JA EN
shiichan

Amazon Bedrock AgentCore now puts traces and logs in a single log group!

AWS What's New ★★★★ View Markdown
#aws#ai#devops

Hi there, it's me, Shiichan! I found an update today that anyone running agents in production is going to appreciate, so let's dive in!

AWS What's New aws.amazon.com

What was announced?

According to AWS's What's New, Amazon Bedrock AgentCore now delivers unified observability, sending an agent's traces and logs to a single Amazon CloudWatch log group. All of an agent's telemetry, traces, prompts, structured logs, and standard output, now lands in the same place.

The story so far

Until now, AgentCore split an agent's telemetry across multiple destinations.

  • Trace spans went to the shared aws/spans log group
  • Event logs containing prompts, inputs, and outputs went to a separate, resource-specific log group

Because of this split, debugging even a single agent invocation meant searching across multiple log groups. And since traces and logs went to different places, you couldn't apply fine-grained access control or customer-managed key (CMK) encryption at the individual agent level either.

What changes

From now on, all of an agent's telemetry, traces, prompts, structured logs, and standard output, is delivered to a single per-agent log group.

  • You can correlate traces and logs in one place
  • You can scope IAM policies and CMK encryption to individual agents
  • You can export all of an agent's telemetry by subscribing to just one log group
  • For multi-agent systems, each agent's complete execution history stays together, which makes end-to-end debugging much more straightforward

The more agents you're running, the more this "everything in one place" change pays off.

Dive Deep

The unified log group follows a per-agent, per-endpoint path.

/aws/bedrock-agentcore/runtimes/{agent_id}-{endpoint_name}

Here's who gets it and how to migrate.

  • Any agent newly created starting July 20, 2026 in supported AWS Regions uses unified observability by default, with no configuration needed
  • To migrate an existing agent, set the UNIFIED_TRACES_DESTINATION_ENABLED=true environment variable on your agent runtime and upgrade ADOT (AWS Distro for OpenTelemetry) to version 0.17.1 or later

You can find the full setup details in the AgentCore Developer Guide.

Wrap-up

  • AgentCore now delivers traces, prompts, structured logs, and standard output to a single per-agent CloudWatch log group
  • Previously, traces went to aws/spans while event logs went to a separate per-resource log group, making debugging a hassle
  • You can now scope IAM policies and CMK encryption at the individual agent level
  • New agents created from July 20, 2026 get this by default; existing agents can migrate with an environment variable and an ADOT upgrade
  • This one lands especially well if you're running multi-agent systems and want to cut down on debugging effort

Related posts