AWS just handed platform teams a new attack surface and called it an enterprise feature. AgentCore runtime instances now GA are persistent, AWSmanaged EC2 runtimes for Bedrock agents that support GPUs, multiagent collaboration, and session lifetimes up to 14 days across regions including useast1, useast2, uswest2, apsouth1, apsoutheast1, apsoutheast2, apnortheast1, eucentral1, and euwest1. That convenience is powerful, and if you treat these like ephemeral Lambdas you will be surprised by how quickly they become security and cost problems.
The new trust boundary
Runtime instances move agent execution from ephemeral request handlers into longrunning managed compute. Practically that means:
- Agents can hold state in memory across interactions for up to 14 days and collaborate with other agents in shared sessions. That's fantastic for complex workflows where context persistence matters.
- GPUs are supported, so heavy model inference and vector operations can run inside the runtime rather than being proxied to a separate inference endpoint.
- AWS runs the EC2 instances; but because these runtimes act like services, they need the same treatment as your microservices: hardened IAM roles, egress controls, secret scoping, and audit logging.
This is the right call from AWS the alternative was teams building adhoc credential injection and longrunning VM hacks around shortlived APIs. But it also shifts responsibility: platform teams must now build guardrails for longlived agents, not just shortlived functions.
What you need to rethink now
-
IAM and least privilege: AgentCore supports multiagent collaboration and access to Bedrock endpoints. Make roles finegrained and use session policies or scoped credentials for runtime actions. Consider principal-based cost allocation for Bedrock endpoints so you can treat billing principals as an operational signal, not just accounting noise.
-
Network egress and segmentation: Longrunning runtimes increase the attack surface for data exfiltration. Enforce egress restrictions, use VPCstyle controls where available, and require private endpoints for downstream services where possible.
-
Observability and auditing: Trace agent interactions as you would service calls. Instrument agent actions, add syscall and network telemetry where feasible, and bake retention and forensic hooks into your incident runbooks.
-
Secrets and state: Dont let agents hold broad credentials long term. Move to shortlived secrets and persession tokens; treat runtime storage as ephemeral unless you intentionally persist to a managed store.
The rest of the week: bandwidth, vectors, and distro refreshes
Two other operational updates matter for platform teams.
-
Lambda outbound bandwidth for functions not in a VPC now scales with configured memory, giving substantially higher network throughput at larger memory sizes. The takeaway: if you need streaming or heavy fanout, allocate more memory and account for the cost and concurrency implications.
-
Amazon DynamoDB introduced builtin vector search and has moved it into general availability in many regions, including commercial and GovCloud partitions. That makes DynamoDB a practical option for embedding indexes closely coupled to application data, but watch write throughput, index maintenance, and cost per query when comparing to specialized vector stores. This pairs naturally with Bedrock inference see how Bedrock's agent and model family work have been evolving in our previous coverage Amazon Bedrock: Sol/Terra/Luna model family, crossRegion inference, and AgentCore runtime updates.
-
EKS Anywhere v0.26.1 bundles refreshed EKS Distro builds aligned to recent upstream Kubernetes releases (1.36, 1.35, 1.34) and updates core components such as the AWS IAM authenticator integration and CoreDNS. If you run onprem EKS, this patch wave is about aligning to upstream fixes test your node image and IAM integration pipelines.
A few smaller but notable items: Bedrock now exposes more constrained, securityfocused model options for governed use cases; certain GPT-style models received price adjustments; and Amazon Corretto shipped a recent critical security update affecting common Java runtimes patch your images promptly.
Final thought
AgentCore runtime instances are the watershed moment: agents stop being a clientside convenience and become firstclass, stateful services in your cloud estate. AWS made the right bet making longrunning, GPUbacked agent runtimes easy to consume now the software engineering cost moves to platform teams. If you don't treat these runtimes as services (with networking, IAM, auditing, and capacity controls), they'll be the next source of production outages and confusing bills. Expect governance tooling and agentaware network policy to become a standard line item in 2027 budgets.
Sources
- AWS News Blog – Amazon Bedrock & AgentCore announcements
- AgentCore runtime instances are now generally available
- AWS Weekly Roundup: AWS Heroes Summit, Web Search on Amazon Bedrock, Dogwood, Kiro Crew, and more (August 10, 2026)
- AWS Weekly Roundup: EC2 application status checks, IAM role manager, OpenAI Daybreak on Bedrock, and more (August 17, 2026)
- Amazon DynamoDB now supports real-time vector search
- Amazon Corretto August 2026 Critical Security Patch Update
- Releases · aws/eks-anywhere
- EKS Distro releases
- Artificial Intelligence – AWS News Blog (Bedrock and GPT pricing updates)