Meenu and the five souls of AgentCore
- Raji Krishnamoorthy
- 2 days ago
- 15 min read
A tale from the Land of Amazonia
Study time
Ten-year-old Meenu lay sprawled on the soft grass inside the lush, gated community of Emerald Springs. With her mischievous eyes, and a braid that had given up on staying tidy, she lay down on the grass, to consider her next bit of trouble.
source : Midjourney
Beside her sat her older cousin Aparna, pushing her thick glasses up her nose for the hundredth time. Aparna was a Cloud Intern at a big law firm in Chennai, and at that moment she was losing a slow, grinding war against her AWS Certified AI Practitioner exam.
"Listen to this, Meenu," Aparna said, reading from her big fat book. Her voice came out flat as a dial tone. "'To build a scalable reasoning AI agent, one must integrate memory, session-based permissions, and event-driven invocation using …..'"
"BORING," Meenu announced, flinging both hands over her face. "Aparna, your book sounds like the instructions for a washing machine. A sad washing machine."
"It's technology, Meenu." Aparna snapped the book shut with a sigh that could have powered a small fan. "It's supposed to be dry and serious."
Meenu bolted upright, eyes flashing. "No, it isn't! Where I go, Amazon Bedrock can walk. AWS Lambda runs faster than the wind. The S3 buckets never, ever stop chattering, and the Databases laugh out loud when you tell them a good joke!"
Aparna blinked. "What sort of world is that? Have you completely lost it?"
Meenu lay back on the cool earth and closed her eyes, smiling like she knew a secret the whole grown-up world had forgotten. "Yes. That's exactly how it works in my land of Amazonia."
"Right. Officially lost it." Aparna stood, brushed off her jeans, and marched toward the house.
"Wait Aparna, wait, I'll prove it!" Meenu scrambled up and tore after her cousin.
She never made it. Her foot caught the edge of a sinkhole that absolutely had not been there a moment ago, and the ground simply gave up holding her. Down she went. Down and down and down, through a darkness, until she landed at the bottom with a soft, surprised thud.
Frightened and bruised, Meenu burst into tears. But these were no ordinary tears. Each one fell fat and shining as a marble, and within seconds they had pooled into a pond, then a lake.
She grabbed a passing log just as the lake became a roaring river, and the river swept her out into a vast, glittering ocean. The waves carried her, rocked her, and at last laid her gently on a shore where she drifted into sleep.
Welcome to Amazonia
Meenu woke with sand in her hair. The sand glowed a warm, electric orange, the color of the vast thick Amazonia forest.
She had barely stood up before a frantic clank-clank-clank made her jump. A small robot with a polished monocle was power-walking across the dunes, checking a golden pocket watch and muttering at it.
source : Midjourney
"Excuse me!" Meenu called. "Who are you, and why are you in such a tizzy?"
The little robot screeched to a halt, gears whirring in alarm. “My name is Lambda! Full name, AWS Lambda, and I have been alive for fourteen minutes and thirty-seven seconds, which means I have twenty-three seconds to get us to the Stone Table before I stop being real. RUN!” And off he scurried, monocle gleaming, before she could ask anything.
"The Stone Table?" Meenu whispered to herself.
"Oh, you'll want to see that, dearie!" chirped a voice. A plump, bucket-shaped robot waddled up beside her, lovingly polishing a pebble as though it were a jewel. "My name is S3, full name, Amazon S3. I keep things. Everything, really. Come along you mustn't miss it!". His pebble disappeared into a slot in his side, as naturally as breathing.
The Crisis at the Arena
The forest opened into a clearing, and Meenu stopped. Rising from the orange sand was a colossal amphitheatre, grown entirely from shimmering glass. It sang faintly when the wind moved through it
Hundreds of robots crowded the tiers around the great Stone Table at its heart.
Suddenly, storm clouds boiled up out of nowhere. A magnificent glowing bird named Garuda came screaming down from the dark, dropped a golden Vintage Parchment Scroll with Wooden Ends onto the Stone Table, and vanished.
A loud robot with a megaphone for a head clanked forward. AWS SNS, the others whispered. He is our announcer.
"ATTENTION, AMAZONIA!" SNS boomed. "A crisis upon Planet Earth! An enterprise has built a support system with a set of AWS Lambda functions and REST APIs that do things like looking up a ticket, checking an order, opening a refund. And now they wish to set a reasoning agent, an AI that decides which of those tools to call, and in what order, to carry a customer's trouble from start to finish."
The crowd gasped all at once.
SNS raised a metal hand for silence. "But to run in production, that agent must satisfy five sacred requirements!"
One. Preserve memory across interactions, so a returning customer never starts from zero.
Two. Share the relevant agent state across sessions and even across agents so the right context is always where it is needed.
Three. Wake up when something happens on its own, and also answer the moment a person asks.
Four. Enforce access control and session-based permissions, so each user reaches only what they may, and each session stands alone.
Five. Be the most scalable approach of all, with no infrastructure to manage.
The Squad Awakens
The ground rumbled. From the deepest shadows of the Arena, a single sleek, robot glided into the light. It broke apart into five shining beings.
"We are the answer," said the robot. "Amazon Bedrock AgentCore. We run AI agents securely, at scale. We are beautifully modular."
Five robots stepped into the orange light, and Meenu leaned forward, breath held.
The first was tall and calm, with little glowing doors all over its body that opened and closed like blinking eyes. "AgentCore Runtime," it said, bowing. "I am the innkeeper. Every guest gets a private room, sealed tight. When the guest leaves, poof — I burn the room down and sweep the ashes. I do not do roommates."
The second was two robots wearing one chassis. The top half held a chalkboard; the bottom half lugged an enormous leather-bound ledger. "We are Memory!" they said, not quite together. "I'm the short bit . I write down the conversation itself, every turn, as it happens," said the chalkboard half. "And I'm the long bit," sighed the ledger, "I remember things you'd frankly prefer I forgot."
The third wore a tool belt jangling with universal adapters and handed Meenu a tiny business card she hadn't asked for. "AgentCore Gateway," it purred. "I speak Lambda. I speak REST. I translate them all into one tongue the agent understands. I never write code. I merely describe, and the doors open."
The fourth was built like a nightclub bouncer, complete with a velvet rope, a clipboard and, bolted to its side, a small iron safe. "AgentCore Identity," it grunted, arms folded. "Token, please. No token, no entry."
The fifth had a hundred eyes and an enormous diary into which it was already scribbling. "AgentCore Observability," it whispered, delighted. "I see everything. And I write it all down. Don't mind me."
The Arena roared. Drone-birds did loop-the-loops across the storm.
Into the Great Workshop
Amazon Bedrock AgentCore led Meenu out the back of the Arena into a place that made her gasp out loud.
It was a workshop the size of a cathedral. Brass pipes climbed the walls and hissed friendly little jets of steam. Far above, dust motes drifted through shafts of golden light, and somewhere a kettle was singing. It smelled of warm metal and rain.
At the center stood a single great desk with a single great computer , its screen as tall as a door, glowing soft blue.
Amazon Bedrock AgentCore Runtime walked in and pulled out a chair. "Sit, traveler. First, we wake the machine.".
Meenu sat. The screen lit. Letters bloomed across it: WORKSTATION — AMAZONIA LABS. She pressed her palm to a glowing pad and the screen chimed welcome.
"Now," said AgentCore Gateway, " the customer on Planet Earth has prepared a special door for us. Inside their AWS console, they created an IAM role with exactly the permissions we need. We assume that IAM role to work inside their console, but only in the rooms the role allows us to enter."
A new window opened. A friendly orange cube spun in the corner. AWS Management Console. Identity, the bouncer, checked the sign-in personally, grunted once in approval, and stepped back.
"We are in," AgentCore Runtime breathed. "Five steps stand between us and a saved planet. Let us begin."
Step One — A Home for the Agent
Agentcore Runtime cracked its knuckly door-panels. "Before an agent can be clever, it needs somewhere to live. Watch."
It guided Meenu's hands to the keyboard, and together they wrote a tiny incantation into a file. As each line appeared, it shimmered faintly gold.
# agent.py
from bedrock_agentcore import BedrockAgentCoreApp
app = BedrockAgentCoreApp()
@app.entrypoint
def invoke(payload):
user_message = payload.get("prompt", "")
# Here you call your model or agent framework (Strands, LangGraph etc).
reply = f"You said: {user_message}"
return {"reply": reply}
if name == "__main__":
app.run()"The little hat @app.entrypoint — that's the doorbell," AgentCore Runtime explained. "When someone calls, that is the function that answers. Now we wrap it and ship it."
Meenu typed the spells exactly as Runtime dictated:
agentcore configure --entrypoint agent.py --name support-agent
agentcore launch # add -l to try it on your own bench first"That’s it!," Runtime exclaimed. "Next, lets test it."
agentcore invoke '{"prompt": "Where is my order?"}'The screen flashed: You said: Where is my order?
"The second caller isn't a person at all. Say a parcel goes missing in a warehouse on Planet Earth at three in the morning. That event travels through a messenger , an Amazon EventBridge rule, or an AWS Lambda function and the messenger rings my very same doorbell by calling InvokeAgentRuntime.
The agent wakes, works the problem, and if the job is a long and thoughtful one, I'll happily keep the room open for hours. The same agent serves both callers, because I scale up and down on my own and never make you manage a single server."
AgentCore Runtime tapped its chest, and one of its little doors swung open to reveal a tidy, empty room, then snapped shut. "And remember: each session gets its own sealed room namely its own microVM, with its own brain and its own desk. Whatever the agent scribbles on that desk lives only as long as the room does. When the session ends, I incinerate the room and sweep the ashes clean. "
Meenu beamed and exclaimed, “The agent had a home."
Step Two — A Memory That Lasts
The two-headed Memory robot shuffled forward, chalkboard and ledger bonking together.
"A support agent with no memory," said the ledger half gravely, " is a goldfish, it forgets you the moment you walk away."
# confirm the fields against the current SDK.from bedrock_agentcore.memory import MemoryClient
memory = MemoryClient(region_name="us-east-2")
memory.create_memory_and_wait(
name="SupportAgentMemory",
strategies=[
{"userPreferenceMemoryStrategy": {"name": "preferences"}},
{"summaryMemoryStrategy": {"name": "summaries"}},
],
)"There are four flavors of long memory," the ledger explained, ticking them off with an inky finger. "One sniffs out facts. One learns a customer's preferences. One summarizes whole conversations. And one remembers what happened — the whole episode, like a diary entry of a visit. For support work, preferences and summaries are a lovely pair."
The chalkboard half added, helpfully, "And I keep the raw conversation itself — every turn, written down as an event, the moment it's spoken. Here is the trick, small human: I live outside the innkeeper's rooms. So when Runtime burns a room down, the transcript on my chalkboard survives. I keep it for a good while long enough for the agent to reread the last few turns of a chat, even across a stumble or a restart and then, when my keeping-time runs out, I wipe myself clean. Tidy!"
"Two labels make the magic work," said the ledger. "An actorId that's who the customer is and a sessionId that's which conversation we're in. Keep the sessionId steady across a chat, and I keep the chat coherent. Write down the durable little truths such as 'this customer prefers email' and I tuck them into long memory forever."
"And then?" Meenu asked.
"And then," the ledger exclaimed with pride, "when that same customer comes back next week, the agent reads my long memory first. So instead of 'Hello, who are you, what's your problem,' it says, 'Welcome back! Still preferring email, I hope?' And because I live outside any single agent's room, I am not one agent's private diary. A billing agent, an escalation agent , any of them may be pointed at this very same store and read the very same truths. One memory, shared wherever the context is needed."
Meenu clapped. "So the room dies on purpose but the conversation outlives it, and the long one remembers and shares!"
"Precisely," both halves said, finally in unision.
Step Three — Hands for the Agent
AgentCore Gateway sauntered to the desk, adapters jingling.
"Our agent can think," it said, "but right now it can't do. It can't actually check an order or open a refund. That's where I come in, Meenu. I turn the enterprise's existing tools into things the agent can simply call by name using a common language called MCP, the Model Context Protocol." It produced a small glowing portal. "First, one secure door for all tool traffic. The Gateway."
The portal shimmered to life on the console.
"Now their order-status AWS Lambda function. I don't rewrite it. I don't even touch its insides. I just point at it and describe it."
// Lambda target — just point at the function and give it a tool schema.
{
"targetType": "lambda",
"lambda": {
"functionArn": "arn:aws:lambda:us-east-2:123456789012:function:GetOrderStatus"
}
}
"And their REST API?" Gateway twirled an adapter. "I hand it the API's OpenAPI description which is the menu of everything the API can do and I turn each item on that menu into a tool the agent can pick up." It winked. "I also speak Smithy, and I happily adopt other MCP servers, but let's not show off."
Finally, Gateway aimed the agent at the glowing portal. On the floating schematic, two new tools lit up beside the agent's hand: get order status and open refund.
"Watch what happens during reasoning," Gateway said. The agent, faced with 'Where is my order?', reached out on its own and tapped get order status. Gateway caught the request, translated it into the language the Lambda understood, fired it across, and carried the answer home. "That," Gateway said, "is what I do. I carry calls to tools and bring answers back. But some tools won't speak to just anyone. They want proof that the caller is allowed in. That proof? I get it from a friend you're about to meet."
Step Four — The Doorkeeper
AgentCore Identity rolled forward, velvet rope draped over one arm, the little iron safe glinting on its back.
"Right. Listen up." It tapped its clipboard. "Anyone can want to use this agent. Not everyone gets to. First, the front door."
It set up an inbound check on the Runtime. "Two kinds of guests," it grunted. "Robots from inside the enterprise's own AWS walls, they show me an IAM SigV4 badge. People — actual humans — they sign in and hand me a JWT token, vouched for by the company's Amazon Cognito sign-in desk." Identity held up a glowing ticket stub. "No token, no entry. Simple."
"I read what's written on the token, which enterprise or which role the person belongs to and I only let the agent run if that little fact matches what's allowed. That's how we keep one customer's world walled off from another's."
"What about when the agent reaches out?" Meenu asked. "To one of the tools?"
"Glad you asked." AgentCore Identity swung the little iron safe around and patted it. "That's my vault. When the agent calls some outside service, it needs the right credentials on the user's behalf, or on its own. I manage all those sign-in formalities such as the consents, the refreshes, the rotations and I lock every token away in here. When AgentCore Gateway needs to open a far door, it comes to me, borrows the key, uses it, and hands it straight back. Gateway carries the calls; I keep the keys."
"Between Runtime's rooms and my velvet rope," AgentCore Identity exclaimed with pride, "you get real access control and real session isolation and you never have to build a security guard from scratch."
Step Five — A Hundred Watchful Eyes
Last came the quiet one. AgentCore Observability drifted to the desk, all hundred eyes blinking softly, diary already open.
"An agent you can't see," it whispered, "is a black box. And black boxes are how disasters sneak in." It did two small, separate chores at the console. First, a one-time bit of CloudWatch housekeeping. Switching on Transaction Search so traces would have somewhere to land. Then it turned to the agent itself and pinned a tiny silver brooch onto it "the OpenTelemetry instrument," it explained, "so the agent narrates its own doings as it works." The whole workshop seemed to brighten.
"Now I record it all. Every reasoning step the agent takes. Every tool it touches. Every word it trades with the model. All of it flows out in a tidy, standard form called OpenTelemetry, an open language that many monitoring tools already speak, and lands straight in CloudWatch, where you can read it like a storybook." It turned its diary toward Meenu, and there indeed was the whole adventure of a single support request, laid out trace by trace.
"And the best part," AgentCore Observability added, setting two little bells on the desk, "I'll ring these the moment something starts to wobble. Each bell can wake up a helper on its own. One can send a message through Amazon SNS to the on-call engineer. Another can fire a Lambda function that flags the conversation for human review. You'll know before a single customer ever feels it, and help will already be on the way."
"So it's completely auditable," Meenu exclaimed.
"Now you understand me well," said AgentCore Observability, and wrote that down too.
Testing
The five robots gathered behind Meenu's chair.
"Time to test it," said Amazon Bedrock. "Let us pretend to be a worried customer and see if our agent works from start to finish."
The front door. Identity stepped up first. "No token, no entry." Meenu signed in at the Cognito desk, and a glowing ticket stub dropped into her palm. This was her JWT, the proof that she was who she claimed to be. She held it up. Identity read the facts written across it, checked them against the rules, and unhooked the velvet rope. "Good token. In you go."
The question. Runtime opened a fresh, sealed room for this conversation. Meenu typed: Where is my order 1001?
The reasoning. Observability threw its hundred eyes wide and began whispering into its diary. "The agent is thinking. It is choosing a tool… ah! It reaches for get order status."
The tool call. Gateway sprang into action. It stopped at Identity's iron safe, borrowed the credentials it needed, then carried the request to the enterprise's own Lambda. The Lambda answered: Shipped by BlueDart, arriving in two days. Gateway brought the answer back, and the agent displayed it on screen. It never needed to know how the Lambda worked inside.
The memory. Meanwhile, the chalkboard half of Memory wrote the conversation down turn by turn, while the ledger half tucked away a lasting truth: this customer asked about order 1001.
The rejection. "Now for the part everyone forgets," said Identity. "What happens without a token?" Meenu slipped the glowing stub into her pocket and asked the same question. The screen flushed red. No bearer token. Entry refused. The agent would not speak to a stranger.
The audit trail. Observability turned its diary around. There was the whole request laid out as a story: the sign-in, the reasoning, the tool call, the borrowed credentials, the answer, and the rejection of the ticketless stranger. Every step timed and traced.
"That," said Amazon Bedrock gently, "is the whole secret. Five friends, working together."
The Arena erupted in a roar. The crisis on Planet Earth was over. The agent was alive, watchful, and wise. The five robots flew back together into one sleek, humming being, glowing with quiet pride. The orange sand beneath Meenu's feet began to swirl, faster and faster, glowing so bright she had to shut her eyes.
Rather fun, actually
When Meenu opened her eyes, she was lying under the giant eucalyptus tree in Emerald Springs, and Aparna was stomping back across the lawn, scowling.
"Meenu! Stop rolling around in the grass and come inside!"
Meenu sat up slowly. A single grain of glowing orange sand clung to the hem of her floral top. She flicked it off and watched it wink out.
"Okay, Aparna," she said. "But now, let's read the chapter on Amazon Bedrock AgentCore together. The one with the runtime that burns down its own rooms, the memory with two heads that outlives the fire, the diplomat who turns APIs into tools, the doorman with a safe full of keys who won't budge without a ticket, and the shy one with a hundred eyes who writes it all down."
Aparna stared at her cousin for a long, long moment.
Then she opened the heavy textbook to a fresh page, sat down on the grass beside her, and for the first time all afternoon , the girls did not find it boring at all.
The End.
Meenu walked through Amazonia so you wouldn't have to read the textbook cold. But the real experience is better than the fairy tale.
I built a hands-on lab that follows the same five steps Meenu took i.e AgentCore Runtime, Memory, Gateway, Identity, Observability except you deploy a real agent to your own AWS account.
By lab 07, you'll have a working, authenticated, observable AI agent with memory and tools , the same architecture the five robots described, running in your console instead of a glass arena.
The labs are free to follow. The AWS resources cost little for a single run-through (details in the repo). Clean up when you're done.
If Meenu can do it, you've got this.
Comments