Change
911b225
911b225dac5086c1563192ed6e23bb00a000712e · commit on GitHub
aws-blog-feed: changed (603409 bytes, HTTP 200)
raw/aws-blog-feed/response.xml modified
- Source
- aws-blog-feed
- Lines added
- +4,043
- Lines removed
- -4,366
- Stored bytes at this commit
- 603,409
- Timestamp
- observed
- Raw artifact at this commit
- raw/aws-blog-feed/response.xml
Recorded headers
| observed_at | 2026-09-04T04:34:57.741Z |
|---|---|
| origin_date | null |
| status | 200 |
| final URL | https://aws.amazon.com/blogs/machine-learning/feed/ |
| etag | null |
| last-modified | Thu, 03 Sep 2026 22:47:36 GMT |
| date | Fri, 04 Sep 2026 04:34:57 GMT |
| age | null |
| cache-control | null |
| cf-cache-status | null |
| content-encoding | null |
| content-length | null |
@
@@ -5,7 +5,7 @@ <atom:link href="https://aws.amazon.com/blogs/machine-learning/feed/" rel="self" type="application/rss+xml"/> <link>https://aws.amazon.com/blogs/machine-learning/</link> <description>Official Machine Learning Blog of Amazon Web Services</description>-
<lastBuildDate>Wed, 02 Sep 2026 21:32:10 +0000</lastBuildDate>+
<lastBuildDate>Thu, 03 Sep 2026 16:16:28 +0000</lastBuildDate> <language>en-US</language> <sy:updatePeriod> hourly </sy:updatePeriod>@
@@ -13,256 +13,215 @@ 1 </sy:updateFrequency> <item>-
<title>Accessing OpenAI models on Amazon Bedrock from Australia with global cross-Region inference</title>-
<link>https://aws.amazon.com/blogs/machine-learning/accessing-openai-gpt-5-6-models-on-amazon-bedrock-from-australia-with-global-cross-region-inference/</link>+
<title>AI-driven development lifecycle using Amazon Bedrock AgentCore</title>+
<link>https://aws.amazon.com/blogs/machine-learning/ai-driven-development-lifecycle-using-amazon-bedrock-agentcore/</link> -
<dc:creator><![CDATA[Frank Huang]]></dc:creator>-
<pubDate>Wed, 02 Sep 2026 21:22:05 +0000</pubDate>-
<category><![CDATA[Amazon Bedrock]]></category>-
<category><![CDATA[Announcements]]></category>-
<category><![CDATA[Intermediate (200)]]></category>-
<guid isPermaLink="false">262427adeddcaf49102f989ea5bfb8332e685f6c</guid>+
<dc:creator><![CDATA[Arghya Banerjee]]></dc:creator>+
<pubDate>Thu, 03 Sep 2026 16:16:28 +0000</pubDate>+
<category><![CDATA[Advanced (300)]]></category>+
<category><![CDATA[Amazon Bedrock AgentCore]]></category>+
<category><![CDATA[Technical How-to]]></category>+
<guid isPermaLink="false">7f13f4ae79bd6cd66b1556e1c750bffc4bbd385e</guid>-
<description>Australian teams can now access OpenAI GPT-5.6 Sol, Terra, and Luna models on Amazon Bedrock with global cross-Region inference from the Asia Pacific (Sydney) and Asia Pacific (Melbourne) Regions. This post shows how to invoke the models, use prompt caching, set up Codex with OpenI…-
<content:encoded><p>Australian teams working with OpenAI models can now access the latest OpenAI models through Amazon Bedrock. Amazon Bedrock offers OpenAI <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html" target="_blank" rel="noope…-
<p>In this post, we show you how to use prompt caching to optimize your inference cost, set up Codex with OpenID Connect (OIDC)-based authentication, and monitor usage with Amazon CloudWatch and Coding Agent Insights.</p> -
<h2 id="gpt-5.6-global-inference-profiles">GPT-5.6 global inference profiles</h2> -
<p>The following table lists the three global profile IDs and the Australian source Regions covered in this post.</p> -
<table border="1px" width="100%" cellpadding="10px"> -
<tbody> -
<tr> -
<td><strong>Global inference profiles</strong></td> -
<td><strong>Source Regions</strong></td> -
<td><strong>Destination Regions</strong></td> -
</tr> -
<tr> -
<td>global.openai.gpt-5.6-sol global.openai.gpt-5.6-terra global.openai.gpt-5.6-luna</td> -
<td>Asia Pacific (Sydney) ap-southeast-2 Asia Pacific (Melbourne) ap-southeast-4</td> -
<td>Routes to supported commercial AWS Regions</td> -
</tr> -
</tbody> -
</table> -
<p>Profile membership and model availability can change. Check <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference-support.html" target="_blank" rel="noopener">Cross-Region inference support</a> before deployment.</p> -
<h2 id="getting-started">Getting started</h2> -
<p>Before proceeding with this section, you can follow the <a href="https://aws.amazon.com/blogs/machine-learning/introducing-cross-region-inference-for-openai-gpt-5-6-models-on-amazon-bedrock/" target="_blank" rel="noopener">GPT-5.6</a> blog post to set up the following prerequisi…+
<description>Engineering teams adopting the AI-Driven Development Lifecycle (AI-DLC) often struggle to turn concepts into working code. This post walks through two reference implementations on Amazon Bedrock AgentCore, Kiro, and Claude Code: an SQL-to-ER-diagram generator and a multi-agent code…+
<content:encoded><p>Engineering teams adopting the AI-Driven Development Lifecycle (AI-DLC) with <a href="https://aws.amazon.com/bedrock/agentcore/" target="_blank" rel="noopener">Amazon Bedrock AgentCore</a> and coding agents like <a href="https://kiro.dev/" target="_…+
<p>This post walks through the architecture, design decisions, and key code patterns behind two reference implementations that demonstrate AI-DLC construction phase patterns using Amazon Bedrock AgentCore, Kiro, and local agentic coding tools. The first generates Mermaid entity relationship di…+
<h2 id="ai-dlc-construction-patterns-in-practice">AI-DLC construction patterns in practice</h2> +
<p>The AI-DLC construction phase positions AI to propose architecture, generate implementation plans, produce code, and create deployment artifacts, with team members providing clarification on technical decisions in real time. The implementations described here map directly to this pattern:&l…<ul> -
<li>An AWS account with Asia Pacific (Sydney) or Asia Pacific (Melbourne) enabled as your source Region.</li> -
<li>If your organization uses service control policy (SCP), verify that the SCP allows the GPT-5.6 global inference profiles in the selected source Region.</li> -
<li>An AWS Identity and Access Management (IAM) role or user with proper permissions to invoke the GPT-5.6 inference profiles.</li> -
<li>Python 3.9 or later with the <code>openai</code>, <code>boto3</code>, and <code>aws-bedrock-token-generator</code> packages installed.</li> +
<li><strong>Automated artifact generation</strong>: An agent receives structured input (SQL schema files), creates a detailed plan, generates output (Mermaid ER diagrams), and stores results for human review.</li> +
<li><strong>Continuous code quality enforcement</strong>: A multi-agent system analyzes code pushed through continuous integration and continuous delivery (CI/CD) pipelines, producing security assessments, Common Vulnerabilities and Exposures (CVE) checks, and policy compliance re…</ul> -
<p>In the following section, we show you how to verify the active global inference profiles with both the AWS Command Line Interface (AWS CLI) and the Amazon Bedrock console.</p> -
<p><strong>Using the AWS CLI.</strong> The following commands list the active GPT-5.6 profiles and inspect the Terra profile from the Sydney Region. You can also use the commands with Sol or Luna by changing the inference profile ID. To run the same check from Melbourne Region, rep…-
<div class="hide-language"> -
<pre><code class="language-bash">aws bedrock list-inference-profiles \-
--region ap-southeast-2 \-
--type-equals SYSTEM_DEFINED \-
--query "inferenceProfileSummaries[?contains(inferenceProfileId, 'openai.gpt-5.6')].[inferenceProfileId,status]" \-
--output table-
-
aws bedrock get-inference-profile \-
--region ap-southeast-2 \-
--inference-profile-identifier global.openai.gpt-5.6-terra</code></pre> -
</div> -
<p><strong>Using the Amazon Bedrock console.</strong> Open the Amazon Bedrock console, select Sydney or Melbourne as your Region and choose Inference profiles under Infer, and filter for Global OpenAI GPT-5.6 Terra. The following screenshot shows the active profile from the Sydney …+
<p>Both systems share a common architectural foundation built on AgentCore, demonstrating how teams can compose AI-driven workflows from modular, manageable components.</p> +
<h2 id="solution-1-sql-schema-to-er-diagram-generation">Solution 1: SQL schema to ER diagram generation</h2> +
<p>This AWS Samples project auto-generates Mermaid ER diagrams from SQL schema files using an agentic AI workflow on Amazon Bedrock AgentCore. After SQL code is checked in by developers, the Amazon Simple Storage Service (Amazon S3) trigger and AWS Lambda function-based workflow invokes the Ag…+
<h3 id="business-challenge">Business challenge</h3> +
<p>Database teams managing evolving SQL schemas need current entity relationship documentation. Manual creation of ER diagrams is time-intensive and documentation frequently drifts from the actual schema. When schema changes land through pull requests, teams need updated diagrams without addin…+
<h3 id="architecture">Architecture</h3> +
<p>The system uses a serverless, event-driven architecture with the following components:</p> <div style="width: 810px" class="wp-caption alignnone">-
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/08/31/ML-21760-1.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/08/31/ML-21760-1.png" alt="Amazon Bedrock inferenc…-
<p class="wp-caption-text">Figure 1: The active GPT-5.6 Terra global inference profile in Sydney</p>-
</div> -
<h3 id="invoke-gpt-5.6-through-amazon-bedrock-runtime">Invoke GPT-5.6 through Amazon Bedrock Runtime</h3> -
<p>GPT-5.6 supports three access paths on the Amazon Bedrock Runtime endpoint: the OpenAI Responses API, OpenAI Chat Completions API, and Amazon Bedrock Converse API. The OpenAI-compatible APIs are called on the <code>/openai/v1</code> paths of this endpoint rather than through the…-
<p><strong>OpenAI Responses API.</strong> For applications that already use the OpenAI SDK with the Responses API, you can point the client at the Regional Amazon Bedrock Runtime endpoint.</p> -
<div class="hide-language"> -
<pre><code class="language-python">from aws_bedrock_token_generator import provide_token-
from openai import OpenAI-
-
region = "ap-southeast-2" # Use "ap-southeast-4" for Melbourne.-
model_id = "global.openai.gpt-5.6-terra"-
prompt = (-
"In three short bullet points, explain how Availability Zones "-
"help make an AWS application highly available."-
)-
-
openai_client = OpenAI(-
base_url=f"https://bedrock-runtime.{region}.amazonaws.com/openai/v1",-
api_key=provide_token(region=region),-
)-
-
responses_result = openai_client.responses.create(-
model=model_id,-
input=prompt,-
max_output_tokens=300,-
)-
-
print(responses_result.output_text)</code></pre> -
</div> -
<p>For streaming output, set <code>stream=True</code> and iterate over the response events. The following example prints text as it arrives:</p> -
<div class="hide-language"> -
<pre><code class="language-python">response_stream = openai_client.responses.create(-
model=model_id,-
input=prompt,-
max_output_tokens=300,-
stream=True,-
)-
-
for event in response_stream:-
if event.type == "response.output_text.delta":-
print(event.delta, end="", flush=True)</code></pre> -
</div> -
<p><strong>OpenAI Chat Completions API.</strong> You can also work with the Chat Completions API if your application already uses that.</p> -
<div class="hide-language"> -
<pre><code class="language-python">from aws_bedrock_token_generator import provide_token-
from openai import OpenAI-
-
region = "ap-southeast-2" # Use "ap-southeast-4" for Melbourne.-
model_id = "global.openai.gpt-5.6-terra"-
prompt = (-
"In three short bullet points, explain how Availability Zones "-
"help make an AWS application highly available."-
)-
-
openai_client = OpenAI(-
base_url=f"https://bedrock-runtime.{region}.amazonaws.com/openai/v1",-
api_key=provide_token(region=region),-
)-
-
chat_result = openai_client.chat.completions.create(-
model=model_id,-
messages=[{"role": "user", "content": prompt}],-
max_completion_tokens=300,-
reasoning_effort="low",-
)-
-
print(chat_result.choices[0].message.content)</code></pre> +
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/08/31/ML-21366-1.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/08/31/ML-21366-1.png" alt="An Amazon S3 upload tri…+
<p class="wp-caption-text">Figure 1: Event-driven architecture for SQL schema to ER diagram generation</p></div> -
<p><strong>Amazon Bedrock Converse API.</strong> Use Converse API when your application calls Amazon Bedrock through an AWS SDK. Boto3 resolves credentials through the standard AWS credential chain.</p> +
<ol type="1"> +
<li><strong>S3 event trigger</strong>: SQL files uploaded to an Amazon S3 bucket trigger an AWS Lambda function that initiates the analysis workflow.</li> +
<li><strong>Authentication</strong>: Amazon Cognito provides OAuth2 machine-to-machine (M2M) authentication. Client credentials are stored in AWS Systems Manager Parameter Store.</li> +
<li><strong>AgentCore runtime</strong>: A containerized agent built with the <a href="https://github.com/strands-agents/sdk-python" target="_blank" rel="noopener">Strands framework</a> runs on AgentCore runtime. The agent uses Claude Sonnet 4 through Amazon Bedrock to …+
<li><strong>AgentCore memory</strong>: Provides persistent session context with a 90-day expiry, and supports semantic search across previous analyses and incremental schema understanding.</li> +
<li><strong>Output storage</strong>: Generated <code>.mmd</code> diagram files are saved to Amazon S3 under a dedicated prefix, with metadata tracking the source file and generation timestamp.</li> +
</ol> +
<p>The workflow proceeds as follows:</p> +
<ol type="1"> +
<li>A SQL file is uploaded to Amazon S3 (manually or through a CI/CD pipeline).</li> +
<li>The Lambda trigger reads the file content and authenticates through Cognito OAuth.</li> +
<li>The trigger invokes the AgentCore runtime agent with the SQL content as the payload.</li> +
<li>The agent analyzes the schema and identifies tables, columns, constraints, and foreign key relationships. It then generates a complete Mermaid erDiagram.</li> +
<li>The diagram is saved to Amazon S3 and the analysis session is stored in AgentCore memory.</li> +
</ol> +
<h3 id="implementation-details">Implementation details</h3> +
<p>The agent implementation uses the <code>BedrockAgentCoreApp</code> runtime wrapper with the <code>@app.entrypoint</code> decorator to register the handler:</p> <div class="hide-language"> -
<pre><code class="language-python">import boto3-
-
region = "ap-southeast-2" # Use "ap-southeast-4" for Melbourne.-
model_id = "global.openai.gpt-5.6-terra"-
prompt = (-
"In three short bullet points, explain how Availability Zones "-
"help make an AWS application highly available."-
)-
messages = [-
{-
"role": "user",-
"content": [{"text": prompt}],-
}-
]-
-
bedrock_client = boto3.client("bedrock-runtime", region_name=region)-
converse_result = bedrock_client.converse(-
modelId=model_id,-
messages=messages,-
inferenceConfig={"maxTokens": 300},-
)+
<pre><code class="language-python">from bedrock_agentcore.runtime import BedrockAgentCoreApp+
from bedrock_agentcore.memory import MemoryClient+
from strands import Agent+
from strands.models import BedrockModel-
print(converse_result["output"]["message"]["content"][0]["text"])</code></pre> -
</div> -
<p>For streaming output, use <code>converse_stream</code> with the same Region and profile ID, then iterate over the returned event stream.</p> -
<div class="hide-language"> -
<pre><code class="language-python">stream_result = bedrock_client.converse_stream(-
modelId=model_id,-
messages=messages,-
inferenceConfig={"maxTokens": 300},-
)+
app = BedrockAgentCoreApp()+
model = BedrockModel(model_id="us.anthropic.claude-sonnet-4-5-20250929-v1:0", region_name="us-west-2")+
erdiagram_agent = Agent(model=model)+
memory_client = MemoryClient(region_name="us-west-2")-
for event in stream_result["stream"]:-
if "contentBlockDelta" in event:-
delta = event["contentBlockDelta"]["delta"]-
if "text" in delta:-
print(delta["text"], end="", flush=True)-
print()</code></pre> -
</div> -
<p>The preceding examples call Amazon Bedrock in Asia Pacific (Sydney). To run the same example for Asia Pacific (Melbourne), set the Region to <code>ap-southeast-4</code> and run the code.</p> -
<h3 id="working-with-prompt-caching">Working with prompt caching</h3> -
<p>GPT-5.6 prompt caching is available through the supported APIs. GPT-5.6 supports two caching modes on Amazon Bedrock. Implicit caching is enabled by default, and no code changes are required, while with explicit caching, you can define the reusable prefix, cache boundary, and cache key. <…-
<h2 id="setting-up-codex-with-gpt-5.6-on-amazon-bedrock">Setting up Codex with GPT-5.6 on Amazon Bedrock</h2> -
<p>Codex can use the same global inference profiles through Amazon Bedrock Runtime. Install the latest Codex CLI to use the native Amazon Bedrock Runtime model provider. Here, we validated the following configuration with codex-cli 0.149.1 using GPT-5.6 Sol from Asia Pacific (Sydney).</p>…-
<div class="hide-language"> -
<pre><code class="language-bash">npm install -g @openai/codex@alpha-
codex --version</code></pre> +
@app.entrypoint+
async def generate_er_diagram(payload: Dict[str, Any]) -&gt; Dict[str, Any]:+
sql_content = payload.get("sql_content", "")+
file_name = payload.get("file_name", "unknown_file.sql")+
# Generate diagram, store in memory, save to S3+
...</code></pre> </div> -
<p>For organizations whose identity provider is Okta, Auth0, Microsoft Entra ID, Amazon Cognito, or AWS IAM Identity Center, the <a href="https://github.com/aws-samples/sample-openai-on-aws/tree/main/aws-oidc-auth" target="_blank" rel="noopener">AWS OIDC Auth Helper repository</a> …-
<div class="hide-language"> -
<pre><code class="language-ini">[profile &lt;AWS_OIDC_PROFILE&gt;]-
credential_process = &lt;ABSOLUTE_PATH_TO_CREDENTIAL_PROCESS&gt; --profile &lt;OIDC_HELPER_PROFILE&gt;-
region = ap-southeast-2-
output = json</code></pre> +
<p>Key design decisions include:</p> +
<ul> +
<li><strong>Chunked processing</strong>: Large SQL files are split into manageable segments, analyzed independently, then consolidated into a unified diagram. This handles schemas with hundreds of tables without exceeding context limits.</li> +
<li><strong>Structured prompting</strong>: The agent uses a systematic analysis prompt that extracts tables, columns, data types, primary keys, and foreign key relationships before generating diagram syntax.</li> +
<li><strong>OpenTelemetry tracing</strong>: Every step is instrumented with spans and attributes, providing observability into processing duration, chunk counts, and error attribution.</li> +
</ul> +
<p>The complete implementation, including OpenAI Codex skills and MCP server integration, is available in the sample-to-create-mermaid-entity-diagrams-from-sql-using-agentic-ai-on-agentcore <a href="https://github.com/aws-samples/sample-to-create-mermaid-entity-diagrams-from-sql-using-agent…+
<h2 id="solution-2-secure-software-handoffs">Solution 2: Secure software handoffs</h2> +
<p>This serverless code security analysis solution uses Amazon Bedrock AgentCore to automatically scan Python or Java code for security vulnerabilities, CVE risks in dependencies, and policy violations. The analysis is triggered when code is pushed from a GitLab pipeline to Amazon S3. A Strand…+
<h3 id="business-challenge-1">Business challenge</h3> +
<p>Code reviews for security compliance require specialized knowledge across CVE databases, organizational coding policies, and language-specific security patterns. Manual security reviews create bottlenecks in delivery pipelines, and inconsistent application of standards across teams leads to…+
<h3 id="architecture-1">Architecture</h3> +
<p>This solution provides automated code security analysis through a multi-agent architecture for secure software handoffs between development stages:</p> +
<div style="width: 810px" class="wp-caption alignnone">+
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/08/31/ML-21366-2.png" target="_blank" rel="noopener"><img src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/08/31/ML-21366-2.png" alt="Uploaded code is analyz…+
<p class="wp-caption-text">Figure 2: Multi-agent architecture for automated code security analysis</p></div> -
<p>This federation helper exchanges an OIDC token for temporary AWS credentials, and Codex reads through the standard AWS credential chain with no further configuration. Next, create or update <code>~/.codex/config.toml</code> and reference the AWS profile, see the <a href="http…+
<ol type="1"> +
<li>Code files are uploaded to an Amazon S3 bucket (manually or through a CI/CD pipeline). An AWS Lambda trigger detects new uploads and initiates the AgentCore analysis workflow with OAuth2 authentication.</li> +
<li><strong>AgentCore Gateway with MCP tools</strong>: The gateway orchestrates calls to external tool integrations: +
<ol type="a"> +
<li><strong>Policy Check Lambda</strong>: Validates code against organization-specific security policies.</li> +
<li><strong>CVE Database Check Lambda</strong>: Scans dependency files for known vulnerabilities.</li> +
</ol> </li> +
<li><strong>AgentCore runtime (Strands framework)</strong>: The core analysis agent performs deep code review, including structure assessment, logic quality evaluation, memory and performance analysis, security issue detection, and best practices compliance.</li> +
<li><strong>AgentCore memory</strong>: Stores analysis results with semantic search capabilities, supporting historical comparison and trend analysis.</li> +
<li><strong>Dashboard Lambda</strong>: Serves a web UI that provides session-based results with search and multi-tab navigation across files, violations, and quality metrics.</li> +
</ol> +
<h3 id="key-capabilities">Key capabilities</h3> +
<ul> +
<li><strong>Multi-dimensional analysis</strong>: The system evaluates code across structural quality, algorithmic efficiency, security posture, and standards compliance. It produces a quality score with specific recommendations.</li> +
<li><strong>Memory strategies</strong>: Three distinct self-managed memory strategies serve different needs: +
<ul> +
<li><em>Semantic strategy</em>: Stores detailed code analysis findings, CVE results, and policy violations for retrieval by context.</li> +
<li><em>Summary strategy</em>: Maintains aggregated metrics and trends for dashboard visualization.</li> +
<li><em>User preference strategy</em>: Tracks dashboard layout and filter preferences across sessions.</li> +
</ul> <p>To learn more, see <a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/memory-strategies.html" target="_blank" rel="noopener">AgentCore memory strategies</a>.</p></li> +
<li><strong>MCP tool integration through AgentCore Gateway</strong>: This capability allows the agent to invoke external tools (policy checker, CVE scanner) as needed during analysis, without hardcoding tool-calling or external API logic into the agent itself.</li> +
</ul> +
<p>The analysis agent follows the same AgentCore runtime pattern as Solution 1, with the addition of MCP tool calls routed through AgentCore Gateway:</p> <div class="hide-language"> -
<pre><code class="language-toml">model = "global.openai.gpt-5.6-sol"-
model_provider = "amazon-bedrock-runtime"-
model_reasoning_effort = "high"+
<pre><code class="language-python">from bedrock_agentcore.runtime import BedrockAgentCoreApp+
from bedrock_agentcore.memory import AgentCoreMemory+
from strands import Agent+
from strands.models import BedrockModel-
[model_providers.amazon-bedrock-runtime.aws]-
profile = "&lt;AWS_OIDC_PROFILE&gt;"-
region = "ap-southeast-2"</code></pre> -
</div> -
<p>If the helper doesn’t have a valid cached session, it opens the configured sign-in page in your browser. After you authenticate, the helper returns temporary AWS credentials through <code>credential_process</code>. Requests are signed with AWS SigV4, so no API key is involved in…-
<h2 id="quota-management">Quota management</h2> -
<p>GPT-5.6 on-demand quotas are measured in requests per minute (RPM) and tokens per minute (TPM). Token burndown determines how each request consumes TPM. Token consumption is calculated from input tokens, cache-write input tokens, and output tokens multiplied by the model’s <a href="https…-
<h2 id="monitoring-and-logging">Monitoring and logging</h2> -
<p>Because GPT-5.6 requests use the Amazon Bedrock Runtime API, requests made through the global inference profiles appear in <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" rel="noopener">model invocation logging</a> lik…-
<p>CloudWatch <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" rel="noopener">Coding Agent Insights</a> provides a dashboard for Codex telemetry, including token usage, API requests, active users, conversation activity, an…-
<p>The following example shows how to configure the Coding Agent Insights for Codex using the Bearer approach. First, <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-OTLP-MetricsBearerTokenAuth.html" target="_blank" rel="noopener">get a CloudWatch metri…-
<div class="hide-language"> -
<pre><code class="language-toml">[otel]-
environment = "production"+
app = BedrockAgentCoreApp()+
model = BedrockModel(model_id="us.anthropic.claude-sonnet-4-5-20250929-v1:0", region_name="us-west-2")+
analysis_agent = Agent(model=model, tools=[analyze_code, check_quality])+
memory = AgentCoreMemory(namespace="code-analysis")-
[otel.metrics_exporter]-
otlp-http = { endpoint = "https://monitoring.ap-southeast-2.amazonaws.com/v1/metrics", protocol = "binary", headers = { "Authorization" = "Bearer YOUR_CLOUDWATCH_METRICS_API_KEY" } }</code></pre> -
</div> -
<p>Replace <code>YOUR_CLOUDWATCH_METRICS_API_KEY</code> with the key created in CloudWatch, then start Codex. This CloudWatch metrics API key can then authorize the export to the Regional CloudWatch endpoint. After telemetry arrives, open the CloudWatch console in Asia Pacific (Syd…-
<div style="width: 810px" class="wp-caption alignnone">-
<a href="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/08/31/ML-21760-2.png" target="_blank" rel="noopener"><img title="Codex usage in CloudWatch Coding Agent Insights" src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59…-
<p class="wp-caption-text">Figure 2: Codex token and request activity in CloudWatch Coding Agent Insights in Asia Pacific (Sydney)</p>+
@app.entrypoint+
async def analyze_uploaded_code(payload: Dict[str, Any]) -&gt; Dict[str, Any]:+
file_content = payload.get("file_content", "")+
file_name = payload.get("file_name", "unknown.py")+
session_id = payload.get("session_id", "")+
# Analyze code, store results in memory, return quality score+
...</code></pre> </div> -
<p>To populate the Organization, Environment, Department, Cost Center, Location, Team, and User filters, provide the corresponding values through <code>OTEL_RESOURCE_ATTRIBUTES</code>. AWS classifies that CloudWatch metric API key as a long-term credential and recommends it only wh…-
<p>For organizations that federate developer identity through corporate single sign-on, we recommend using the enterprise rollout, where a local collector signs the export with SigV4 using the developer’s federated credentials and no token is distributed.</p> +
<p>The agent receives code content from the AWS Lambda trigger, performs multi-dimensional analysis using the foundation model (FM), then invokes external tools (policy checker, CVE scanner) through AgentCore Gateway as needed. Results are persisted to AgentCore memory for dashboard retrieval …+
<p>Key design decisions include:</p> +
<ul> +
<li>Multi-agent separation: The code analysis agent focuses solely on quality assessment. Policy checking and CVE scanning are delegated to dedicated AWS Lambda functions invoked through AgentCore Gateway, keeping each component single-purpose and independently updatable.</li> +
<li>Session-based result persistence: Each analysis run creates a unique session in AgentCore memory. The dashboard retrieves results by session ID, allowing developers to compare quality scores across multiple code submissions.</li> +
<li>Gateway-mediated tool invocation: External tools are registered through AgentCore Gateway using MCP rather than direct invocation. This decouples the agent from tool implementation details and allows new tools to be added without modifying agent code.</li> +
</ul> +
<p>The complete implementation is available in the sample-agentic-secure-software-handoffs <a href="https://github.com/aws-samples/sample-agentic-secure-software-handoffs" target="_blank" rel="noopener">repository</a>.</p> +
<h2 id="integrating-local-agentic-tools-kiro-openai-chatgpt-codex-and-claude-code">Integrating local agentic tools: Kiro, OpenAI ChatGPT Codex and Claude Code</h2> +
<p>While AgentCore provides the cloud runtime for deployed, event-driven agent workloads, the development workflow itself benefits from local agentic tools that implement AI-DLC patterns at the developer’s workstation.</p> +
<h3 id="kiro-agents-and-skills">Kiro agents and skills</h3> +
<p><a href="https://kiro.dev" target="_blank" rel="noopener">Kiro</a> supports the AI-DLC inception and construction phases through structured specifications and custom agent skills:</p> +
<ul> +
<li><strong>Spec-driven development</strong>: Kiro transforms natural language requirements into structured specifications with acceptance criteria, then generates implementation plans from those specifications. This maps directly to the AI-DLC pattern of AI creating plans and see…+
<li><strong>Custom skills</strong>: Teams can define reusable Kiro <a href="https://kiro.dev/docs/skills/" target="_blank" rel="noopener">agent skills</a> that encode organizational standards (coding patterns, security requirements, architectural guidelines), so that A…+
<li><strong>Agentic task execution</strong>: Kiro’s agent mode handles multi-file implementation tasks with autonomous tool use (file creation, terminal commands, search) while maintaining the human-in-the-loop review at each specification checkpoint.</li> +
</ul> +
<h3 id="openai-chatgpt-codex-mcp-server-and-skills">OpenAI ChatGPT Codex (MCP server and skills)</h3> +
<p>The repository also includes an OpenAI Codex integration that demonstrates how the same ER diagram generation workflow extends to additional coding agents through MCP and custom skills:</p> +
<ul> +
<li><strong>MCP server for live database schema access</strong>: A local stdio-based MCP server connects Codex to MySQL or Amazon Aurora MySQL databases through <code>INFORMATION_SCHEMA</code>. The server exposes three tools (<code>schema_summary</code>, &l…+
<li><strong>Custom Codex skill</strong>: A <code>SKILL.md</code> file encodes the ER diagram generation workflow as a reusable Codex skill, guiding the agent through schema analysis and diagram creation with consistent quality.</li> +
<li><strong>Secure credential management</strong>: Database credentials are retrieved from AWS Secrets Manager with TLS verification enforced, following the same security patterns used in the AgentCore implementation.</li> +
</ul> +
<h3 id="claude-code-local-agent">Claude Code (local agent)</h3> +
<p>Claude Code operates as a local command-line agent that complements AgentCore deployments:</p> +
<ul> +
<li><strong>Rapid prototyping</strong>: Before deploying to AgentCore runtime, developers use Claude Code to iterate on agent logic, test prompts, and validate tool integration patterns locally.</li> +
<li><strong>Infrastructure-as-code generation</strong>: Claude Code generates deployment scripts, Dockerfiles, AWS Identity and Access Management (IAM) policies, and AWS CloudFormation templates. These artifacts follow architectural specifications produced during the AI-DLC constr…+
<li><strong>Code review and refactoring</strong>: Local agents perform first-pass reviews against project rules and custom instructions, catching issues before code enters the CI/CD pipeline where the secure software handoff system provides the authoritative security analysis.<…+
</ul> +
<h3 id="the-combined-workflow">The combined workflow</h3> +
<p>A typical AI-DLC bolt (short, intense work cycle) using these tools follows this pattern:</p> +
<ol type="1"> +
<li><strong>Inception</strong> (Kiro): Transform business requirements into specifications with acceptance criteria. The team validates AI-generated specs in a mob elaboration session.</li> +
<li><strong>Construction</strong> (Claude Code and Kiro): Generate implementation code, deployment scripts, and test suites. Local agents handle file generation and iterative refinement while Kiro manages task orchestration.</li> +
<li><strong>Validation</strong> (AgentCore): Code pushed through CI/CD triggers automated security analysis. The multi-agent system provides a quality assessment before merge.</li> +
<li><strong>Operations</strong> (AgentCore): Production agents (like the ER diagram generator) run continuously on AgentCore runtime, triggered by events, processing workloads at scale with full observability.</li> +
</ol> +
<h2 id="best-practices">Best practices</h2> +
<p>Based on implementing these systems, we recommend the following practices:</p> +
<ul> +
<li><strong>Separate agent concerns</strong>: Design each agent with a single, well-defined responsibility. The ER diagram agent only generates ER diagrams. Composability comes from orchestration, not from overloading individual agents.</li> +
<li><strong>Use AgentCore memory for context continuity</strong>: Persistent memory allows agents to learn from previous interactions, compare current analysis with historical baselines, and maintain state across sessions without reprocessing.</li> +
<li><strong>Instrument with OpenTelemetry from day one</strong>: Tracing provides visibility into agent behavior, processing duration, and failure modes. This is essential for debugging prompt effectiveness and identifying performance bottlenecks.</li> +
<li><strong>Store configuration in Parameter Store</strong>: Decouple configuration from code. Cognito credentials, memory IDs, model selections, and bucket names should all be retrievable at runtime.</li> +
<li><strong>Implement chunked processing for large inputs</strong>: Design agents to handle inputs that exceed model context windows by splitting, analyzing independently, and consolidating results.</li> +
<li><strong>Secure with Cognito M2M authentication</strong>: Use OAuth2 client credentials flow for service-to-service communication. Avoid hardcoded credentials or long-lived tokens.</li> +
<li><strong>Integrate through CI/CD, not manual upload</strong>: In production, connect agents to repository events (merge requests, pipeline stages) rather than requiring manual file uploads. The S3 trigger pattern shown here translates directly to GitLab webhook or GitHub Action…+
<li><strong>Apply Amazon Bedrock Guardrails for production agent outputs:</strong> Configure content filtering policies, denied topic detection, and grounding validation to make sure agent-generated responses meet responsible AI standards. For code analysis agents, guardrails can …+
</ul> <h2 id="conclusion">Conclusion</h2> -
<p>In this post, we showed how to discover and invoke the GPT-5.6 Sol, Terra, and Luna global inference profiles from Asia Pacific (Sydney) and Asia Pacific (Melbourne) Regions. We also introduced how to configure Codex to use Amazon Bedrock Runtime and export Codex telemetry to CloudWatch Cod…-
<p>To get started, follow the examples in this post and test GPT-5.6 models in your account. If you are using Codex, you can configure the <a href="https://aws.amazon.com/bedrock/" target="_blank" rel="noopener">Amazon Bedrock Runtime</a> provider and enable CloudWatch Coding Agent…+
<p>The AI-DLC methodology becomes practical when backed by concrete implementation patterns. Amazon Bedrock AgentCore provides the runtime infrastructure (containerized agents, persistent memory, secure gateways, and external tool integration) while local tools like Kiro and Claude Code accele…+
<p>Start with the <code>SQL-to-ER-Diagram</code> sample to deploy your first AgentCore agent. Follow the deployment scripts in sequence, then extend the pattern with multi-agent coordination, MCP tool integrations, and CI/CD-driven triggers using the Secure software handoffs sample…+
<p>To go deeper, see <a href="https://aws.amazon.com/blogs/machine-learning/move-your-ai-agents-from-proof-of-concept-to-production-with-amazon-bedrock-agentcore/" target="_blank" rel="noopener">Move your AI agents from proof of concept to production with Amazon Bedrock AgentCore</a&g…<hr style="width: 100%"> <h2>About the authors</h2> <footer> <div class="blog-author-box"> <div class="blog-author-image"> -
<p><img loading="lazy" class="alignleft size-full" src="https://d2908q01vomqb2.cloudfront.net/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59/2026/08/31/ML-21760-3.jpeg" alt="Frank Huang" width="100" height="100"></p> -
</div> -
<h3 class="lb-h4">Frank Huang</h3> -
<p>Frank Huang, PhD, is a Senior AI/ML Specialist Solutions Architect at AWS based in Auckland, New Zealand. He focuses on helping customers deliver AI/ML solutions. Throughout his career, Frank has worked across a variety of industries such as financial services, Web3, hospitality, media an…-
</div> -
<div class="blog-author-box"> Diff display stops at 400 lines. The line counts above are from the whole diff. 46 lines shown here cut at 300 characters. The raw artifact at this commit is linked above.