Building an Agent Control Plane on AWS: A High-Level Architecture

We often hear from AWS users: "Ok, we get it, you provide all the building blocks, but how do I combine all of these to build my agent control plane for all the agents, tools, and skills my organization is running, including identity, policies, discoverability, and observability?"
AWS has all the primitives we need to build a robust agent-first control plane. This post walks through the high-level architecture.

The excerpt itself is just a framing statement, not a set of checkable facts — but the underlying thesis ("AWS has all the primitives for an agent control plane") holds up well against what's actually shipped, as of August 2026:

Accurate / well-supported:

• AWS does have a fairly complete, named product answering this exact pitch: Amazon Bedrock AgentCore, which bundles runtime, gateway, identity, memory, built-in tools, observability, and evaluations, and (as of the latest release notes) policy and harness capabilities too.
• Discoverability: the AWS Agent Registry shipped in preview in April 2026, specifically pitched at letting organizations discover, share, and reuse agents, tools, and skills — directly matching the "discoverability" claim in your framing.
• Identity: AgentCore Identity plus standard IAM/CloudTrail integration is real and documented, including for agent-authored code flowing into Bedrock.
• Observability: AgentCore Observability publishes to CloudWatch, with traces, evaluation dashboards, invocation counts, latency, and usage patterns feeding back into the registry.
• Policy: A newer detail worth citing if your post covers policy — AWS introduced Dogwood, described as an open-source policy language for AI agents, plus temporal policies and gateway rate limiting, for deterministic, cross-action control (not just per-call checks).