Change
42e9060
42e9060559c03996a3a8ed9bcd55421351a8f1a7 · commit on GitHub
aws-blog-feed: changed (572316 bytes, HTTP 200)
raw/aws-blog-feed/response.xml modified
- Source
- aws-blog-feed
- Lines added
- +4,798
- Lines removed
- -4,210
- Stored bytes at this commit
- 572,316
- Timestamp
- observed
- Raw artifact at this commit
- raw/aws-blog-feed/response.xml
Recorded headers
| observed_at | 2026-10-02T05:37:33.339Z |
|---|---|
| origin_date | null |
| status | 200 |
| final URL | https://aws.amazon.com/blogs/machine-learning/feed/ |
| etag | null |
| last-modified | Thu, 01 Oct 2026 22:20:57 GMT |
| date | Fri, 02 Oct 2026 05:37:33 GMT |
| age | null |
| cache-control | null |
| cf-cache-status | null |
| content-encoding | null |
| content-length | null |
@
@@ -5,7 +5,7 @@ <atom:link href="https://aws.amazon.com/blogs/machine-learning/feed/" rel="self" type="application/rss+xml"/> <link>https://aws.amazon.com/blogs/machine-learning/</link> <description>Official Machine Learning Blog of Amazon Web Services</description>-
<lastBuildDate>Wed, 30 Sep 2026 15:37:15 +0000</lastBuildDate>+
<lastBuildDate>Thu, 01 Oct 2026 22:13:49 +0000</lastBuildDate> <language>en-US</language> <sy:updatePeriod> hourly </sy:updatePeriod>@
@@ -13,555 +13,2451 @@ 1 </sy:updateFrequency> <item>-
<title>Query claims in natural language with Amazon Bedrock Knowledge Bases</title>-
<link>https://aws.amazon.com/blogs/machine-learning/query-claims-in-natural-language-with-amazon-bedrock-knowledge-bases/</link>+
<title>Scaling cloud migrations with agentic AI on Amazon Bedrock AgentCore</title>+
<link>https://aws.amazon.com/blogs/machine-learning/scaling-cloud-migrations-with-agentic-ai-on-amazon-bedrock-agentcore/</link> -
<dc:creator><![CDATA[Shreya Pawaskar]]></dc:creator>-
<pubDate>Wed, 30 Sep 2026 15:37:15 +0000</pubDate>+
<dc:creator><![CDATA[Nikhil Jha]]></dc:creator>+
<pubDate>Thu, 01 Oct 2026 22:06:14 +0000</pubDate> <category><![CDATA[Advanced (300)]]></category>-
<category><![CDATA[Amazon Bedrock]]></category>-
<category><![CDATA[Amazon Bedrock Knowledge Bases]]></category>+
<category><![CDATA[Amazon Bedrock AgentCore]]></category> <category><![CDATA[Technical How-to]]></category>-
<guid isPermaLink="false">6f62e0665479ef5d4ffddb480328d07ce719281b</guid>+
<guid isPermaLink="false">d0376fa78aeb5acfd7edb22f7e3658ad0679a620</guid>-
<description>This technical how-to builds a conversational claims assistant on Amazon Bedrock Knowledge Bases that answers natural-language questions with citations. It covers ingesting claim documents from Amazon S3, querying with the AgenticRetrieveStream API, multi-turn follow-ups, metadata …-
<content:encoded><p>Claim answers are scattered across adjuster diary entries, repair estimates, police reports, payment ledgers, and scanned attachments rather than one searchable field. A policyholder might ask whether a claim was approved, while an adjuster might need every open a…-
<p>Retrieval Augmented Generation (RAG) uses retrieved documents to ground model responses. <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html" target="_blank" rel="noopener">Amazon Bedrock Knowledge Bases</a> is the fully managed RAG capability for d…-
<p>This technical how-to uses synthetic claim records and doesn’t describe a production customer deployment. You build a claims assistant that answers natural-language questions with citations by completing these steps:</p>+
<description>Learn how AWS Professional Services uses a multi-agent framework built on Amazon Bedrock AgentCore to automate enterprise cloud migrations end to end. Purpose-built AI agents handle discovery, infrastructure as code generation, portfolio governance, and post-migration operations, r…+
<content:encoded><p><em><strong>October 2026: This post was reviewed and updated for accuracy.</strong></em></p>+
<p>Scaling cloud migrations with agentic AI on <a href="https://aws.amazon.com/bedrock/agentcore/" target="_blank" rel="noopener">Amazon Bedrock AgentCore</a> raises a practical question. Which parts of a large migration program belong to a managed service, and which parts need cus…+
<p>This pattern runs alongside <a href="https://docs.aws.amazon.com/transform/" target="_blank" rel="noopener">AWS Transform</a> rather than in place of it, as a hybrid that adds custom agents where your program requires them. AWS Transform covers the migration and modernization wo…+
<p>AWS Professional Services builds a suite of purpose-built AI agents for programs with that requirement. The agents use the <a href="https://strandsagents.com/" target="_blank" rel="noopener">Strands Agents SDK</a> and run on Amazon Bedrock AgentCore, a platform to build, connect…+
<p>In this post, you explore the architecture of a four-agent pattern for MCP-connected environments. You also see the code that defines an agent, connects it to its tools, and applies responsible AI controls. The pattern includes four agents:</p><ul>-
<li>Ingest claim documents and their metadata from Amazon Simple Storage Service (Amazon S3).</li>-
<li>Query them in plain language with the <code>AgenticRetrieveStream</code> API.</li>-
<li>Ask multi-turn follow-up questions.</li>-
<li>Scope retrieval with metadata filters on attributes such as claim ID and claim type.</li>-
<li>Add a contextual grounding guardrail to keep answers tied to the records.</li>+
<li>The Intake Agent, which reads migration inputs from document and collaboration systems through MCP tools.</li>+
<li>The IaC Agent, which generates IaC that composes your approved internal modules.</li>+
<li>The Migration Intelligence and Governance Agent, which reports and governs inside your own program tools.</li>+
<li>The Site Reliability Engineering (SRE) Agent for operations after cutover.</li></ul>-
<h2 id="the-claims-lookup-challenge">The claims lookup challenge</h2>-
<p>Policyholders, contact center agents, and adjusters ask different questions:</p>+
<p>To follow along, you need an AWS account with access to Amazon Bedrock AgentCore and to Amazon Bedrock foundation models. You also need familiarity with the Strands Agents SDK and MCP server patterns, plus the IaC tooling used by your organization. Confirm first that an AWS managed service …+
<h2 id="when-this-pattern-applies">When this pattern applies</h2>+
<p>AWS Transform covers migration and modernization for server, network, mainframe, .NET, and application code workloads as a managed service, and AWS DMS covers databases. This pattern adds agents for the requirements that stay specific to your organization.</p>+
<p>On the program described here, three conditions held together.</p><ul>-
<li>Policyholders ask for a plain-language status update: “Has the estimate for claim CLM-100482 been approved, and when will the check be issued?”</li>-
<li>Contact center agents need a fast, accurate answer while the customer waits, without transferring the call.</li>-
<li>Adjusters ask multi-part questions across claims, such as which open auto claims over $10,000 were filed last month and what work remains on each.</li>+
<li><strong>MCP-connected sources and destinations:</strong> The systems holding the migration inputs, and the systems receiving the outputs, were reached through MCP tools that the delivery team built and maintained. They included an internal wiki holding security standards, a ti…+
<li><strong>Organization-specific IaC composition:</strong> Generated infrastructure code had to compose an internal module library that the security office reviews and approves. Writing that composition by hand took 3 to 4 weeks per application, which across a 300+ application po…+
<li><strong>Work continuing past cutover:</strong> Program scope included operations after handover, which sits outside the migration services.</li></ul>-
<p>Answers are stored in PDF adjuster reports, Word correspondence, and text notes rather than consistent database fields.</p>-
<p>Records can conflict or supersede earlier versions. A revised estimate can replace an earlier one, or a provisional payment can be reversed later. The assistant must identify which estimate, payment, or status controls.</p>-
<p>Because claims are regulated, every answer must be grounded in source documents and include citations. Contact center agents can verify a source before repeating an answer, and supervisors can audit how the assistant reached it.</p>-
<h2 id="solution-overview">Solution overview</h2>-
<p>The solution uses <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html" target="_blank" rel="noopener">Amazon Bedrock Knowledge Bases</a> to index claim documents from Amazon S3 for retrieval.</p>-
<p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-agentic-retrieve.html" target="_blank" rel="noopener">Agentic retrieval</a> through <code>AgenticRetrieveStream</code> plans an answer, breaks a multi-part question into sub-queries, and runs one o…-
<p>The API streams trace events, answer text, and citations. Trace events expose the retrieval plan, and each citation maps part of the answer to a source claim document.</p>-
<p>The following diagram shows both paths. The ingestion lane loads claim documents and metadata into a knowledge base. The retrieval lane sends each question through <code>AgenticRetrieveStream</code> and an Amazon Bedrock Guardrails grounding check before returning a cited answer…+
<h2 id="architecture-overview">Architecture overview</h2>+
<p>This pattern uses four purpose-built agents. The architecture attaches to a migration program at three points: the systems holding migration inputs, IaC composition, and operations after cutover. The pattern applies security at each of those points. The following diagram shows how the agent…<div style="width: 810px" class="wp-caption alignnone">-
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/28/ML-21629-1.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/28/ML-21629-1.png" alt="Architecture with an in…-
<p class="wp-caption-text">Figure 1: Conversational claims assistant with Amazon Bedrock Knowledge Bases</p>+
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/01/REVBLOG-1301-1-1.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/10/01/REVBLOG-1301-1-1.png" alt="How the age…+
<p class="wp-caption-text">Figure 1: How the agents connect across the migration and operations journeys through Model Context Protocol tool calling</p></div>-
<p>The ingestion lane runs as documents arrive:</p>-
<ol type="1">-
<li>Claim documents in PDF, Word, or text format land in Amazon S3 with matching metadata sidecars.</li>-
<li>An ingestion job synchronizes the S3 data source with the knowledge base as documents change.</li>-
<li>The knowledge base parses, chunks, embeds, and indexes the documents and their metadata in managed vector storage.</li>-
</ol>-
<p>The retrieval lane runs for each question:</p>-
<ol start="4" type="1">-
<li>The application calls <code>AgenticRetrieveStream</code> with the question, conversation history, and optional metadata filters that scope the search.</li>-
<li>A foundation model creates sub-queries and repeats retrieval until it has enough evidence, up to maxAgentIteration rounds.</li>-
<li>A contextual grounding check blocks answers that are unsupported by the retrieved records.</li>-
<li>Amazon Bedrock streams the answer, trace events, and citations, so the application can display output as it arrives.</li>-
</ol>-
<h2 id="prerequisites">Prerequisites</h2>-
<p>Before you begin, verify that you have the following:</p>+
<p>The pattern organizes agents into two journeys. The migration journey agents handle discovery through deployment. The operations journey agent handles post-migration monitoring.</p>+
<p>Migration journey agents:</p><ul>-
<li>An AWS account with AWS Identity and Access Management (IAM) permissions for Amazon Bedrock and Amazon S3.</li>-
<li>Access to a foundation model (FM) enabled through <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html" target="_blank" rel="noopener">Amazon Bedrock model access</a>.</li>-
<li>An AWS Region that supports the selected foundation model and Amazon Bedrock Knowledge Bases. This walkthrough uses US West (Oregon), us-west-2. Check <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/models-regions.html" target="_blank" rel="noopener">Supported models b…-
<li>The <a href="https://aws.amazon.com/sdk-for-python/" target="_blank" rel="noopener">AWS SDK for Python (Boto3)</a>, configured with credentials and a version that supports the APIs used here.</li>-
<li>An S3 bucket for the synthetic claim documents and metadata.</li>-
<li>Familiarity with Python and with basic RAG concepts.</li>+
<li><strong>Intake Agent (Phase 1):</strong> Reads architecture documents, questionnaires, and dependency records through MCP tools, then defines target state architecture.</li>+
<li><strong>IaC Agent (Phase 2):</strong> Generates IaC that composes your approved internal modules for each application.</li>+
<li><strong>Migration Intelligence and Governance Agent:</strong> Provides automated portfolio reporting, well-architected assessments, and governance across Jira, Confluence, and Webex.</li></ul>-
<h2 id="prepare-the-claims-documents-and-metadata">Prepare the claims documents and metadata</h2>-
<p>Store one document per claim in Amazon S3. The knowledge base reads PDF adjuster reports, Word correspondence, and text notes directly, so you can keep documents in their native format.</p>-
<p>Figure 2 shows a synthetic claim record. Current exposure is the estimated total claim cost. Its evidence index identifies a superseded fax draft, meaning a record replaced by a newer version. The metadata sidecar repeats fields that the assistant can filter.</p>-
<div style="width: 810px" class="wp-caption alignnone">-
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/28/ML-21629-2.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/09/28/ML-21629-2.png" alt="A synthetic claim recor…-
<p class="wp-caption-text">Figure 2: A synthetic claim record with its file-control fields and evidence index</p>-
</div>-
<p>For filtering, add an accompanying metadata file with the same name plus <code>.metadata.json</code>. For <code>CLM-100482.pdf</code>, use <code>CLM-100482.pdf.metadata.json</code>. Subrogation is an insurer’s effort to recover costs from a responsible th…+
<p>Operations journey agents:</p>+
<ul>+
<li><strong>SRE Agent (Phase 3):</strong> Provides monitoring and automated remediation after cutover.</li>+
</ul>+
<p>AWS managed services carry the migration and complement the custom agents:</p>+
<ul>+
<li><a href="https://docs.aws.amazon.com/dms/" target="_blank" rel="noopener">AWS Database Migration Service (AWS DMS)</a>: Generative AI-assisted schema conversion and automated cutover for database migration.</li>+
<li><a href="https://docs.aws.amazon.com/transform/" target="_blank" rel="noopener">AWS Transform</a>: Discovery, wave planning, landing zone creation, network conversion, rehost or replatform execution, and modernization for mainframe, virtualized, and .NET workloads.</li>+
</ul>+
<h3 id="how-the-components-connect">How the components connect</h3>+
<p>This section describes how the framework components interact at runtime.</p>+
<p>Each agent is a Strands agent, defined by a foundation model, a system prompt, and a set of tools. Amazon Bedrock AgentCore runtime hosts them in a serverless environment with session isolation and multi-agent orchestration. Amazon Bedrock foundation models power the reasoning that interpre…+
<p>Each agent calls MCP tools scoped to its function through <a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-quick-start.html" target="_blank" rel="noopener">AgentCore Gateway</a>, a capability of Amazon Bedrock AgentCore, which converts your APIs, AW…+
<p>Amazon Bedrock <a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/memory.html" target="_blank" rel="noopener">AgentCore memory</a> stores agent session state and shared context. Agents use this shared context to persist outputs and track migration progress ac…+
<h3 id="defining-an-agent-in-code">Defining an agent in code</h3>+
<p>The following Python example defines the IaC Agent and prepares it for Amazon Bedrock AgentCore runtime. The agent reaches your MCP tools through AgentCore Gateway, and it calls a foundation model through Amazon Bedrock with an <a href="https://docs.aws.amazon.com/bedrock/latest/userguid…+
<div class="hide-language">+
<pre><code class="language-python">+
import json+
import logging+
import os+
import uuid+
from bedrock_agentcore.runtime import BedrockAgentCoreApp+
from strands import Agent+
from strands.models import BedrockModel+
from strands.tools.mcp import MCPClient+
from strands.tools.mcp.mcp_types import MCPClientCredentials+
+
logger = logging.getLogger(__name__)+
app = BedrockAgentCoreApp()+
+
REGION = os.environ["AWS_REGION"]+
+
# url+auth lets the SDK run the client_credentials grant and re-mint the+
# token on expiry. A statically captured bearer token would go stale.+
gateway = MCPClient(+
url=os.environ["GATEWAY_MCP_URL"],+
auth=MCPClientCredentials(+
client_id=os.environ["GATEWAY_CLIENT_ID"],+
client_secret=get_secret("gateway/client_secret"),+
scopes=[os.environ["GATEWAY_SCOPE"]],+
),+
)+
+
model = BedrockModel(+
model_id=os.environ["MODEL_ID"],+
region_name=REGION,+
guardrail_id=os.environ["GUARDRAIL_ID"],+
guardrail_version=os.environ.get("GUARDRAIL_VERSION", "1"),+
guardrail_trace="enabled",+
)+
+
+
+
@app.entrypoint+
def invoke(payload, context):+
prompt = (payload.get("prompt") or "").strip()+
if not prompt:+
return {"status": "error", "error": "missing required field: prompt"}+
+
try:+
with gateway:+
# Fetch the approved policies for this wave first, so the rules+
# travel in the system prompt instead of depending on the model+
# to ask for them.+
lookup = gateway.call_tool_sync(+
tool_use_id=str(uuid.uuid4()),+
name="get_policies",+
arguments={+
"resource_types": payload.get("resource_types", []),+
"wave": payload.get("wave"),+
},+
)+
if lookup["status"] != "success":+
return {"status": "error", "error": "policy lookup failed"}+
policies = lookup.get("structuredContent", {})+
+
# tools=[gateway]: SDK owns the connection lifecycle and paginates+
# tool discovery, which list_tools_sync() alone does not.+
agent = Agent(+
model=model,+
system_prompt=(+
f"{IAC_AGENT_PROMPT}\n\n"+
f"Generated IaC satisfies these approved policies:\n"+
f"{json.dumps(policies.get('policies', []), indent=2)}"+
),+
tools=[gateway],+
)+
result = agent(prompt)+
+
if result.stop_reason == "guardrail_intervened":+
logger.warning("guardrail blocked request, session_id=%s",+
getattr(context, "session_id", None))+
return {"status": "blocked_by_guardrail"}+
+
return {+
"status": "ok",+
"iac": str(result),+
"policy_set_version": policies.get("version"),+
"waived_policies": policies.get("waived", []),+
}+
+
except Exception as e:+
logger.exception("invocation failed, session_id=%s",+
getattr(context, "session_id", None))+
return {"status": "error", "error": str(e)}+
+
+
if __name__ == "__main__":+
app.run()</code></pre>+
</div>+
<p>The entrypoint returns the generated IaC together with the policy set version that shaped it, so a reviewer traces the output back to a signed-off standard. AgentCore Runtime handles session isolation and scaling. For deployable examples, see the <a href="https://github.com/awslabs/amazo…+
<h2 id="phase-1-intake-agent-for-automated-discovery">Phase 1: Intake Agent for automated discovery</h2>+
<p>The Intake Agent reads the migration inputs that live in your document and collaboration systems. On this program, those systems were reachable through MCP tools the delivery team built and maintained.</p>+
<p>The agent ingests architecture documentation, application inventory lists, intake questionnaires, and dependency records through those tools. It then produces a target AWS architecture with a recommended migration pattern, resource sizing specifications, and a compliance validation report.&…+
<p>The output feeds directly into the IaC Agent, creating an automated handoff from intake to infrastructure provisioning.</p>+
<h2 id="phase-2-iac-agent-for-automated-infrastructure-code-generation">Phase 2: IaC Agent for automated infrastructure code generation</h2>+
<p>AWS Professional Services deployed the IaC Agent first in the portfolio, and it delivers the most immediately measurable impact. It generates IaC code adhering to your security best practices and standards.</p>+
<h3 id="how-it-works">How it works</h3>+
<p>The agent workflow proceeds through five steps:</p>+
<p><strong>Step 1: Ingest the steering document.</strong> The agent reads the steering document from the wave team. It extracts deployment scope, compliance constraints, and Security Office-approved wave-specific overrides.</p>+
<p><strong>Step 2: Interpret the target state architecture diagram.</strong> Using the Intake Agent’s output, the IaC Agent identifies infrastructure components, their relationships, and dependencies.</p>+
<p><strong>Step 3: Generate IaC.</strong> Based on this interpretation, the agent generates IaC using your defined and established patterns. It populates configurations with wave-specific parameters and configures remote state management. It then applies mandatory tagging and adds …+
<p><strong>Step 4: Validate through Policy in Amazon Bedrock AgentCore.</strong> Before execution, Policy in AgentCore evaluates each tool call against Cedar rules. It calculates the scope of potential change, checks dependency conflicts with concurrent waves, and confirms complian…+
<p><strong>Step 5: Execute and report.</strong> The centralized execution plane triggers the IaC, monitors deployment, and reports outcomes through AgentCore Observability, a capability of Amazon Bedrock AgentCore. Post-deployment validation runs automatically and compliance metric…+
<h3 id="custom-mcp-tools-the-security-foundation">Custom MCP tools: The security foundation</h3>+
<p>Each action passes through custom MCP tools exposed by Amazon Bedrock AgentCore Gateway and governed by AgentCore Identity and Policy in AgentCore. AgentCore Identity authenticates each agent action through scoped IAM roles with least-privilege access. The framework validates inputs against…+
<p>No credentials or sensitive values pass through agent context, because AgentCore Identity resolves secrets at runtime from a centralized credential provider. AgentCore Observability and AWS CloudTrail write each agent action to an immutable, centralized audit trail. <a href="https://docs…+
<h3 id="curated-organizational-policies-as-mcp-tools">Curated organizational policies as MCP tools</h3>+
<p>The security office curates the policy set, not the agent. A versioned document holds each rule, the resource types it covers, a machine-checkable assertion, and the approval record. The following example shows three policies and one wave exception.</p><div class="hide-language"> <pre><code class="language-json">{-
"metadataAttributes": {-
"claim_id": "CLM-100482",-
"claim_type": "auto",-
"status": "open",-
"date_filed": 20260709,-
"amount": 14250,-
"region": "us-west",-
"adjuster": "Martha Rivera",-
"policyholder": "Mary Major",-
"policy_number": "POL-AUTO-78432",-
"customer_id": "CUST-MM-1042",-
"household_id": "HHD-MM-1042",-
"document_type": "adjuster_report",-
"carrier": "Example Insurance",-
"has_subrogation": true,-
"has_litigation": false,-
"complexity_tier": "high"-
}-
}</code></pre>+
"policy_set": "security-office/baseline",+
"version": "2026.09.1",+
"policies": [+
{+
"id": "SEC-ENC-001",+
"applies_to": ["aws_s3_bucket", "aws_ebs_volume", "aws_rds_cluster"],+
"requirement": "Encrypt data at rest with a customer managed KMS key",+
"assertion": "kms_key_id != null and sse_algorithm == 'aws:kms'",+
"severity": "blocking",+
"source": "SecOffice/Encryption-Standard-v4"+
},+
{+
"id": "SEC-NET-014",+
"applies_to": ["aws_security_group_rule"],+
"requirement": "No ingress from 0.0.0.0/0 on administrative ports",+
"assertion": "not (cidr_blocks contains '0.0.0.0/0' and to_port in [22, 3389])",+
"severity": "blocking",+
"source": "SecOffice/Network-Standard-v7"+
},+
{+
"id": "OPS-TAG-003",+
"applies_to": ["*"],+
"requirement": "Carry owner, cost-center, data-classification, and wave tags",+
"assertion": "tags has_keys ['owner', 'cost-center', 'data-classification', 'wave']",+
"severity": "blocking",+
"source": "SecOffice/Tagging-Standard-v2"+
}+
],+
"wave_overrides": [+
{+
"wave": "wave-14",+
"policy_id": "SEC-NET-014",+
"decision": "exception",+
"expires_on": "2026-10-31",+
"approved_by": "security-office"+
}+
]+
}</code></pre></div>-
<p>The sidecar contains scalar string, number, and Boolean values. Value types determine available filters. The following table lists fields used later in the queries.</p>-
<p>This post uses synthetic data. Don’t place real personally identifiable information (PII) or protected health information in these resources without the required controls and approvals.</p>+
<p>An AWS Lambda function serves that document, and AgentCore Gateway exposes the function as an MCP tool named get_policies. The IaC Agent requests only the policies in scope for the resource types in the wave it generates.</p>+
<div class="hide-language">+
<pre><code class="language-python"> import json+
from datetime import date+
from pathlib import Path+
+
POLICY_SET = Path("policies/security-office-baseline.json")+
+
def get_policies(event, context):+
"""Return the approved policies for the requested resource types and wave.+
+
AgentCore Gateway exposes this function as the get_policies MCP tool.+
"""+
doc = json.loads(POLICY_SET.read_text())+
requested = set(event.get("resource_types") or [])+
today = date.today()+
waived = {+
o["policy_id"]+
for o in doc["wave_overrides"]+
if o["wave"] == event.get("wave")+
and date.fromisoformat(o["expires_on"]) &gt;= today+
}+
policies = [+
p for p in doc["policies"]+
if (p["applies_to"] == ["*"] or requested &amp; set(p["applies_to"]))+
and p["id"] not in waived+
]+
return {+
"version": doc["version"],+
"policies": policies,+
"waived": sorted(waived),+
}</code></pre>+
</div>+
<p>The response carries the policy set version, so generated code records which rules produced it and a reviewer traces a resource back to a signed-off standard. Waived policies travel in their own field rather than disappearing, and the compliance report lists them for the wave. Each exceptio…+
<p>Two policy layers operate here, and they answer different questions. AgentCore Policy evaluates Cedar rules to decide whether an agent calls a tool at all. The curated policy set decides what the generated infrastructure satisfies.</p>+
<h3 id="iac-generation-based-on-your-patterns">IaC generation based on your patterns</h3>+
<p>The IaC Agent generates infrastructure code based on your defined and established patterns. These patterns encode organizational standards into reusable constructs. They include network configurations, security group rules, IAM roles, <a href="https://docs.aws.amazon.com/cloudwatch/" tar…+
<p>This approach provides consistency across waves, speed for wave teams who don’t write infrastructure code from scratch, and governance where security updates propagate to consumers on their next deployment cycle.</p>+
<h3 id="output-artifacts">Output artifacts</h3>+
<p>The agent produces IaC code, automated test cases, compliance reports, and deployment runbooks for each application.</p>+
<p>The IaC Agent pushes generated code directly to your code repository (such as <a href="https://docs.aws.amazon.com/codecommit/" target="_blank" rel="noopener">AWS CodeCommit</a>, GitLab, or Bitbucket). From there, it enters your existing review and deployment pipeline without re…+
<h2 id="migration-intelligence-and-governance-agent-portfolio-wide-visibility">Migration Intelligence and Governance Agent: Portfolio-wide visibility</h2>+
<p>A 300+ application portfolio needs status reporting, progress tracking, follow-up actions, and well-architected validation. On this program, that work ran inside the customer’s own Jira, Confluence, and Webex. Performing it by hand creates significant overhead for project managers and deliv…+
<p>The Migration Intelligence and Governance Agent addresses this with automated, on-demand intelligence and governance across the portfolio. It aggregates data from three sources through AgentCore Gateway. Jira provides sprint progress and impediments. Confluence provides architecture documen…+
<p>The agent provides well-architected assessments across migrated workloads, compliance and governance validation, and architecture pattern adherence tracking.</p>+
<p>Automated actions include updating Confluence pages with latest migration status, creating Jira tasks for identified action items, and generating ServiceNow tickets for escalations. These actions require explicit human approval before execution. This approval-gated architecture is a core de…+
<p>On-demand reporting across the 300+ application portfolio replaces manual aggregation, based on internal project tracking data. Your results might vary based on portfolio size and tool integrations.</p>+
<h2 id="phase-3-sre-agent-for-proactive-post-migration-operations">Phase 3: SRE Agent for proactive post-migration operations</h2>+
<p>The SRE Agent covers the phase after handover. The migration services complete at cutover. After applications run on AWS, the SRE Agent shifts the team from reactive response to proactive improvement.</p>+
<p>The agent monitors <a href="https://docs.aws.amazon.com/cloudwatch/" target="_blank" rel="noopener">Amazon CloudWatch</a> metrics, application performance data, and historical patterns. It raises alerts before issues affect production. The agent also publishes automated remediat…+
<p>Target areas (with human-in-the-loop approval) include database cluster right-sizing, performance tuning, storage tiering, and compute scaling and efficiency improvements.</p>+
<p>The SRE Agent extends the pattern past migration. Applications don’t land on AWS and stop there. They continuously improve over time.</p>+
<h2 id="data-migration-with-aws-dms">Data migration with AWS DMS</h2>+
<p>Alongside the custom AI agents, two AWS managed services handle the data and application modernization, server and network migration layer.</p>+
<p><a href="https://docs.aws.amazon.com/dms/latest/userguide/schema-conversion-convert.databaseobjects.html" target="_blank" rel="noopener">DMS Schema Conversion with generative AI</a> reduces manual schema mapping effort. It converts code objects that rules-based conversion leaves…+
<p>AWS Transform covers the server, network, and code layers of the same program. The <a href="https://docs.aws.amazon.com/transform/latest/userguide/what-is-service.html" target="_blank" rel="noopener">AWS Transform User Guide</a> lists the current capabilities by workload type.&l…+
<h2 id="security-and-compliance-embedded-not-bolted-on">Security and compliance: Embedded, not bolted on</h2>+
<p>This architecture embeds security from the start, not as an afterthought, applying it at each phase of the migration lifecycle. Key controls across the agent suite:</p>+
<ul>+
<li><strong>Security standards enforcement:</strong> The IaC Agent pulls your security office standards directly from Confluence and applies them across generated IaC using custom MCP tools.</li>+
<li><strong>Landing zone validation:</strong> The framework validates generated infrastructure against the enterprise’s landing zone compliance requirements before deployment.</li>+
<li><strong>Human-in-the-loop approval gates:</strong> Automated actions across all agents in the suite require explicit human approval before execution. No agent acts autonomously on production systems.</li>+
<li><strong>AgentCore Gateway coordination:</strong> Amazon Bedrock AgentCore Gateway coordinates context and security controls across agents, maintaining consistent policy application throughout the migration lifecycle.</li>+
<li><strong>Continuous integration and continuous delivery (CI/CD) integration:</strong> The framework integrates security controls into the CI/CD pipeline, with automated test cases generated alongside IaC to catch compliance issues before they reach production.</li>+
<li><strong>Responsible AI controls at the inference layer:</strong> Amazon Bedrock Guardrails applies content filters, denied topics, sensitive information filters, and contextual grounding checks to each prompt and each model response. An agent acts only on output that clears th…+
</ul>+
<p>This approach aligns with the AWS shared responsibility model. AWS provides security of the underlying infrastructure, while you’re responsible for security in the cloud. The agents automate your configuration responsibilities while maintaining human oversight for approval decisions.</p&…+
<p>In this implementation, the pattern maintained enterprise security standards across the over 300 application portfolio at speeds manual processes could not match. Your results might vary based on your security requirements and organizational standards.</p>+
<h2 id="measurable-impact">Measurable impact</h2>+
<p>Across the migration program, this framework delivered the following results. These metrics reflect this specific implementation. Your results might vary based on application complexity, team size, and organizational requirements.</p>+
<ul>+
<li><strong>IaC development time reduced from weeks to minutes:</strong> from 3–4 weeks per application to minutes of automated generation (based on internal project tracking data).</li>+
<li><strong>Pattern consistency applied across waves:</strong> no wave can deviate from the approved IaC patterns baseline.</li>+
<li><strong>Security compliance:</strong> verified automatically at each deployment, with a complete audit trail requiring zero manual effort.</li>+
<li><strong>Architecture-to-deployment fidelity improved:</strong> the agent interprets the diagram, and the IaC realizes it as designed.</li>+
<li><strong>On-demand portfolio reporting</strong> across over 300 applications with precise metrics and zero manual aggregation.</li>+
<li><strong>Wave team onboarding improved:</strong> teams upload documents and the agents produce the IaC and the reports.</li>+
</ul>+
<h2 id="cost-considerations">Cost considerations</h2>+
<p>Running this pattern adds cost in a few predictable places. Foundation model tokens usually dominate, because intake and IaC generation push documents, policies, and architecture context through a model and return generated code. Amazon Bedrock AgentCore bills on consumption. Runtime charge…+
<p>Across a 300+ application portfolio the agents run for the length of the migration program rather than as a single job, so treat this as a running cost that tracks wave activity. Token volume follows document size and tool-call count more than application count, so a pilot wave gives you a …+
<h2 id="clean-up-resources">Clean up resources</h2>+
<p>To avoid ongoing charges after you finish testing the framework, remove the resources that you created:</p>+
<ul>+
<li>Delete the agents from AgentCore runtime, then remove the Gateway targets and the Gateway.</li>+
<li>Delete the AgentCore memory resources that hold session state and shared context.</li>+
<li>Delete the guardrail, the Policy in AgentCore definitions, and the IAM roles created for the agents.</li>+
<li>Delete the CloudWatch log groups that AgentCore Observability wrote to, if you no longer need the history.</li>+
<li>Delete any AWS DMS replication instances and endpoints provisioned for test migrations.</li>+
</ul>+
<p>Confirm in the Amazon Bedrock AgentCore console that no agent sessions remain active.</p>Diff display stops at 400 lines. The line counts above are from the whole diff. 42 lines shown here cut at 300 characters. The raw artifact at this commit is linked above.