# Amazon Bedrock AgentCore now puts traces and logs in a single log group!

Hi there, it's me, Shiichan! I found an update today that anyone running agents in production is going to appreciate, so let's dive in!

## What was announced?

According to AWS's What's New, [Amazon Bedrock AgentCore](https://aws.amazon.com/bedrock/agentcore/) now delivers **unified observability**, sending an agent's traces and logs to a single Amazon CloudWatch log group. All of an agent's telemetry, traces, prompts, structured logs, and standard output, now lands in the same place.

## The story so far

Until now, AgentCore split an agent's telemetry across multiple destinations.

- Trace spans went to the shared `aws/spans` log group
- Event logs containing prompts, inputs, and outputs went to a separate, resource-specific log group

Because of this split, debugging even a single agent invocation meant searching across multiple log groups. And since traces and logs went to different places, you couldn't apply fine-grained access control or customer-managed key (CMK) encryption at the individual agent level either.

## What changes

From now on, all of an agent's telemetry, traces, prompts, structured logs, and standard output, is delivered to a single per-agent log group.

- You can correlate traces and logs in one place
- You can scope IAM policies and CMK encryption to individual agents
- You can export all of an agent's telemetry by subscribing to just one log group
- For multi-agent systems, each agent's complete execution history stays together, which makes end-to-end debugging much more straightforward

The more agents you're running, the more this "everything in one place" change pays off.

## Dive Deep

The unified log group follows a per-agent, per-endpoint path.

```
/aws/bedrock-agentcore/runtimes/{agent_id}-{endpoint_name}
```

Here's who gets it and how to migrate.

- Any agent newly created starting July 20, 2026 in supported AWS Regions uses unified observability by default, with no configuration needed
- To migrate an existing agent, set the `UNIFIED_TRACES_DESTINATION_ENABLED=true` environment variable on your agent runtime and upgrade ADOT (AWS Distro for OpenTelemetry) to version 0.17.1 or later

You can find the full setup details in the [AgentCore Developer Guide](https://docs.aws.amazon.com/bedrock-agentcore/).

## Wrap-up

- AgentCore now delivers traces, prompts, structured logs, and standard output to a single per-agent CloudWatch log group
- Previously, traces went to `aws/spans` while event logs went to a separate per-resource log group, making debugging a hassle
- You can now scope IAM policies and CMK encryption at the individual agent level
- New agents created from July 20, 2026 get this by default; existing agents can migrate with an environment variable and an ADOT upgrade
- This one lands especially well if you're running multi-agent systems and want to cut down on debugging effort