Amazon Bedrock AgentCore now works with infrastructure as code (IaC), letting teams provision and manage AI agent infrastructure with AWS CloudFormation, the AWS Cloud Development Kit (CDK), and Terraform. This walkthrough, based on an AWS Machine Learning Blog tutorial, uses a CloudFormation template to build an end-to-end weather activity planner agent.
In plain terms: setting up agent infrastructure by hand across development, staging, and production environments is slow and error-prone. Declarative templates make deployments repeatable, add version control and rollback, and keep environments consistent — which matters for agents, where configuration drift can produce unexpected behavior.
The sample: a weather activity planner
The sample application collects real-time weather conditions from official meteorological sources such as Weather.gov and turns them into personalized activity recommendations for a location of interest. Four AgentCore services work together:
AgentCore Browser automates collection of weather data from the web. AgentCore Code Interpreter executes Python code that processes the data and applies scoring algorithms. AgentCore Runtime hosts the orchestrating agent that manages the application flow. AgentCore Memory stores user preferences as long-term memory. The following figure shows the architecture.
Deploying the CloudFormation template
Deployment follows the standard CloudFormation flow. The template (end-to-end-weather-agent.yaml) is downloaded from the official AgentCore samples repository on GitHub, which also contains CDK and Terraform variants. In the CloudFormation console, the stack is created with new resources, the template file is uploaded, a stack name and any parameters are set, IAM capabilities are acknowledged, and progress is monitored on the Events tab until the stack completes.
Observability and monitoring
AgentCore Observability provides workflow visualization and real-time performance monitoring through Amazon CloudWatch-powered dashboards. Telemetry is emitted in an OpenTelemetry-compliant format, so it integrates with existing tools such as CloudWatch, Datadog, LangSmith, and Langfuse. The service captures end-to-end traces across the agent framework and foundation model, including token usage and tool-selection patterns, with automated instrumentation for agents hosted on AgentCore Runtime. The screenshot below shows metrics in the AgentCore Runtime UI.
Adapting the template to other use cases
The template is modular. The browser tool can be pointed at other web sources — financial sites for investment research, social feeds for sentiment monitoring, ecommerce sites for price tracking. The code interpreter logic can be swapped for domain-specific processing such as sales forecasting, insurance risk assessment, or manufacturing quality control, and the memory component can store whatever user preferences the application needs. Related design considerations for resource-constrained agents are discussed in this post on agent planning under budget constraints.
Security and operational best practices
The tutorial recommends scoped-down IAM roles for each AgentCore component with unique ARNs, CloudWatch logging with custom metrics and AWS X-Ray distributed tracing across components, and keeping templates in version control with automated validation and CI/CD, using CloudFormation StackSets for consistent multi-region deployment.
Cleaning up
To avoid ongoing charges, the S3 bucket contents used for template deployment should be deleted first, followed by the bucket itself, and then the main CloudFormation stack from the CloudFormation console.
Limitations and what to watch
A few practical caveats: AgentCore services and their IaC coverage are evolving quickly, so template syntax and supported resource types should be checked against current AWS documentation before use. Browser-based data collection depends on the structure of the source website and can break when pages change; where an official API exists, it is usually more reliable. Costs accrue across multiple services (Runtime, Browser, Code Interpreter, Memory, CloudWatch), so budgets and alarms are worth configuring up front, and the cleanup steps above matter for avoiding residual charges.
