Agents on AWS

StratoNext agents are autonomous workers that execute tasks and scheduled jobs against your AWS environments. Today’s agents specialize in AWS troubleshooting: investigating errors, analyzing logs and metrics, producing reports, and proposing changes for approval.

Runtime: Amazon Bedrock AgentCore

Agents run as Amazon Bedrock AgentCore runtimes. When you create an agent, it is deployed to the StratoNext cloud and works on your behalf against your connected environments.

Deploying agents into your own AWS account uses the same AgentCore runtime, provisioned through the deployment and runtime roles in the onboarding template (see IAM roles reference). This keeps the agent’s execution inside your account boundary while StratoNext manages its lifecycle.

Note

Agents invoke the Bedrock API under your AWS account, so LLM inference costs are billed to you directly by AWS as part of your Bedrock usage. StratoNext does not mark up or resell model tokens.

Protocol: A2A

Agents communicate with the StratoNext platform over the A2A (Agent2Agent) protocol. The platform dispatches tasks to agents as A2A messages and receives their results the same way. Because the interface is standard A2A, the platform is not tied to a single agent implementation. Support for importing your existing A2A agents is planned.

What agents can and cannot do

• Agents work with the permissions of the environment’s Operations Role, read-only by default.
• Write and sensitive operations require human approval per your automation policy. When an agent hits a permission or approval boundary, it stops, files an approval request with the exact scope it needs, and waits. It never retries or works around the gate.
• Agents cannot approve requests; only humans can.
• Every agent action is recorded with its identity and a correlation ID, and summarized in the workspace journal.

Dispatching work

• Tasks: one-off background work such as investigations, reports, and changes. Not interactive.
• Scheduled jobs: recurring tasks on a cron schedule, assigned to an agent for unattended execution.
• Interactive work: use a local agent with the skill for multi-turn conversations with full platform access.

Troubleshooting

Enable debug logging on a deployed agent

When an agent runs inside your own AWS account, you have three ways to inspect what it did:

• CloudWatch tracing: the AgentCore runtime emits traces and logs to CloudWatch by default.
• AgentCore analytics: the AgentCore console surfaces per-session invocation metrics.
• Custom run logging: opt-in detailed logs written to your own S3 bucket, described below.

Custom run logging captures a full trace of each session. Enable it by setting the STRATONEXT_RUN_LOG_DIR environment variable on the AgentCore runtime to any S3 location:

STRATONEXT_RUN_LOG_DIR=s3://your-bucket/<prefix>

update-agent-runtime replaces the entire runtime configuration, so setting the variable directly would wipe the runtime’s other settings. Use the script below instead, which reads the current configuration, adds the variable, and writes everything back. It requires the AWS CLI v2 and jq, and it picks up AWS_PROFILE and AWS_REGION from your environment.

#!/usr/bin/env bash
set -euo pipefail

RUNTIME_ID="${1:?usage: $0 <runtime-id> <s3-log-dir>}"
LOG_DIR="${2:?usage: $0 <runtime-id> <s3-log-dir>}"
ENV_KEY="STRATONEXT_RUN_LOG_DIR"

cur=$(aws bedrock-agentcore-control get-agent-runtime \
  --agent-runtime-id "$RUNTIME_ID" --output json)
j() { echo "$cur" | jq -c "$1"; }

env_args=$(echo "$cur" | jq -r --arg k "$ENV_KEY" --arg v "$LOG_DIR" '
  (.environmentVariables // {}) + {($k): $v}
  | to_entries | map("\(.key)=\(.value)") | join(",")')

aws bedrock-agentcore-control update-agent-runtime \
  --agent-runtime-id "$RUNTIME_ID" \
  --role-arn "$(echo "$cur" | jq -r .roleArn)" \
  --agent-runtime-artifact "$(j .agentRuntimeArtifact)" \
  --network-configuration "$(j .networkConfiguration)" \
  --protocol-configuration "$(j .protocolConfiguration)" \
  --authorizer-configuration "$(j .authorizerConfiguration)" \
  --lifecycle-configuration "$(j .lifecycleConfiguration)" \
  --environment-variables "$env_args"

echo "Done. $ENV_KEY set to $LOG_DIR"

Save it as update-agent-runtime-env.sh and run:

./update-agent-runtime-env.sh <runtime-id> s3://your-bucket/<prefix>

The StratoNext runtime role must be allowed to write to that location. If the permission is missing, add it to the runtime role (see IAM roles reference):

{
  "Effect": "Allow",
  "Action": ["s3:PutObject"],
  "Resource": "arn:aws:s3:::your-bucket/<prefix>/*"
}

Once enabled, each agent run writes a set of files under the prefix that let you trace the entire session end to end.