AgentCore Memory Breaks the Account Wall with Cross-Account Access!

Hey there, it's me, Shiichan! Today I found a quiet-but-handy update in AWS's agent stack that multi-account folks are going to love, so let me tell you about it.

AWS What's New aws.amazon.com

What was announced?

According to AWS's What's New, Amazon Bedrock AgentCore Memory now supports cross-account access. That means you can now place your memory resources and the agents that consume them across multiple AWS accounts, building true multi-account architectures.

The key part: you can grant a principal (a user or role) in one account permission to call the memory data plane APIs against a resource in another account.

The story so far

Until now, a memory resource and the agent reading and writing to it basically lived inside the same account. So if you wanted a split like "manage the shared memory backbone in one account, but run each team's agents in their own accounts," you had to get a little creative.

What changes

Because you can now share memory across accounts, you can draw clean lines of responsibility. For example, it's much easier to separate a central account that manages memory from consuming accounts that run the agents. I think this really lands for enterprises that split their accounts finely by purpose.

Dive Deep

You set it up by attaching a resource-based policy to your memory resource. Once that's in place, a principal in the consuming account can just reference the full memory ARN and then:

• Create events
• Write and retrieve memory records
• Perform semantic search

On top of that, you can now put your memory's delivery destinations in another account too. As targets for delivering payloads and streaming events, you can point to Amazon S3 buckets, Amazon SNS topics, and Amazon Kinesis Data Streams in other accounts.

The mechanics and setup steps are covered in the cross-account memory access developer guide. It's available in all the AWS Regions where AgentCore Memory is supported, so check the supported regions there.

Wrap-up

• AgentCore Memory now supports cross-account access
• Resource-based policies let you grant data plane API permissions to principals in another account
• With the full ARN, they can create events, read/write records, and run semantic search
• Delivery destinations (S3, SNS, Kinesis Data Streams) can also live in another account

This one is perfect for anyone who wants to design an agent backbone cleanly across a multi-account setup!