What happened?

Amazon Web Services (AWS) announced in a blog post published on August 13, 2026, a method that enables AgentCore Observability—the monitoring component of the Amazon Bedrock AgentCore platform—to now monitor AI agents running outside the AWS cloud as well. AgentCore Observability previously only natively supported agents hosted on the AgentCore runtime. The new approach uses an auto-instrumentation tool called AWS Distro for OpenTelemetry (ADOT) to transmit telemetry data from agents built with frameworks like Strands Agents, LangGraph, and CrewAI to Amazon CloudWatch's OTLP (OpenTelemetry Protocol) endpoint.

According to AWS, this solution covers agents running on Amazon EKS, Amazon ECS, and AWS Lambda, as well as agents running on-premises servers or on other cloud providers such as Google Cloud Platform (GCP) or Microsoft Azure. Authentication is performed via SigV4 signing using IAM (Identity and Access Management) user credentials. AWS recommends using IAM Roles Anywhere, which provides temporary credentials via X.509 certificates, instead of long-lived access keys for production environments.

Why does it matter?

Deploying AI agents across different cloud environments or on-premises infrastructure is becoming increasingly common, but this can create centralized monitoring gaps. AWS states that observability is a fundamental pillar of responsible AI applications. Centralized telemetry collection allows developers to view agent reasoning chains, tool calls, and model outputs, making it easier to detect hallucinations, monitor harmful or off-topic responses, manage costs based on token usage, and audit agent behavior.

AWS particularly emphasizes that problematic outputs from agents running outside AWS could go unnoticed without centralized monitoring. For organizations running AI agents in on-premises or multi-cloud architectures, the new method therefore fills a practical gap in security and cost oversight.

How does the setup work?

  • ADOT auto-instrumentation is injected into the Python runtime, automatically patching boto3 and the Strands framework to produce OpenTelemetry traces.
  • SigV4 authentication signs OTLP export requests using the boto3 credential chain.
  • Telemetry is sent to CloudWatch's native OTLP ingestion endpoint and routed to the designated AgentCore log group.
  • The Strands framework's [otel] package captures agent reasoning steps, tool calls, and model invocations with token usage in accordance with OpenTelemetry generative AI semantic conventions.

What's next?

AWS detailed in the blog post the prerequisites needed for setup—Amazon Bedrock model access, enabling CloudWatch Transaction Search, Python 3.10 or higher, and the necessary IAM permissions. The company noted that developers can follow these steps to verify the end-to-end telemetry flow in their own environments. This announcement stands out as part of AWS's ongoing efforts to expand the Amazon Bedrock AgentCore platform and increase its compatibility with different agent frameworks.