End-to-end distributed tracing of agent reasoning, CloudTrail audit of every API call, and automated compliance validation with Security Hub.
You can't secure what you can't see. Amazon Bedrock AgentCore Observability exports OpenTelemetry (OTEL) traces so you can follow an agent's reasoning chain end to end.
Traces are emitted natively — no bolt-on instrumentation needed to get visibility.
Every LLM invocation, tool call, memory read/write, and policy evaluation shows up as a span.
Link user request → agent reasoning → tool execution → response into one correlated trace.
The originating call.
The agent's decision steps.
What it invoked and why.
What was returned.
Export OTEL traces to CloudWatch for dashboards and alerting. This is also where memory-poisoning anomalies (M5) become visible — an unexpected write shows up as a span you can alert on.
Tracing tells you how the agent reasoned; CloudTrail gives you the immutable record of what it did at the API level.
Every Amazon Bedrock AgentCore API call is recorded in CloudTrail for audit and forensics.
Centralize a trail across multi-account agent deployments — one place to answer "who did what."
Feed events into Security Hub for automated findings and correlation.
Correlate with the request ID. CloudTrail tells you who called the API; CloudWatch Logs captures what the agent actually did inside the session. Both carry the request ID — that's the join key that turns two separate logs into one story. Set metric filters and alarms on the log group so unexpected patterns page you instead of waiting to be discovered.
X-Amzn-Bedrock-AgentCore-Runtime-User-Id header, log the mapping between the authenticated IAM principal and that user-id value. Without it, an audit can tell you which role called the API but not which human it claimed to act for.
CreateAgentRuntime, UpdateAgentRuntime, CreateMemory. Data plane: InvokeAgentRuntime, InvokeAgentRuntimeCommand, CreateEvent, and the policy engine's AuthorizeAction. A query like "all memory writes in the last hour by agent X" — that's CreateEvent — is exactly how you investigate a suspected poisoning event from M5.
Security Hub CSPM ships seven automated controls for Amazon Bedrock AgentCore. They give you continuous posture checking — no manual audit needed to catch common misconfigurations. Two of them map to controls this course demonstrates end-to-end: BedrockAgentCore.1 (VPC runtime) and BedrockAgentCore.3 (memory CMK).
PUBLIC runtimes · HighRuntimes should use VPC network mode — fails on PUBLIC. M3
Gateways should require inbound authorization — fails when no authorizer is set. M4
Memory should be encrypted with a customer-managed KMS key. M5
Gateway should be encrypted with a customer-managed KMS key. M4
Custom browsers should not use public network mode. Tools
Custom browsers should have session recording enabled to S3. Tools
Custom code interpreters should use a private network config (not PUBLIC/SANDBOX). Tools
SOC 1/2/3, ISO 27001, and HIPAA eligibility inform which controls you must evidence.
Multi-AZ deployment and data durability considerations round out the production posture.
The payoff: a Security Hub dashboard gives you a live compliance score for your Amazon Bedrock AgentCore resources — turning "are we configured correctly?" from a quarterly audit into a continuous signal.