AWS Builds Production-Ready Autonomous Agents with Spring AI and Bedrock AgentCore
Summary:AWS has published a production-oriented reference implementation for building autonomous agents in Java with Spring AI and Amazon Bedrock AgentCore. The samples cover tool calling, conversational and long-term memory, resilience, deterministic rules, multi-agent routing, and deployment through Terraform and an ARM64 container. The architecture separates application-level Spring components from model- and framework-agnostic AgentCore services for runtime, memory, browser automation, code executi
AWS has published a production-oriented reference implementation for building autonomous agents in Java with Spring AI and Amazon Bedrock AgentCore. It covers model interaction, tool execution, memory, resilience, multi-agent orchestration, and cloud deployment without introducing a new foundation model. The main objective is to bring runtime management, identity, memory, and governance into an existing Spring engineering stack.
The repository contains two systems: a single-agent travel assistant demonstrating tool calling, Server-Sent Events, and conversational memory; and an IDP application that routes documents to five specialist agents for legal, mortgage, insurance, tax, and general processing. A deterministic rules engine then sends flagged documents to alerts or human review. Both applications use Spring Boot 4.1, Spring AI 2.0, and spring-ai-agentcore 2.0.
Mapping agent capabilities to Spring
The implementation identifies three core agent capabilities: planning, tool use, and memory. Spring AI's ChatClient handles model interaction, @Tool exposes Java methods as callable functions, and advisors enrich requests with memory or safety context before they reach the model. Structured responses are mapped to Java records.
Tool execution follows a model–tool–model loop. Tool definitions are included in the model context, the model returns a function name and structured arguments, Spring AI binds and invokes the method locally, and the result is returned to the model for further reasoning. External APIs, databases, and code-execution environments must therefore be treated as untrusted execution boundaries. Tool descriptions should state parameter constraints, idempotency, and side effects, while high-impact actions should not rely solely on model discretion.
There is also a practical streaming distinction. A plain text response can be streamed directly, but workflows involving multi-argument tool calls should first use a blocking call() so arguments bind reliably, then chunk the final result. This sacrifices some first-token responsiveness in exchange for deterministic tool execution.
AgentCore runtime and memory
@AgentCoreInvocation maps a Spring method to AgentCore Runtime's POST /invocations and GET /ping contract, including JSON handling, SSE framing, and health reporting. The health endpoint returns either Healthy or HealthyBusy; a long-running operation must report the busy state so the managed runtime does not scale it down while work remains.
AgentCore Memory integrates through Spring AI's advisor mechanism. Short-term memory maintains context within a session, while long-term memory asynchronously extracts semantic facts, user preferences, summaries, and episodic interactions. Asynchronous extraction avoids blocking responses, but it also creates visibility delays, risks persisting incorrect facts, and introduces data-retention costs.
Memory isolation must rely on a trusted server-side identity. The example uses an actor:session namespace, but the actor should be derived from a verified OAuth 2.0 or JWT identity rather than a client-supplied session identifier.
Multi-agent coordination patterns
The IDP system uses router, evaluator, and optional parallel fan-out patterns. The router classifies and dispatches requests without owning domain logic. The evaluator applies deterministic policies after specialist agents return their findings. Parallel fan-out runs multiple specialists concurrently, making overall wall-clock latency approximately bounded by the slowest individual call rather than the sum of all calls.
The in-process rules engine evaluates SpEL expressions and supports INFO, WARN, ALERT, and BLOCK levels. Alert delivery can be replaced through a pluggable service, while BLOCK routes a document to manual review. Separating probabilistic extraction from deterministic business policy is an important design choice: the model identifies candidate fields, while auditable rules determine operational consequences.
The SpEL evaluator is not a durable workflow engine such as AWS Step Functions. It works well for low-latency, relatively stateless checks, but long-running approvals, compensation, cross-service state, and durable retries still require an external orchestration system.
Engineering trade-offs
The applications are stateless, infrastructure settings are externalized, and a single ARM64 image is promoted unchanged through CI/CD. This supports both AgentCore Runtime and an optional Amazon EKS deployment through IAM Roles for Service Accounts. AgentCore can scale to zero, although foundation-model token usage remains the main variable cost.
Resilience4j adds exponential-backoff retries, circuit breaking, and timeouts, including handling for HTTP 429 quota responses. Production teams must distinguish idempotent reads from side-effecting writes: automatic retries are safe for reads only when operations are idempotent or protected by idempotency keys.
Security is split across identity, authorization, runtime, and content controls. AgentCore Runtime uses IAM authentication by default, while user-facing services should add a JWT authorizer such as Amazon Cognito. The execution role should be restricted to ECR access, scoped Bedrock calls, logging, and a specific memory resource. The sample's in-process GuardrailService is only a placeholder; production deployments should always apply Amazon Bedrock Guardrails to model requests instead of relying on a per-request client toggle.
Micrometer, structured JSON logging, and Prometheus metrics provide a useful observability foundation. However, the guide explicitly leaves distributed trace sampling and the automated evaluation feedback loop unimplemented. In other words, the telemetry interfaces exist, but the repository does not yet demonstrate a mature regression system for promoting prompt, model, tool, or routing changes.
Deployment and evaluation considerations
Terraform provisions ECR, IAM resources, and AgentCore Runtime. CI builds a linux/arm64 container and pushes it under an immutable tag. Kubernetes teams can deploy the same image to Amazon EKS and use IRSA for scoped pod credentials.
The guide verifies structured output with Claude Sonnet 4.5, but Spring AI's record-schema approach is best-effort. Other model families may return outputs that violate the schema. High-stakes extraction should therefore combine native schema enforcement, Java Bean Validation, bounded retries, and sampled human review rather than relying on prompt instructions alone.
No comparable end-to-end figures for latency, token cost, tool success rate, classification accuracy, or human-review rate are provided. Before production adoption, teams should measure tool-argument correctness, end-to-end task success, cost and latency per successful task, and safety-violation interception rate. For Java organizations, the central value is not leaving the Spring ecosystem; it is treating an agent as a governed distributed execution system with identity boundaries, resilient state handling, observability, and release gates.
— END —Source: AWS Machine Learning Blog (2026-11-12)
Tags: #Amazon Bedrock AgentCore #Spring AI #Java Agents #Multi-Agent Orchestration #Tool Calling
Editorial & Fact-Checking Note: This article is compiled from primary research, official release documentation, and source papers by the ZICQ Newsroom pipeline with automated entity verification and human editorial review. If you notice any technical inaccuracy, please submit a correction via our corrections policy or email our editorial desk directly.
Community Comments