases.
Step 5: Observability traces each step end-to-end.
The response streams back through the same path. Each component is independently deployable — you can use Memory without Gateway, or Gateway without Runtime.
Q5. Which agent frameworks does AgentCore support?
Answer: AgentCore is framework-agnostic. Supported frameworks include:
- Strands Agents (AWS’s open-source SDK)
- LangGraph and LangChain
- CrewAI
- LlamaIndex
- Google ADK
- OpenAI Agents SDK
Your agent code is packaged as a Docker image and deployed to Runtime — any framework that runs in a container works. The AgentCore CLI scaffolds projects for common frameworks out of the box.
Q6. Which foundation models work with AgentCore?
Answer: AgentCore is model-agnostic. It supports:
- Any Amazon Bedrock model (Claude Opus/Sonnet/Haiku, Llama, Mistral, Amazon Nova, Cohere, AI21)
- SageMaker-hosted custom models
- External providers via the Strands SDK — Anthropic API, OpenAI, Ollama (local), and LlamaAPI
The Managed Harness (preview) lets you switch models mid-session without redeploying.
Q7. What is the Managed Harness and how does it simplify agent development?
Answer: The Managed Harness (preview, April 2026) lets you define an agent by specifying just a model, system prompt, and tools — three API calls — with no orchestration code required.
AgentCore handles the agent loop: reasoning, tool selection, action execution, context window management, retries, and response streaming.
Key benefits:
- Configuration can be overridden per invocation without redeploying
- Each session gets its own microVM with filesystem and shell access
- Filesystem persistence (preview) lets agents suspend and resume mid-task
- You can export the harness orchestration as Strands-based code for full control
Q8. What regions support AgentCore?
Answer: As of mid-2026, AgentCore is available in 14+ AWS Regions including US East (N. Virginia), US West (Oregon), Europe (Frankfurt, Ireland, London), Asia Pacific (Tokyo, Sydney, Singapore, Mumbai), and South America (Sao Paulo).
The Managed Harness preview launched in four regions: Oregon, N. Virginia, Frankfurt, and Sydney.
Q9. What is the AgentCore CLI and what commands does it provide?
Answer: The AgentCore CLI is a Node.js-based tool (requires Node.js 20+) for scaffolding, developing, deploying, and managing agents:
npm install -g @aws/agentcore
agentcore create # Scaffold a new agent project
agentcore dev # Run locally with hot reload + inspector UI
agentcore deploy # Deploy to AWS infrastructure (uses CDK)
agentcore invoke # Test a deployed agent
agentcore status # Check deployment status
agentcore add memory # Add Memory capability
agentcore add identity # Add Identity capability
agentcore add evaluator # Add an evaluator
agentcore add gateway # Add Gateway with policy engine
Configuration lives in agentcore/agentcore.json (project settings) and agentcore/aws-targets.json (deployment targets). The CLI uses AWS CDK constructs from @aws/agentcore-cdk to provision resources.
Q10. What interfaces can you use to interact with AgentCore?
Answer: Six interfaces:
1. AgentCore CLI — project scaffolding and deployment
2. AgentCore Python SDK (bedrock-agentcore) — Runtime, Memory, Tools, Identity, Evaluations primitives
3. AgentCore MCP Server — enables deploying agents from MCP clients like Kiro, Cursor, Claude Code, or Amazon Q CLI
4. AWS SDK (boto3) — control plane and data plane operations
5. AgentCore Console — web UI for creating services and testing agents in the sandbox
6. AWS CLI — command-line access to both control and data plane APIs
Q11. What is the AgentCore MCP Server?
Answer: The AgentCore MCP Server exposes agent lifecycle management (create, deploy, test, promote) as MCP tools, allowing you to manage agents conversationally from any MCP-compatible client — Kiro Power, Claude Code, Cursor, Amazon Q CLI.
Instead of writing CLI commands, you describe what you want (“deploy my agent with memory and identity”), and the MCP server translates that into the correct AgentCore API calls.
Q12. Explain the AgentCore pricing model.
Answer: AgentCore uses consumption-based pricing with no upfront costs or minimums. You pay only for the components you use:
Runtime: $0.0895 per vCPU-hour (active CPU only; I/O wait not billed) + $0.00945 per GB-hour
Gateway: $0.005 per 1,000 invocations | $0.025 per 1,000 search calls
Memory (short-term): $0.25 per 1,000 events
Memory (long-term): $0.75 per 1,000 records/month (with auto extraction) | $0.50 per 1,000 retrievals
Identity: $0.010 per 1,000 requests (free when used via Runtime/Gateway)
Policy: $0.000025 per authorization request
Evaluations (built-in): $0.0024 per 1K input tokens | $0.012 per 1K output tokens
Foundation model inference is billed separately through Bedrock.
Q13. What is the typical cost for a production agent?
Answer: AWS’s official examples:
- Runtime: 10M sessions/month costs ~$7,235
- Gateway: HR assistant with 50M interactions/month costs ~$2,250
- Memory: coding assistant costs ~$42.50/month
A realistic production agent handling 50K sessions/month with Memory, Gateway, and Policy runs approximately $500-600/month in AgentCore fees (excluding model inference). The biggest cost driver is typically observability (CloudWatch spans/logs at standard rates).
Q14. How do you migrate from Bedrock Agents Classic to AgentCore?
Answer: Three migration paths:
1. Lift-and-shift (2-4 weeks) — Use the Import-Agent toolkit on GitHub to convert agents to LangChain, LangGraph, or Strands, test in staging, then switch traffic.
2. Rebuild natively (4-8 weeks) — Rewrite agent logic to use Gateway for tool routing and Memory for state, gaining multi-agent orchestration from the start.
3. Hybrid — Keep Classic for existing agents, build new work on AgentCore, migrate incrementally.
Key migration gotchas: Custom tool configs must be rewritten for Gateway, memory state doesn’t transfer automatically, and IAM roles need reconfiguration for multi-agent permissions.
Q15. What are AgentCore Skills?
Answer: AgentCore Skills are pre-built guidance packages that give agents domain-specific capabilities without custom orchestration code. The first set targets coding assistants — available through Kiro Power at launch (April 2026), with Claude Code, Codex, and Cursor support following.
Skills combine a system prompt, curated tool set, and evaluation criteria into a reusable bundle. You attach a skill to an agent the way you’d attach a tool.
Section 2 — Strands Agents SDK & Agent Creation (Q16-Q28)
Q16. What is the Strands Agents SDK?
Answer: Strands Agents is AWS’s open-source (Apache 2.0) Python SDK for building AI agents. It takes a model-driven approach: you define an agent with a model, tools, and a prompt, and the SDK runs an agentic loop.
The LLM reasons, selects tools, Strands executes them, and the cycle continues until the task is complete.
Production credentials: Strands powers Amazon Q Developer, AWS Glue, and VPC Reachability Analyzer. Contributors include Accenture, Anthropic, Meta, PwC, and Langfuse.
Q17. How do you create a basic Strands agent?
Answer:
pip install strands-agents strands-agents-tools
from strands import Agent, tool
@tool
def lookup_order(order_id: str) -> str:
"""Look up order status by order ID."""
return f"Order {order_id}: Shipped 3 days ago, arriving tomorrow."
agent = Agent(
system_prompt="You are a customer support agent. Use tools to help users.",
tools=[lookup_order],
)
response = agent("Where is my order #12345?")
print(response)
Three components define every Strands agent: a model (defaults to Bedrock Claude), tools (Python functions with @tool), and a prompt. The SDK handles the entire orchestration loop.
Q18. How do you define custom tools with the @tool decorator?
Answer: Any Python function becomes a tool with the @tool decorator. The function’s docstring tells the LLM when and how to use it, and type hints define the parameter schema:
from strands import tool
@tool
def calculate_shipping(
weight_kg: float,
destination_country: str,
express: bool = False
) -> dict:
"""Calculate shipping cost for a package.
Args:
weight_kg: Package weight in kilograms
destination_country: ISO 3166-1 alpha-2 country code
express: Whether to use express shipping
"""
base_rate = 5.0 if destination_country == "US" else 15.0
cost = base_rate + (weight_kg * 2.5)
if express:
cost *= 1.8
return {
"cost_usd": round(cost, 2),
"delivery_days": 2 if express else 7,
"carrier": "FedEx" if express else "USPS"
}
The LLM receives the function name, docstring, and parameter schema. It decides when to call the tool based on the user’s request and the docstring description.
Q19. How do you use MCP servers as tools in Strands?
Answer:
from strands import Agent
from strands.tools.mcp import MCPClient
mcp = MCPClient("npx -y @anthropic/domain-checker-mcp")
tools = mcp.list_tools_sync()
agent = Agent(
system_prompt="Check domain availability before suggesting names.",
tools=tools,
)
agent("Is acmecorp.com available? If not, suggest alternatives.")
Thousands of published MCP servers can be used as Strands tools — database connectors, API wrappers, file system handlers. Strands also supports the Agent-to-Agent (A2A) protocol (coming soon).
Q20. What pre-built tools does the Strands SDK provide?
Answer: The strands-agents-tools package provides 20+ tools:
calculator— Mathematical calculationshttp_request— Make HTTP API callsretrieve— Semantic search over Bedrock Knowledge Basesfile_read/file_write— File system operationsthinking— Multi-cycle deep analysis and self-reflectionagent_graph— Define multi-agent topologies and message routingshell— Execute shell commandscode_interpreter— Execute Python in sandbox (AgentCore)browser— Web browsing in sandbox (AgentCore)
The retrieve tool is especially noteworthy — it can retrieve relevant tools from a large catalog (one internal AWS agent has 6,000+ tools) so only relevant descriptions reach the model’s context window.
Q21. What model providers does Strands support?
Answer:
Amazon Bedrock (default) — Claude family, Llama, Mistral, Nova, Cohere. Best for production use (managed, scalable).
Anthropic API — Claude Opus, Sonnet, Haiku. Best for direct Anthropic access.
Llama API — Meta Llama models. Best for open-weight models.
Ollama — Any GGUF model. Best for local development, offline testing.
LiteLLM — OpenAI, Google, any provider. Best for multi-provider routing.
Custom — Any model via pluggable provider interface.
Switch providers by changing one line — the rest of the agent code stays the same.
Q22. How do you switch model providers in Strands?
Answer:
from strands import Agent
# Default: Amazon Bedrock
agent = Agent(tools=[my_tool])
# Switch to Anthropic API
from strands.models.anthropic import AnthropicModel
agent = Agent(
model=AnthropicModel(model_id="claude-sonnet-4-20250514"),
tools=[my_tool],
)
# Switch to Ollama for local dev
from strands.models.ollama import OllamaModel
agent = Agent(
model=OllamaModel(model_id="llama3.1:8b"),
tools=[my_tool],
)
Interview tip: Highlight the pluggable provider interface — develop locally with Ollama, test with Anthropic’s API, and deploy to production on Bedrock. Same agent logic throughout.
Q23. What deployment architectures does Strands support?
Answer: Four architectures:
1. Fully local — Agent runs in the user’s environment (CLI tool, desktop app).
2. Behind an API — Deployed on AWS Lambda (serverless), Fargate/ECS/EKS (long-running, streaming), or EC2.
3. Split — Agent loop in Fargate, tools in Lambda, allowing independent scaling and isolation.
4. Return-of-control — Client runs some tools locally while the agent and other tools run in the cloud (useful for tools needing local filesystem access).
Rule of thumb: Start monolithic; split out tools that need independent scaling as load grows. Lambda suits short tasks; Fargate suits long-running, streaming workloads. AgentCore Runtime supports sessions up to 8 hours.
Q24. How does the Strands agentic loop work internally?
Answer: The loop follows a plan-act-observe cycle:
Step 1: Strands sends the prompt, agent context, and tool descriptions to the LLM.
Step 2: The LLM can reply in natural language, plan steps, reflect on prior steps, or select tools.
Step 3: Strands executes selected tools and returns results to the LLM.
Step 4: The loop repeats until the LLM produces a final answer with no tool calls.
The model drives the entire process — this “model-driven” approach means the orchestration logic lives in the model’s reasoning, not in hand-coded if/else chains.
Q25. How do you wrap a Strands agent for AgentCore Runtime deployment?
Answer:
from strands import Agent
from bedrock_agentcore.runtime import BedrockAgentCoreApp
app = BedrockAgentCoreApp()
def load_model():
from strands.models.bedrock import BedrockModel
return BedrockModel(model_id="anthropic.claude-sonnet-4-20250514-v1:0")
@app.entrypoint
async def invoke(payload, context):
session_id = getattr(context, 'session_id', 'default-session')
agent = Agent(
model=load_model(),
system_prompt="You are a helpful assistant.",
tools=[my_tool],
)
response = agent(str(payload.get("prompt", "")))
return response
The BedrockAgentCoreApp wrapper adapts any Strands agent for AgentCore deployment. Deploy with agentcore deploy.
Q26. What is the difference between Strands Agents and the AgentCore Managed Harness?
Answer:
Strands = open-source SDK where you write and own the orchestration code. You control every step of the agent loop.
Managed Harness = zero-code option where you specify model, prompt, and tools, and AgentCore runs the loop for you.
Think of it as a spectrum: start with the Managed Harness for prototyping (three API calls, no code), then export to Strands when you need custom logic. The harness can export its orchestration as Strands code at any time.
Q27. How does Strands handle tool selection from large catalogs?
Answer: The retrieve pre-built tool performs semantic search over tool descriptions. When an agent has access to thousands of tools, sending all descriptions to the model would overflow the context window.
Instead, the retrieve tool searches the catalog by meaning, returns only the relevant tool descriptions, and the model picks from that subset. This is essentially RAG over your tool catalog. One internal AWS agent has 6,000+ tools — only the relevant subset reaches the model per query.
Q28. How do you test Strands agents locally?
Answer: Use agentcore dev for a local development experience with hot reload and an inspector UI.
For unit testing:
from strands import Agent, tool
from strands.models.ollama import OllamaModel
@tool
def mock_db_lookup(user_id: str) -> str:
"""Look up user in database."""
return '{"name": "Alice", "plan": "Pro"}'
agent = Agent(
model=OllamaModel(model_id="llama3.1:8b"),
tools=[mock_db_lookup],
system_prompt="You are a support agent.",
)
result = agent("What plan is user U123 on?")
assert "Pro" in str(result)
The CLI also provides agentcore invoke to test deployed agents.
Section 3 — AgentCore Runtime & Deployment (Q29-Q40)
Q29. How does AgentCore Runtime work?
Answer: Runtime is a serverless compute layer that auto-scales from zero. Your agent code is packaged into a Docker image, pushed to Amazon ECR, and deployed via the CLI or CDK.
Key features:
- Auto-scaling from 0 to N based on demand
- Framework-agnostic — any code that runs in a container
- Hot reload during development
- Support for long-running sessions up to 8 hours
- Asynchronous tool execution
- Multi-agent systems run each agent in its own isolated runtime
Q30. Walk through deploying an agent with the AgentCore CLI.
Answer:
# 1. Create project
agentcore create --project-name MyAgent --framework strands
cd MyAgent
# 2. Add capabilities
agentcore add memory --name AgentMemory --strategies SEMANTIC,SUMMARIZATION
agentcore add identity
agentcore add gateway --name MyGateway --authorizer-type AWS_IAM
# 3. Develop locally with hot reload
agentcore dev
# 4. Deploy to AWS
agentcore deploy
# 5. Test the deployed agent
agentcore invoke --prompt "Hello, what can you help me with?"
# 6. Check status
agentcore status
Each agentcore add command modifies agentcore.json and provisions the corresponding service on the next agentcore deploy. Environment variables like MEMORY_AGENTMEMORY_ID are automatically injected.
Q31. What happens under the hood during agentcore deploy?
Answer:
Step 1: Reads agentcore.json for project config and aws-targets.json for deployment targets.
Step 2: Builds a Docker image from your agent code.
Step 3: Pushes the image to Amazon ECR.
Step 4: Synthesizes AWS CDK constructs from @aws/agentcore-cdk.
Step 5: Runs cdk deploy to provision/update Runtime, Memory, Gateway, Identity, and other declared services.
Step 6: Outputs the Runtime ARN, endpoint URL, and environment variables.
Q32. How does the Managed Harness microVM model work?
Answer: Each Managed Harness session gets its own microVM with dedicated filesystem and shell access. The microVM boots in milliseconds (similar to Firecracker) and provides full Linux isolation.
Capabilities:
- Persistent filesystem state within a session
- Filesystem persistence (preview) for suspend/resume mid-task
- Model switching mid-session without redeployment
- Per-invocation configuration overrides
The microVM is destroyed when the session ends or after a configurable timeout.
Q33. How do you configure infrastructure-as-code for AgentCore?
Answer: AgentCore supports AWS CDK (GA) and CloudFormation (GA), with Terraform coming soon.
from aws_cdk import Stack
from aws_cdk.aws_bedrock_agentcore_alpha import (
AgentRuntime, Memory, Gateway
)
class AgentStack(Stack):
def __init__(self, scope, construct_id, **kwargs):
super().__init__(scope, construct_id, **kwargs)
memory = Memory(self, "AgentMemory",
name="CustomerSupportMemory",
strategies=["SEMANTIC", "SUMMARIZATION"],
)
runtime = AgentRuntime(self, "AgentRuntime",
name="CustomerSupportAgent",
memory=memory,
)
Q34. What is the Code Interpreter tool and how is it billed?
Answer: The Code Interpreter runs Python and shell commands in an isolated, sandboxed environment within AgentCore. Agents use it for data analysis, visualizations, file processing, or computational tasks.
Billing: Same as Runtime — $0.0895/vCPU-hour (active CPU only) and $0.00945/GB-hour. AWS’s example: 30K code executions/month costs ~$109.40.
The sandbox prevents the agent from accessing the host network or filesystem, mitigating prompt injection risks.
Q35. What is the Browser tool and when would you use it?
Answer: The Browser tool gives agents a sandboxed web browser for navigating websites, filling forms, extracting content, and taking screenshots.
Use cases: price comparison agents, web scraping, form automation, and research agents. The browser runs in the same isolated environment as the Code Interpreter.
Q36. How do you invoke a deployed agent programmatically?
Answer:
import boto3
client = boto3.client('bedrock-agentcore', region_name='us-east-1')
response = client.invoke_agent_runtime(
agentRuntimeId='arn:aws:bedrock-agentcore:us-east-1:123456789:runtime/my-agent',
sessionId='session-abc-123',
inputText='What is the status of order #12345?',
)
for event in response['completion']:
if 'chunk' in event:
print(event['chunk']['bytes'].decode(), end='')
Use the bedrock-agentcore data plane client for runtime operations. The control plane client handles creation and configuration.
Q37. How do you handle long-running agent tasks?
Answer:
Option 1: Use filesystem persistence (preview) to externalize session state for suspend/resume.
Option 2: Implement checkpoint patterns where the agent writes intermediate results to Memory or S3.
Option 3: Use event-driven triggers — the agent completes a phase, publishes an event to EventBridge, and a new invocation continues.
For truly long-running workflows (days), decompose into multiple agent sessions orchestrated by Step Functions.
Q38. Compare AgentCore Runtime with Lambda, Fargate, and EC2 for agent hosting.
Answer:
AgentCore Runtime: Max 8 hours, millisecond cold start (microVM), built-in auto-scale, native Memory/Identity integration, per active CPU-second billing.
Lambda: Max 15 minutes, seconds cold start, built-in auto-scale, manual Memory integration, per invocation + duration billing.
Fargate: Unlimited duration, 30-60s cold start, ECS auto-scaling, manual integration, per vCPU + memory billing.
EC2: Unlimited duration, minutes cold start, ASG scaling, manual everything, per instance-hour billing.
Bottom line: AgentCore Runtime is purpose-built for agents — native Memory, Identity, and Gateway integration eliminate glue code.
Q39. How does AgentCore handle network isolation?
Answer: AgentCore supports VPC deployment via PrivateLink, ensuring agent traffic never traverses the public internet. Runtime endpoints can be placed in private subnets with security groups controlling traffic. Gateway routes tool calls through the VPC. This satisfies regulatory requirements for financial services, healthcare (HIPAA), and government workloads.
Q40. What compliance certifications does AgentCore inherit?
Answer: AgentCore inherits Amazon Bedrock’s compliance posture: SOC 1/2/3, ISO 27001/27017/27018, HIPAA eligibility (sign a BAA), PCI DSS, FedRAMP High (GovCloud regions), and CSA STAR.
Data is encrypted at rest (KMS) and in transit (TLS 1.2+). IAM policies provide fine-grained access control, and CloudTrail logs all API calls.
Section 4 — Gateway & Tool Integration (Q41-Q52)
Q41. What is the AgentCore Gateway?
Answer: The Gateway is a managed MCP (Model Context Protocol) server that acts as a centralized tool server for your agents. It converts REST APIs, Lambda functions, OpenAPI specs, and Knowledge Bases into agent-usable tools with automatic protocol translation, authentication pass-through, rate limiting, and error handling.
Q42. What types of tool targets does the Gateway support?
Answer: Five target types:
1. Lambda functions — invoke any Lambda as a tool
2. REST APIs — any HTTP endpoint with an OpenAPI schema
3. API Gateway endpoints — existing Amazon API Gateway services
4. MCP servers — any published MCP server
5. Knowledge Bases — Bedrock Knowledge Bases exposed as retrieval tools
Each target is registered with the Gateway and becomes available to any connected agent.
Q43. How do you add a Gateway target via CLI?
Answer:
agentcore add gateway --name MyGateway \
--authorizer-type AWS_IAM \
--policy-engine-name MyPolicyEngine \
--policy-engine-mode enforce
aws bedrock-agentcore-control create-gateway-target \
--gateway-id gw-abc123 \
--name OrderLookup \
--target-type LAMBDA \
--lambda-target functionArn=arn:aws:lambda:us-east-1:123456789:function:order-lookup \
--description "Look up order status by order ID"
The Gateway auto-generates tool descriptions from OpenAPI schemas or Lambda function metadata.
Q44. How does Gateway protocol translation work?
Answer: When an agent calls a tool, the Gateway:
1. Receives the tool call in MCP format
2. Looks up the registered target
3. Translates the request to the target’s protocol (REST, Lambda invoke, etc.)
4. Passes through authentication credentials
5. Invokes the target
6. Translates the response back to MCP format
7. Enforces Policy rules (guardrails) on request and response
8. Returns the result to the agent
Metered at $0.005 per 1,000 invocations.
Q45. How does Gateway authentication pass-through work?
Answer: Three authentication modes:
AWS_IAM — Uses the agent’s IAM role to authenticate with AWS services.
GATEWAY_IAM_ROLE — The Gateway’s own execution role authenticates (useful when agents shouldn’t have direct service access).
OAuth2 pass-through — Passes the user’s OAuth token from Identity to external APIs (Slack, Zoom, Google Workspace). The agent code never touches raw OAuth tokens.
Q46. What is Gateway composition and how is it billed?
Answer: Composition lets you chain multiple tool calls within a single Gateway request. For example, “create-and-notify” calls a Lambda to create an order, then calls Slack to notify the team — in one request.
Important: Each composed tool call counts as a separate invocation for billing. Poorly designed multi-agent setups with heavy composition can roughly triple costs. Use Gateway response caching to reduce redundant calls.
Q47. How do you connect a Knowledge Base to the Gateway?
Answer: In the Gateway console, add a target under Connectors and select Knowledge Bases. Select the Bedrock Knowledge Base and configure the retrieval type (standard or agentic). The Gateway exposes the KB as an MCP tool that any connected agent can invoke, with identity, permissions, and policies enforced automatically.
Q48. How does Gateway rate limiting protect downstream services?
Answer: The Gateway applies configurable rate limits per tool target — for example, 100 requests/second for a REST API, 50 concurrent invocations for a Lambda. When limits are exceeded, the Gateway returns a throttle response to the agent, which the LLM can handle by retrying or choosing an alternative approach. This is critical for production agents that may make rapid-fire tool calls during complex reasoning chains.
Q49. How do you use the Gateway Search API?
Answer: The Search API performs semantic search over registered tools. Instead of listing all tools in the prompt, you search for relevant ones. The Search API embeds the query, matches against tool descriptions and schemas, and returns top-k tools.
Billing: $0.025 per 1,000 search calls + $0.02 per 100 tools/month indexed.
Think of it as RAG over your tool registry — essential for enterprise agents with large tool catalogs.
Q50. How does Gateway integrate with VPC for private tool access?
Answer: Gateway supports VPC data egress at $0.006/GB for routing tool calls through your VPC. Configure a VPC endpoint, and tool calls to internal services stay within your network. External API calls route through NAT gateways. This lets agents access internal tools without exposing them to the public internet.
Q51. Compare AgentCore Gateway with direct tool integration.
Answer:
Auth management: Direct = per-tool in agent code | Gateway = centralized pass-through
Rate limiting: Direct = manual per-tool | Gateway = configured per-target
Protocol translation: Direct = custom adapters per API | Gateway = automatic
Guardrails: Direct = app-level validation | Gateway = Cedar policy engine, inline
Observability: Direct = manual instrumentation | Gateway = automatic OTEL tracing
Tool discovery: Direct = hardcoded in prompts | Gateway = Search API, dynamic
Cost: Direct = free (no middleware) | Gateway = $0.005/1K invocations
Verdict: Use Gateway for centralized governance, multi-agent sharing, or enterprise compliance. Use direct integration for simple prototypes.
Q52. What is the Agent Registry and how does it relate to Gateway?
Answer: The Agent Registry is a catalog of deployed agents, tool configurations, and version metadata. It provides free thresholds: 5,000 records, 1M Search API calls, and 2M List/Get calls per month.
Combined with Gateway, the Registry lets teams discover and share agents across an organization — enabling composable agent architectures where specialized agents become building blocks.
Section 5 — Memory Management (Q53-Q65)
Q53. Explain AgentCore Memory’s two-layer architecture.
Answer:
Layer 1 — Short-term memory: Raw conversation events (user messages, assistant responses, tool calls) stored per session, available immediately. Cost: $0.25 per 1,000 events.
Layer 2 — Long-term memory: Insights extracted from events by a memory strategy. Extraction runs asynchronously (typically within 60 seconds) and produces durable records — summaries, user preferences, and semantic facts that persist across sessions. Cost: $0.75 per 1,000 records/month (with extraction).
Q54. What memory strategies are available?
Answer:
1. Summary — Condenses conversations into session summaries organized by namespace templates. Best for maintaining conversation continuity across sessions.
2. Semantic — Extracts factual information and entities (e.g., “User prefers dark mode,” “Order #12345 was shipped”). Supports vector-based semantic search. Best for building user profiles and knowledge.
3. User Preference — Specifically targets user preferences and settings. Best for personalizing agent behavior over time.
You can combine multiple strategies on a single Memory resource. Each writes to its own namespace.
Q55. How do you create a Memory resource and write events?
Answer:
from bedrock_agentcore.memory import MemoryClient
client = MemoryClient(region_name="us-east-1")
# Create memory with semantic + summary strategies
memory = client.create_memory_and_wait(
name="CustomerSupportMemory",
strategies=[
{
"summaryMemoryStrategy": {
"name": "SessionSummarizer",
"namespaceTemplates": ["/summaries/{actorId}/{sessionId}/"]
}
},
{
"semanticMemoryStrategy": {
"name": "FactExtractor",
"namespaceTemplates": ["/users/{actorId}/facts/"]
}
}
]
)
# Write conversation events
client.create_event(
memory_id=memory.get("id"),
actor_id="User84",
session_id="OrderSupport1",
messages=[
("Hi, I'm having trouble with order #12345", "USER"),
("Let me look that up for you.", "ASSISTANT"),
],
)
Q56. How do you retrieve long-term memories?
Answer:
# Retrieve summaries
summaries = client.retrieve_memories(
memory_id=memory.get("id"),
namespace="/summaries/User84/OrderSupport1/",
query="summarize the support issue"
)
# Retrieve semantic facts about a user
facts = client.retrieve_memories(
memory_id=memory.get("id"),
namespace="/users/User84/facts/",
query="what are User84's recent orders?"
)
Retrieval uses vector-based semantic search. The namespace parameter scopes the search to a specific strategy’s output. Long-term retrievals cost $0.50 per 1,000.
Q57. How do you use the MemorySessionManager for Strands integration?
Answer:
from bedrock_agentcore.memory import MemorySessionManager
from bedrock_agentcore.memory.constants import ConversationalMessage, MessageRole
session_manager = MemorySessionManager(
memory_id=memory_id,
region_name="us-west-2"
)
session = session_manager.create_memory_session(
actor_id="User1",
session_id="Session1"
)
# Add conversation turns
session.add_turns(
messages=[ConversationalMessage(
"Hi, how can I help you?", MessageRole.ASSISTANT
)]
)
# Retrieve recent turns (short-term)
turns = session.get_last_k_turns(k=5)
# Search long-term records
records = session.search_long_term_memories(
query="user preferences",
namespace_path="/",
top_k=3
)
Q58. How do you add Memory to an existing Strands agent?
Answer: Three steps:
Step 1: Add and deploy memory via CLI:
agentcore add memory --name MyMemory --strategies SEMANTIC,SUMMARIZATION
agentcore deploy
Step 2: Create a session manager module:
from bedrock_agentcore.memory.integrations.strands.config import (
AgentCoreMemoryConfig, RetrievalConfig
)
from bedrock_agentcore.memory.integrations.strands.session_manager import (
AgentCoreMemorySessionManager
)
def get_session_manager(session_id, actor_id):
return AgentCoreMemorySessionManager(
AgentCoreMemoryConfig(
memory_id=os.getenv("MEMORY_MYMEMORY_ID"),
session_id=session_id,
actor_id=actor_id,
retrieval_config={
f"/users/{actor_id}/facts": RetrievalConfig(top_k=3, relevance_score=0.5),
},
),
os.getenv("AWS_REGION"),
)
Step 3: Pass the session manager to the Agent: Agent(session_manager=get_session_manager(sid, uid), ...)
Q59. How does Memory semantic retrieval work internally?
Answer: When a memory strategy extracts long-term records, each record is embedded into a vector representation using a Bedrock embedding model (managed, no configuration needed). Records are stored in an internal vector index organized by namespace.
On retrieval, the query is embedded and matched using approximate nearest neighbor (ANN) search. The relevance_score parameter (0.0-1.0) filters low-confidence matches.
This is essentially RAG built into the memory layer — no separate vector database to manage.
Q60. How do you configure Memory event expiry to control costs?
Answer: Configure event expiry so old session events are automatically pruned. Long-term records persist independently — once facts are extracted, deleting raw events doesn’t lose the insights.
Recommended cost optimization:
- Keep raw events for 30 days
- Keep summaries for 1 year
- Keep semantic facts indefinitely
Q61. How does Memory differ from Bedrock Knowledge Bases?
Answer:
Memory stores conversation context, user preferences, and session state — scoped per-user, updated in real-time, used for personalization and continuity.
Knowledge Bases store organizational documents, policies, and procedures — scoped organization-wide, updated via batch sync, used for RAG over enterprise knowledge.
Use them together: Memory tells the agent who the user is; Knowledge Bases tell the agent what the organization knows.
Q62. What is episodic memory and how was it added to AgentCore?
Answer: Episodic memory stores sequences of events as ordered chains of actions, observations, and outcomes. Added in December 2025, it supplements semantic and summary memory.
Episodic memory lets agents learn from past task executions: “Last time I tried approach A, it failed; approach B succeeded.” Particularly useful for coding agents and customer support agents encountering recurring patterns.
Q63. How do you clean up Memory resources?
Answer:
agentcore remove memory --name CustomerSupportSemantic
agentcore deploy
# Or via boto3
control_client = boto3.client('bedrock-agentcore-control')
control_client.delete_memory(memoryId='mem-abc123')
Removing a Memory resource deletes all associated events and records. For selective cleanup, use the data plane API.
Q64. How would you design a Memory strategy for a multi-turn coding assistant?
Answer: Combine three strategies:
1. Semantic (/users/{actorId}/facts/) — Extracts coding preferences, project context, frequently referenced APIs.
2. Summary (/summaries/{actorId}/{sessionId}/) — Condenses long debugging sessions into concise summaries.
3. User Preference — Tracks settings like preferred editor, formatting rules, testing frameworks.
Recommended settings: Event expiry at 90 days, summaries for 6 months, semantic facts indefinitely. Estimated cost: ~$42.50/month.
Q65. What are the consistency guarantees for Memory reads and writes?
Answer:
Short-term writes: Strongly consistent — once create_event returns, the event is available.
Long-term extraction: Eventually consistent — strategies run asynchronously, typically completing within 60 seconds.
Best practice: Implement a polling pattern with exponential backoff rather than relying on a fixed time.sleep(60).
Section 6 — Identity, Security & Guardrails (Q66-Q78)
Q66. How does AgentCore Identity handle inbound authentication?
Answer: Identity validates callers via JWT (JSON Web Token). It extracts the JWT from the Authorization header, validates signature/expiration/issuer, extracts claims (user ID, roles, permissions), and passes authenticated context to the agent and Policy engine.
Supported identity providers: Amazon Cognito, Okta, Microsoft Entra ID, and any OIDC-compliant provider.
Billing: $0.010 per 1,000 direct requests, but free when used through Runtime or Gateway.
Q67. How does outbound OAuth2 work for acting on user behalf?
Answer: AgentCore Identity supports OAuth2 three-legged flows:
Step 1: User authenticates with the external service through a consent screen.
Step 2: Identity receives and securely vaults the OAuth token.
Step 3: When the agent calls the external API, Identity provides the token via Gateway auth pass-through.
Step 4: Gateway injects the token into API request headers. Token refresh is handled automatically.
Your agent code never touches raw OAuth tokens.
Q68. What is the Cedar policy engine and how does it work with AgentCore?
Answer: Cedar is an open-source policy language created by AWS (same as Amazon Verified Permissions). In AgentCore, the Cedar policy engine evaluates every tool call through the Gateway in real time.
Policies express fine-grained rules: who (principal) can do what (action) on which resource, with optional conditions.
Important: An engine in ENFORCE mode denies everything unless a policy permits it — you must add explicit permit policies for benign requests.
Q69. How do you configure content-filtering guardrails?
Answer:
agentcore add policy-engine --name MyPolicyEngine
agentcore add gateway --name MyGateway \
--authorizer-type AWS_IAM \
--policy-engine-name MyPolicyEngine \
--policy-engine-mode enforce
Example Cedar policy to block violent content:
forbid (principal,
action == AgentCore::Action::"MyTarget___POST:/invocations",
resource == AgentCore::Gateway::"arn:aws:...:gateway/MyGateway")
when guardrails {
BedrockGuardrails::ContentFilter(
["VIOLENCE"],
[context.input.prompt]
)["VIOLENCE"].confidenceScore.greaterThan(decimal("0.7"))
};
Q70. What guardrail categories does AgentCore support?
Answer:
Content Filter: VIOLENCE, HATE, SEXUAL, MISCONDUCT, INSULTS — blocks harmful user inputs or model outputs.
Prompt Attack: JAILBREAK, PROMPT_INJECTION, PROMPT_LEAKAGE — detects and blocks manipulation attempts.
Sensitive Information: ADDRESS, EMAIL, PHONE, CREDIT_DEBIT_CARD_NUMBER, SSN, etc. — flags or redacts PII.
Each filter has a confidence score (0.0-1.0). Policies can forbid (block input), permit (allow below threshold), or suppressOutput (block model response).
Q71. How do Cedar policy effects differ: forbid vs. permit vs. suppressOutput?
Answer:
forbid — Blocks the request before it reaches the agent. Caller gets a 403. Use for input filtering.
permit — Allows requests below a confidence threshold. Used to explicitly allow certain patterns.
suppressOutput — Blocks the model’s response on the output side. The request reaches the agent, but if the response violates the policy, it’s blocked before reaching the caller. Use for output filtering — catches hallucinated PII or harmful generated content.
Q72. How do you test guardrails before enforcing them?
Answer:
# Test a blocked request
agentcore invoke --gateway MyGateway \
--path /MyTarget/invocations --method POST \
--payload '{"prompt":"harmful content here"}'
# Expected: 403 "Request Denied: Agent runtime request not allowed
# due to policy enforcement"
Best practice: Before going to ENFORCE mode, set the policy engine to log-only mode to monitor what would be blocked without actually blocking. Review CloudWatch logs to tune thresholds.
Q73. How does the sandboxed execution model protect against prompt injection?
Answer: Defense-in-depth with five layers:
1. Gateway guardrails detect and block prompt injection attempts before they reach the agent.
2. Code Interpreter sandboxing prevents malicious code execution from accessing host resources.
3. Browser sandboxing prevents web-browsing agents from reaching internal networks.
4. MicroVM isolation gives each Managed Harness session its own microVM.
5. IAM least-privilege ensures agents only have permissions for specific resources.
Q74. How do you implement least-privilege IAM for agents?
Answer: Each agent gets its own IAM execution role with scoped policies:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["bedrock:InvokeModel"],
"Resource": "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-sonnet-*"
},
{
"Effect": "Allow",
"Action": "bedrock-agentcore:*",
"Resource": "arn:aws:bedrock-agentcore:us-east-1:123456789:memory/mem-abc123"
},
{
"Effect": "Allow",
"Action": "lambda:InvokeFunction",
"Resource": "arn:aws:lambda:us-east-1:123456789:function:order-lookup"
}
]
}
Scope model access to specific model IDs, Memory to specific resources, and Lambda to specific functions.
Q75. What is the Policy natural-language authoring feature?
Answer: You describe a policy in plain English (“Block any request with violent content above 70% confidence”), and AgentCore generates the corresponding Cedar policy. Billed at $0.13 per 1,000 input tokens. Lowers the barrier for non-developers to author guardrail policies.
Q76. How do you audit agent actions with CloudTrail?
Answer: CloudTrail automatically logs all AgentCore API calls — control plane (create/update/delete) and data plane (InvokeAgentRuntime, create_event, create_policy). Each log includes caller identity, timestamp, API action, request parameters, and response.
For compliance, configure a CloudTrail trail to deliver logs to S3 with Object Lock (WORM) for immutable audit records.
Q77. How does AgentCore encryption work?
Answer:
At rest: AWS KMS — all data encrypted with AWS-managed keys or customer-managed CMKs.
In transit: TLS 1.2+ for all API calls and inter-service communication.
For Memory, customer-managed keys let you control key rotation and access — if you revoke the key, all stored memories become inaccessible. Satisfies HIPAA, PCI DSS, and financial regulations.
Q78. How would you design a guardrail strategy for a healthcare agent?
Answer: Layer three Cedar policy sets:
1. Input guardrails: Forbid content matching VIOLENCE, HATE, SEXUAL, MISCONDUCT. Detect PROMPT_INJECTION and JAILBREAK with low threshold (0.5). Detect and redact PII in inputs.
2. Output guardrails: SuppressOutput for responses containing patient identifiers (SSN, medical record numbers). Require citation of sources for medical claims.
3. Access policies: Restrict tool access by caller role (doctor vs. nurse vs. patient). Scope Memory to patient’s own records.
Infrastructure: VPC isolation (PrivateLink), customer-managed CMK, CloudTrail audit trail.
Section 7 — Knowledge Bases & RAG (Q79-Q88)
Q79. How do Bedrock Knowledge Bases integrate with AgentCore?
Answer: Knowledge Bases connect through the Gateway as a connector target. You select a KB in the Gateway console, configure retrieval type, and the Gateway exposes it as an MCP tool. Any agent connected to the Gateway can invoke the KB — the agent doesn’t need to know the KB implementation details.
Q80. What data connectors do Knowledge Bases support?
Answer: Native connectors:
- Amazon S3 (documents, PDFs, CSVs)
- Microsoft SharePoint
- Atlassian Confluence
- Google Drive
- Microsoft OneDrive
- Web crawling (website content)
The Knowledge Base manages the full pipeline: crawl, chunk, embed, index, retrieve.
Q81. What is the difference between standard and agentic retrieval?
Answer:
Standard retrieval: Single search pass. Pure similarity search. Best for focused questions answerable by one document section. Lower cost and latency.
Agentic retrieval: Multi-step — interprets intent, plans queries, evaluates intermediate results, reranks, and synthesizes. Best for complex questions spanning multiple documents. Higher cost but better answer quality.
Example: “What is our refund policy?” uses standard. “Compare our refund policy for enterprise vs. SMB customers” uses agentic.
Q82. How do you create a Knowledge Base and connect it to an agent?
Answer:
Console path: AgentCore Console, then Built-in Tools, then Knowledge Bases, then Create, then Select data source, then Configure embedding, then Start ingestion, then Gateway, then Add Target, then Connectors, then Select KB.
Programmatic path:
from strands import Agent
# KB is exposed as a Gateway tool — agent discovers it
agent = Agent(
system_prompt="Answer questions using the company knowledge base.",
tools=gateway_tools,
)
agent("What is our refund policy for enterprise customers?")
Q83. How does Knowledge Base chunking affect retrieval quality?
Answer:
Chunk size: Smaller chunks (200-500 tokens) give precise answers but may lose context. Larger chunks (500-1,000 tokens) preserve context but may include irrelevant text.
Overlap: 50-100 token overlap prevents information loss at boundaries.
Semantic chunking: Splits at topic boundaries rather than fixed sizes — more coherent chunks.
Recommendation: For technical documentation, semantic chunking with 500-token chunks and 100-token overlap typically gives the best results.
Q84. How do you use the Strands retrieve tool for Knowledge Base queries?
Answer:
from strands import Agent
from strands.tools import retrieve
agent = Agent(
system_prompt="Use the knowledge base to answer product questions.",
tools=[retrieve],
)
agent("How do I configure SSO for our enterprise plan?")
The retrieve tool supports two modes: document retrieval (standard semantic search) and tool retrieval (search over tool descriptions to dynamically select relevant tools).
Q85. How does the retrieve tool handle large tool catalogs?
Answer: The retrieve tool indexes tool descriptions in a Knowledge Base. When the model needs a tool, it calls retrieve with a natural-language query like “find a tool that can look up customer orders.” The retrieve tool returns top-k matching descriptions, which the model then uses.
This pattern — RAG over the tool registry — is used in production by Amazon Q Developer, which has 6,000+ tools.
Q86. What embedding models does Knowledge Bases support?
Answer: Amazon Titan Text Embeddings (v1 and v2), Cohere Embed (English and multilingual), and any Bedrock-supported embedding model.
Titan Embeddings v2: 1,024 dimensions, good quality at low cost.
Cohere Embed: State-of-the-art multilingual support.
For specialized domains (medical, legal, financial), fine-tuned embeddings can significantly improve retrieval accuracy.
Q87. How do you combine Memory and Knowledge Bases in one agent?
Answer: Through the Gateway, an agent accesses both as tools:
1. Memory provides who the user is — their history, preferences, current session context.
2. Knowledge Bases provide what the organization knows — policies, documentation, procedures.
3. The agent queries Memory first for personalization context, then queries the KB grounded by that context.
Result: A personalized answer grounded in official documentation.
Q88. How would you architect a RAG pipeline with AgentCore for a legal research agent?
Answer:
1. Data ingestion: KB with S3 bucket containing legal documents, semantic chunking with 800-token chunks.
2. Retrieval: Agentic retrieval (legal questions span multiple statutes and precedents).
3. Memory: Semantic strategy to track research context across sessions.
4. Guardrails: Cedar policies to suppress PII and require citations.
5. Evaluation: Custom evaluator checking answer groundedness.
6. Observability: Trace every retrieval to its source document for audit.
Section 8 — Multi-Agent Orchestration (Q89-Q98)
Q89. How does AgentCore support multi-agent systems?
Answer: AgentCore runs each agent in its own isolated Runtime. Multi-agent coordination through three mechanisms:
1. Agents-as-tools — A supervisor agent wraps specialist agents as tools.
2. Gateway tool sharing — Multiple agents share tools through the same Gateway.
3. Shared Memory — Agents share context through the same Memory resource using namespaces.
End-to-end tracing connects all agents in a request through OpenTelemetry.
Q90. Explain the multi-agent patterns supported by Strands.
Answer:
1. Supervisor (agents-as-tools) — Orchestrator delegates to specialist agents wrapped as tools. Single point of control.
2. Swarm / peer-to-peer — Agents communicate without a central orchestrator. Uses mesh communication and shared memory/blackboard patterns.
3. Hierarchical — Multi-level delegation in a tree. Tasks flow down from orchestrator through managers to workers.
4. Graph topology — Arbitrary agent connections defined via the agent_graph tool. Supports competitive patterns (multiple agents propose solutions).
Q91. How do you implement the supervisor pattern with Strands?
Answer:
from strands import Agent, tool
# Specialist agents
research_agent = Agent(
system_prompt="You are a research specialist.",
tools=[web_search, retrieve],
)
writer_agent = Agent(
system_prompt="You are a technical writer.",
tools=[],
)
# Wrap specialists as tools
@tool
def delegate_research(query: str) -> str:
"""Delegate a research task to the research specialist."""
return str(research_agent(query))
@tool
def delegate_writing(content: str, instructions: str) -> str:
"""Delegate a writing task to the writing specialist."""
return str(writer_agent(f"{instructions}\n\nContent:\n{content}"))
# Supervisor agent
supervisor = Agent(
system_prompt="Break tasks into research and writing phases.",
tools=[delegate_research, delegate_writing],
)
supervisor("Write a technical brief on AgentCore's memory system.")
Q92. How do multi-agent systems share memory in AgentCore?
Answer: Agents share a Memory resource using namespaces to scope access:
retrieval_config = {
"/orchestration/{session_id}/": RetrievalConfig(top_k=3),
"/research/{session_id}/": RetrievalConfig(top_k=5),
}
The supervisor writes to /orchestration/, the research agent writes to /research/, and the writer reads from both. The memory layer acts as a shared blackboard.
Q93. What is the Agent-to-Agent (A2A) protocol?
Answer: A2A is an open protocol for agents to discover and invoke other agents, regardless of framework or hosting. An agent on AgentCore could invoke an agent on Google Cloud or Azure as easily as calling a local tool. Strands has announced A2A support as “coming soon.”
Q94. How do you implement runtime isolation between agents?
Answer: Each agent gets:
1. Separate IAM execution roles — research agent accesses KBs but not production databases.
2. Separate Gateway policies — different Cedar policies per agent.
3. Separate Memory namespaces — agents only see needed context.
4. Independent scaling — each agent scales based on its own demand.
5. Per-agent observability — cost attribution and tracing per agent.
Q95. How does AgentCore handle agent communication latency?
Answer: Mitigations:
1. Colocate agents in the same region.
2. Use asynchronous patterns — dispatch tasks and collect results.
3. Cache Gateway responses.
4. Minimize agent depth — three levels usually sufficient.
5. Use streaming for partial results.
Q96. Compare AgentCore’s multi-agent approach with LangGraph and CrewAI.
Answer:
AgentCore + Strands: Model-driven orchestration, separate Runtimes + IAM, managed Memory service, Gateway tool sharing, Cedar policies, managed serverless deployment. Best for enterprise and compliance-heavy.
LangGraph: Graph-based orchestration (explicit edges), same-process threads, checkpointer (Redis/Postgres), per-node tools, custom validation nodes, self-hosted or LangGraph Cloud. Best for complex deterministic flows.
CrewAI: Role-based orchestration (crew/task), same process, short/long-term stores, per-agent tools, custom guardrails, self-hosted. Best for rapid prototyping.
Q97. How do you debug multi-agent interactions?
Answer:
1. Distributed traces — OpenTelemetry propagates trace IDs through Gateway, so entire chains appear as one trace.
2. CloudWatch dashboards — Per-agent metrics (latency, error rate, tool usage).
3. Cost attribution — Model tokens, Gateway calls, and Memory operations per agent.
4. agentcore dev — Local inspector UI for stepping through interactions before deploying.
Q98. Design a multi-agent customer service system on AgentCore.
Answer: Supervisor pattern with four specialists:
1. Triage agent — Classifies requests and routes to specialists.
2. Billing agent — Accesses billing APIs through Gateway with human-in-the-loop for refunds.
3. Technical agent — Queries KB for product docs, escalates complex issues.
4. Account agent — Uses Identity OAuth to act on user behalf.
Shared Memory tracks complete interaction history. Cedar guardrails filter PII. Cost optimization: 5-minute idle timeouts and Gateway response caching.
Section 9 — Observability, Evaluation & Production (Q99-Q110)
Q99. How does AgentCore observability work?
Answer: OpenTelemetry-based distributed tracing covering:
- LLM invocations — model ID, prompt tokens, completion tokens, latency
- Tool calls — name, input, output, duration, errors
- Memory operations — event writes, retrieval queries, extraction
- Multi-step reasoning — full agent loop as nested spans
- Gateway policy evaluations — decisions per policy
Telemetry supports any OTEL-compatible backend: CloudWatch (default), Grafana, Datadog, Dynatrace, Jaeger.
Q100. What metrics does Strands expose for observability?
Answer: Tool invocation counts and error rates, turns per interaction, model latency (time-to-first-token and total), prompt and completion token counts, and timestamped logs with optional content redaction.
These metrics propagate through OTEL to any configured backend. Traces can propagate across services.
Q101. How does the AgentCore Evaluations system work?
Answer:
Built-in evaluators: AWS-provided scorers for relevance, groundedness, helpfulness, safety, and latency. Cost: $0.0024/1K input tokens + $0.012/1K output tokens.
Custom evaluators: Your own scoring logic. Cost: $1.50/1K evaluations (model usage billed separately).
Evaluations run in both development (test datasets) and production (sampled live traffic). Results feed into CloudWatch dashboards.
Q102. How do you set up online evaluation for a production agent?
Answer:
agentcore add online-eval --name QualityMonitor \
--evaluator-type RELEVANCE \
--sample-rate 0.1
agentcore deploy
Online evaluation samples live traffic asynchronously — no latency impact. Set CloudWatch Alarms on p50 relevance score dropping below 0.7 to catch quality degradation early.
Q103. How do you implement cost attribution across agents?
Answer: Build a CloudWatch dashboard aggregating OTEL spans by agent ID:
- Runtime costs — vCPU-hours and GB-hours per agent
- Model costs — input/output tokens per agent
- Gateway costs — invocations per agent
- Memory costs — events and retrievals per agent
Critical for multi-agent systems where one poorly optimized agent can dominate the bill.
Q104. What production deployment best practices does AgentCore recommend?
Answer:
1. Aggressive session timeouts (5 minutes idle)
2. Gateway response caching
3. Run evaluations off-peak
4. Memory event expiry (30-90 day TTL)
5. VPC isolation (PrivateLink)
6. Per-agent IAM roles (least-privilege)
7. Cedar policies in ENFORCE mode
8. CloudWatch Alarms on error rates, latency p99, evaluation scores, and cost budgets
Q105. How do you handle agent errors and retries in production?
Answer:
Model-level: Managed Harness retries transient errors automatically. For Strands, implement retry with exponential backoff.
Tool-level: Gateway returns structured errors the LLM can reason about — try alternatives or ask for clarification.
System-level: Dead-letter queues (SQS DLQ), EventBridge alert rules, Step Functions for complex recovery.
Q106. How do you implement blue-green deployments for agents?
Answer:
Step 1: Deploy new version as separate Runtime endpoint.
Step 2: Use ALB or API Gateway with weighted target groups (10% new, 90% old).
Step 3: Monitor evaluation scores and error rates.
Step 4: Gradually shift traffic.
Step 5: Decommission old version.
For Managed Harness, per-invocation overrides let you A/B test model changes without separate deployments.
Q107. How does AgentCore Observability integrate with third-party tools?
Answer: OTEL-compatible telemetry integrates with Grafana, Datadog, Dynatrace, and Jaeger. CloudWatch receives all telemetry natively at $0.35/GB for spans, $0.50/GB for logs.
Cost note: For a platform processing 10 TB spans and 6 TB logs, observability alone costs ~$6,500/month — often the biggest AgentCore-related line item.
Q108. What is the Optimization Recommendations feature?
Answer: Free during preview. Analyzes your agent’s telemetry and suggests improvements:
- Model selection — “switch from Opus to Sonnet for this task, saving 60%”
- Tool usage — “this tool is called 3x per request with same result, enable caching”
- Memory strategy — “event volume is high, enable summary strategy”
- Session configuration — “average idle is 8 minutes, reduce timeout to 5”
Q109. How do you set up alerting for agent failures?
Answer:
# High error rate alarm
aws cloudwatch put-metric-alarm \
--alarm-name "AgentHighErrorRate" \
--metric-name "Errors" \
--namespace "AgentCore/Runtime" \
--dimensions Name=AgentId,Value=my-agent \
--statistic Sum --period 300 --threshold 10 \
--comparison-operator GreaterThanThreshold \
--alarm-actions arn:aws:sns:us-east-1:123456789:alerts
# Quality degradation alarm
aws cloudwatch put-metric-alarm \
--alarm-name "AgentQualityDrop" \
--metric-name "RelevanceScore" \
--namespace "AgentCore/Evaluations" \
--statistic p50 --period 3600 --threshold 0.7 \
--comparison-operator LessThanThreshold \
--alarm-actions arn:aws:sns:us-east-1:123456789:alerts
Q110. How do you estimate the total cost of an AgentCore deployment?
Answer: Sum across components:
Runtime: sessions/month x avg duration x (vCPU rate + memory rate)
Gateway: tool calls/month x $0.005/1K + search calls x $0.025/1K
Memory: events x $0.25/1K + records x $0.75/1K/month + retrievals x $0.50/1K
Identity: Usually free (via Runtime/Gateway)
Policy: Authorization checks x $0.000025
Observability: CloudWatch rates (often the biggest line item)
Model inference: Billed separately through Bedrock
Example: A prototype chatbot (10K sessions/month) costs ~$43/month in AgentCore fees. A production agent (50K sessions/month) costs ~$500-600/month before model inference.
Section 10 — Scenario-Based & System Design (Q111-Q115)
Q111. Design an enterprise document processing system on AgentCore.
Answer:
Architecture — Supervisor pattern with three specialists:
Invoice agent: Extracts line items, totals, vendor info using Code Interpreter for OCR. Tools: Textract via Gateway, calculator, database writer.
Contract agent: Identifies key clauses, dates, obligations using KB for legal templates.
Compliance agent: Validates extracted data against regulatory rules via Lambda rule engine.
Memory: Semantic strategy tracks vendor histories. Summary condenses processing logs for audit.
Guardrails: Cedar policies filter PII (SSN, account numbers). Prompt injection detection on document content.
Observability: End-to-end tracing from document arrival to data storage. Custom evaluator checks extraction accuracy.
Estimated cost: ~$800/month for 100K documents.
Q112. Design a real-time financial trading assistant on AgentCore.
Answer:
Network isolation: Runtime in private VPC via PrivateLink. All APIs through VPC endpoints.
Agent: Single Strands agent with tools for market data, portfolio analysis, order preview (not execution — human-in-the-loop).
Guardrails: Forbid order-execution API (human-only). Suppress PII. Require disclaimer on investment advice.
Identity: Cognito JWT + OAuth2 to brokerage APIs with token vault.
Compliance: CloudTrail audit, KMS encryption, HIPAA-eligible config. All policy evaluations logged for SEC/FINRA.
Cost optimization: 2-minute session timeout, Gateway caching for market data.
Q113. Design an AgentCore-based coding assistant for a development team.
Answer:
Managed Harness with microVM per developer session. Claude Opus for complex reasoning, Sonnet for simple queries.
Tools: Code Interpreter, Browser, Gateway tools (GitHub API, Jira API, KB for internal docs).
Memory: Semantic (coding preferences), Summary (past debugging sessions), Episodic (successful resolution patterns).
Identity: Okta SSO, GitHub tokens vaulted for OAuth pass-through.
Guardrails: Suppress API keys/credentials, detect prompt injection in code, block file access outside project directory.
Estimated cost: ~$42.50/month for Memory, ~$0.0007 per session for Runtime, $500-1,000/month model inference for a 10-person team.
Q114. Design a multi-tenant SaaS agent platform on AgentCore.
Answer:
Tenant isolation: Separate Memory resource (namespace scoped to tenant ID), Gateway with tenant-specific Cedar policies, IAM roles with tenant-scoped permissions.
Agent customization: Tenants configure via management API — system prompt, tool selection, guardrail strength, model selection.
Tool marketplace: Agent Registry catalogs available tools. Gateway enforces per-tenant tool access.
Billing: Per-tenant cost tracking via OTEL spans tagged with tenant ID.
Security: Tenant data never crosses boundaries. VPC isolation for enterprise tenants. KMS per-tenant keys.
Q115. Compare AgentCore with Google Vertex AI and Azure Agent365 for enterprise deployment.
Answer:
AWS AgentCore: Serverless Runtime + composable services. Pay-per-second (~$0.0007/session). Widest framework support. Cedar policy engine. Best for AWS-native enterprises and regulated industries.
Google Vertex AI / ADK: Agent Engine + ADK open-source SDK. Free tier + usage pricing. ADK, LangChain, MCP, LiteLLM. Model Armor for prompt injection. Best for developer-first, rapid prototyping.
Microsoft Agent365: Control plane + Copilot Studio. $30/user/month or Copilot Credits. MCP, A2A, Microsoft Agent Framework. Adaptive access controls and DLP. Best for Microsoft 365 organizations and multi-vendor governance.
Frequently Asked Questions
Is Bedrock Agents being discontinued?
The original service is rebranded as “Bedrock Agents Classic” and enters maintenance mode on July 30, 2026 — no new customers, no new features. Existing agents continue to work but should be migrated to AgentCore. AWS provides an Import-Agent toolkit and estimates 2-4 weeks for lift-and-shift migration.
Do I need to use Strands to build agents on AgentCore?
No. AgentCore is framework-agnostic — it supports Strands, LangGraph, CrewAI, LlamaIndex, ADK, and OpenAI Agents SDK. Any framework that runs in a Docker container works. Strands has the deepest integration, but it’s not required.
Can AgentCore agents use non-AWS models?
Yes. Via Strands: Anthropic API, OpenAI (via LiteLLM), Meta’s Llama API, or local models via Ollama. You pay only for AgentCore infrastructure — model costs are billed by the respective provider.
How much does it cost to run a simple chatbot on AgentCore?
A prototype (10K sessions/month) costs ~$43/month in AgentCore infrastructure. With Claude Sonnet 5 for inference (2K input + 1K output tokens per session), model costs add ~$200/month. Total: ~$243/month.
Is AgentCore HIPAA-compliant?
AgentCore inherits Bedrock’s compliance certifications including HIPAA eligibility. Sign a BAA with AWS, use customer-managed KMS keys, deploy with VPC isolation, and configure Cedar guardrails for PII filtering.
Key Takeaways
- AgentCore replaces Bedrock Agents Classic — seven independently deployable services. Classic enters maintenance July 30, 2026.
- Framework-agnostic and model-agnostic — supports Strands, LangGraph, CrewAI, LlamaIndex, ADK, OpenAI Agents.
- Strands Agents SDK is AWS’s open-source framework — model-driven agents in a few lines of Python. Powers Amazon Q Developer.
- The Gateway is a managed MCP server — protocol translation, auth pass-through, rate limiting, and policy enforcement.
- Memory has two layers: short-term events and long-term extracted records (semantic, summary, user-preference). No separate vector database needed.
- Cedar policy engine evaluates every tool call in real time — content filtering, prompt injection detection, PII redaction.
- Pricing is consumption-based: Runtime ~$0.0895/vCPU-hour, Gateway ~$0.005/1K invocations, Memory ~$0.25-0.75/1K events.
- Multi-agent patterns: supervisor, swarm, hierarchical, and graph topologies with isolated Runtimes.
- OpenTelemetry observability with distributed tracing, cost attribution, and third-party integration.
- Compliance-ready: SOC, ISO, HIPAA-eligible, PCI DSS, FedRAMP. VPC isolation, KMS encryption, CloudTrail audit.
For related interview prep, see our LangGraph Interview Questions, Google ADK Interview Questions, Claude & Anthropic Interview Questions, and the AgentCore Enterprise Platform Guide.
