Deploy Spring AI Apps with Amazon Bedrock Agent Core

Learn to deploy Spring AI applications with Amazon Bedrock Agent Core, build enterprise AI solutions on AWS.

Arun Thangavel

Senior Solutions Architect

Published Jan 7, 2026

Last modified Jan 7, 2026

Amazon Bedrock Agent Core is a managed platform for deploying AI-powered applications at scale. Combined with Spring AI's framework, developers can create sophisticated AI agents that leverage Amazon's foundation models with enterprise-grade reliability.

In this guide, we'll build and deploy a Spring AI application that integrates with Amazon Bedrock Agent Core.

What is Amazon Bedrock Agent Core?

Amazon Bedrock Agent Core is a managed service for deploying and running AI agents at scale:

Managed Infrastructure: Serverless compute with automatic scaling
Foundation Model Integration: Access to Amazon Nova , Claude, and other models via Amazon Bedrock
Agent Orchestration: Multi-step reasoning and tool usage support
Enterprise Security: IAM integration, VPC support, and encryption

Framework-Agnostic HTTP Protocol Contract

Amazon Bedrock Agent Core uses a framework-agnostic approach with a standardized HTTP protocol contract for deploying agents built with any framework or programming language.

HTTP Protocol Requirements

Amazon Bedrock Agent Core requires your containerized agent to implement specific HTTP endpoints:

Container Specifications:

Host: 0.0.0.0
Port: 8080 (standard port for HTTP-based agent communication)
Platform: ARM64 container (required for AgentCore Runtime compatibility)

Required Endpoints:

`/invocations` - POST

The primary agent interaction endpoint that processes user requests:

1
2
3
4
5
6
7
8
9
10
// Request format
{
  "question": "What's the weather today?"
}

// Response format (JSON)
{
  "response": "Your agent's response here",
  "status": "success"
}

`/ping` - GET

Health check endpoint that verifies your agent is operational:

1
2
3
4
5
// Response format
{
  "status": "Healthy",
  "time_of_last_update": 1671234567
}

Status Values:

Healthy - System is ready to accept new work
HealthyBusy - System is operational but currently busy with async tasks

Why This Matters for Spring AI

This standardized approach means:

Technology Freedom: Use Spring AI, LangChain, FastAPI, Express.js, or any HTTP framework
Language Flexibility: Deploy agents written in Java, Python, Node.js, Go, or any language
Simple Integration: Standard REST endpoints that any web framework can implement
Migration Path: Easily migrate existing web applications to Bedrock Agent Core

The Spring AI implementation aligns with this contract by using port 8080, implementing the required endpoints, and returning JSON responses.

Project Overview

Our sample application demonstrates a Spring AI service that implements the Amazon Bedrock Agent Core HTTP protocol contract:

Integrates with Amazon Bedrock Converse API using Amazon Nova 2 Lite model
Follows HTTP protocol specifications with containerized deployment
Provides health monitoring via Spring Actuator for automated recovery
Supports ARM64 compatibility for Bedrock Agent Core requirements

Prerequisites

Before we begin, ensure you have installed:

Java 25+
Maven 3.6+
AWS CLI configured with appropriate permissions
Docker for containerization

Project Structure

1
2
3
4
5
6
7
8
9
sample-spring-ai-bedrock-agent-core/
├── src/main/java/com/amazon/samplespringaibedrockagentcore/
│   ├── SampleSpringAiBedrockAgentCoreApplication.java
│   ├── MainController.java
│   └── Prompt.java
├── src/main/resources/
│   └── application.properties
├── Dockerfile
└── pom.xml

Core Implementation

1. Maven Dependencies

The pom.xml includes essential Spring AI and Bedrock dependencies :

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
<properties>
    <java.version>25</java.version>
    <spring-ai.version>1.1.2</spring-ai.version>
</properties>

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.ai</groupId>
        <artifactId>spring-ai-starter-model-bedrock-converse</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>
</dependencies>

2. Application Entry Point

The main Spring Boot application class:

1
2
3
4
5
6
7
8
9
10
11
12
package com.amazon.samplespringaibedrockagentcore;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class SampleSpringAiBedrockAgentCoreApplication {

    public static void main(String[] args) {
        SpringApplication.run(SampleSpringAiBedrockAgentCoreApplication.class, args);
    }
}

3. Request Model

The Prompt.java record defines the request structure:

1
2
3
package com.amazon.samplespringaibedrockagentcore;

public record Prompt(String question){}

4. Main Controller

The MainController.java provides a simple REST endpoint for AI interactions:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
@RestController
public class MainController {

    private final ChatClient chatClient;

    public MainController(ChatClient.Builder chatClientBuilder) {
        chatClient = chatClientBuilder.build();
    }

    @PostMapping("/invocations")
    String getAIResponse(@RequestBody Prompt prompt) {
        return chatClient.prompt()
                         .user(prompt.question())
                         .call()
                         .content();
    }
}

3. Configuration

The application.properties configures Bedrock integration and health monitoring:

1
2
3
4
5
6
7
8
9
spring.application.name=sample-spring-ai-bedrock-agent-core

# Bedrock Configuration
spring.ai.bedrock.converse.chat.options.model=us.amazon.nova-2-lite-v1:0

# Health Monitoring
management.endpoints.web.exposure.include=health
management.endpoints.web.base-path=/
management.endpoints.web.path-mapping.health=ping

We use Spring Boot Actuator for the required /ping endpoint - it provides production-ready health checks with zero custom code while mapping /health to /ping for protocol compliance.

Container Deployment

The included Dockerfile enables ARM64-compatible container deployment:

1
2
3
4
5
6
7
8
9
FROM amazoncorretto:25-al2023

WORKDIR /app

COPY target/sample-spring-ai-bedrock-agent-core-0.0.1-SNAPSHOT.jar app.jar

EXPOSE 8080

ENTRYPOINT ["java", "-jar", "app.jar"]

Build and Push to ECR

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# Build the application
mvn clean package

# Get your account ID
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
echo $ACCOUNT_ID

# Create ECR repository (if it doesn't exist)
aws ecr create-repository \
    --repository-name spring-ai-bedrock-agent-core \
    --region us-west-2 \
    --image-scanning-configuration scanOnPush=true

# Build Docker image
docker buildx build --platform linux/arm64 -t spring-ai-bedrock-agent-core .

# Get ECR login token and authenticate Docker
aws ecr get-login-password --region us-west-2 | \
    docker login --username AWS --password-stdin $ACCOUNT_ID.dkr.ecr.us-west-2.amazonaws.com

# Tag and push image
docker tag spring-ai-bedrock-agent-core:latest \
    $ACCOUNT_ID.dkr.ecr.us-west-2.amazonaws.com/spring-ai-bedrock-agent-core:latest

docker push $ACCOUNT_ID.dkr.ecr.us-west-2.amazonaws.com/spring-ai-bedrock-agent-core:latest

Deploy to Amazon Bedrock Agent Core

Deploy your Spring AI application using Bedrock Agent Core CLI commands:

Step 1: Create Required IAM Role

First, create the execution role that Agent Core will use to run your container:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
# Create trust policy for Bedrock Agent Core
cat > trust-policy.json << 'EOF'
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AssumeRolePolicy",
            "Effect": "Allow",
            "Principal": {
                "Service": "bedrock-agentcore.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "ACCOUNT_ID_PLACEHOLDER"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:bedrock-agentcore:us-west-2:ACCOUNT_ID_PLACEHOLDER:*"
                }
            }
        }
    ]
}
EOF

# Replace placeholder with actual account ID
sed "s/ACCOUNT_ID_PLACEHOLDER/$ACCOUNT_ID/g" trust-policy.json > trust-policy-final.json

# Create the IAM role
aws iam create-role \
    --role-name BedrockAgentCoreExecutionRole \
    --assume-role-policy-document file://trust-policy-final.json \
    --description "Execution role for Bedrock Agent Core runtime"

# Create permissions policy
cat > permissions-policy.json << 'EOF'
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ECRImageAccess",
            "Effect": "Allow",
            "Action": [
                "ecr:BatchGetImage",
                "ecr:GetDownloadUrlForLayer"
            ],
            "Resource": [
                "arn:aws:ecr:us-west-2:ACCOUNT_ID_PLACEHOLDER:repository/spring-ai-bedrock-agent-core"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogStreams",
                "logs:CreateLogGroup"
            ],
            "Resource": [
                "arn:aws:logs:us-west-2:ACCOUNT_ID_PLACEHOLDER:log-group:/aws/bedrock-agentcore/runtimes/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogGroups"
            ],
            "Resource": [
                "arn:aws:logs:us-west-2:ACCOUNT_ID_PLACEHOLDER:log-group:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:us-west-2:ACCOUNT_ID_PLACEHOLDER:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*"
            ]
        },
        {
            "Sid": "ECRTokenAccess",
            "Effect": "Allow",
            "Action": [
                "ecr:GetAuthorizationToken"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "xray:PutTraceSegments",
                "xray:PutTelemetryRecords",
                "xray:GetSamplingRules",
                "xray:GetSamplingTargets"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Resource": "*",
            "Action": "cloudwatch:PutMetricData",
            "Condition": {
                "StringEquals": {
                    "cloudwatch:namespace": "bedrock-agentcore"
                }
            }
        },
        {
            "Sid": "GetAgentAccessToken",
            "Effect": "Allow",
            "Action": [
                "bedrock-agentcore:GetWorkloadAccessToken",
                "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
                "bedrock-agentcore:GetWorkloadAccessTokenForUserId"
            ],
            "Resource": [
                "arn:aws:bedrock-agentcore:us-west-2:ACCOUNT_ID_PLACEHOLDER:workload-identity-directory/default",
                "arn:aws:bedrock-agentcore:us-west-2:ACCOUNT_ID_PLACEHOLDER:workload-identity-directory/default/workload-identity/springAiBedrockAgent-*"
            ]
        },
        {
            "Sid": "BedrockModelInvocation",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:*::foundation-model/*",
                "arn:aws:bedrock:us-west-2:ACCOUNT_ID_PLACEHOLDER:*",
                "arn:aws:bedrock:us-east-1:ACCOUNT_ID_PLACEHOLDER:*"
            ]
        }
    ]
}
EOF

# Replace placeholder with actual account ID
sed "s/ACCOUNT_ID_PLACEHOLDER/$ACCOUNT_ID/g" permissions-policy.json > permissions-policy-final.json

# Note: If you're copying these policies manually, replace ACCOUNT_ID_PLACEHOLDER 
# with your actual AWS account ID (e.g., 123456789012) in both JSON files

# Attach permissions policy to role
aws iam put-role-policy \
    --role-name BedrockAgentCoreExecutionRole \
    --policy-name BedrockAgentCorePermissions \
    --policy-document file://permissions-policy-final.json

# Clean up temporary files
rm trust-policy.json permissions-policy.json trust-policy-final.json permissions-policy-final.json

Step 2: Create Agent Runtime

Now create the agent runtime using the IAM role:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
# Create the agent runtime
aws bedrock-agentcore-control create-agent-runtime \
    --agent-runtime-name "springAiBedrockAgent" \
    --agent-runtime-artifact "{
        \"containerConfiguration\": {
            \"containerUri\": \"$ACCOUNT_ID.dkr.ecr.us-west-2.amazonaws.com/spring-ai-bedrock-agent-core:latest\"
        }
    }" \
    --role-arn "arn:aws:iam::${ACCOUNT_ID}:role/BedrockAgentCoreExecutionRole" \
    --network-configuration '{
        "networkMode": "PUBLIC"
    }' \
    --protocol-configuration '{
        "serverProtocol": "HTTP"
    }' \
    --region us-west-2

Test Your Deployed Agent

Testing via AWS Console

The easiest way to test your deployed agent is through the AWS Console's built-in testing interface:

Navigate to Amazon Bedrock Agent Core in the AWS Console
Select 'Agent Sandbox' under Test sub section on the menu

Figure 1: Agent Sandbox testing input interface in AWS Console

Figure 2: Select your Runtime Agent, Endpoint and use the Input JSON as shown below

Figure 3: Agent Sandbox response output showing successful interaction

Troubleshooting Common Issues

Model Access Denied

Ensure your IAM role has bedrock:InvokeModel permissions for the specific model ARN.

Connection Timeouts

Increase timeout values in application properties:

1
spring.ai.bedrock.converse.chat.options.timeout=60s

Memory Issues

Adjust JVM settings in your Dockerfile:

1
ENTRYPOINT ["java", "-Xmx1024m", "-jar", "app.jar"]

Conclusion

Deploying Spring AI applications with Amazon Bedrock Agent Core provides a robust foundation for enterprise AI solutions. The combination offers:

Scalability: Automatic scaling based on demand
Reliability: Managed infrastructure with high availability
Security: Enterprise-grade security controls
Cost Efficiency: Pay-per-use pricing model
Developer Experience: Familiar Spring Boot patterns

This architecture enables teams to focus on building AI-powered features while AWS handles the underlying infrastructure complexity.

Next Steps

Explore advanced agent capabilities with multi-step reasoning
Implement custom tools for domain-specific functionality
Add streaming responses for better user experience
Integrate with other AWS services like DynamoDB for state management
Set up CI/CD pipelines for automated deployments

References

# spring-boot # amazon-bedrock-agentcore # agentic-ai # generative-ai # amazon-bedrock

Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.

Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article

Builder Center

Deploy Spring AI Apps with Amazon Bedrock Agent Core

Arun Thangavel

What is Amazon Bedrock Agent Core?

Framework-Agnostic HTTP Protocol Contract

HTTP Protocol Requirements

/invocations - POST

/ping - GET

Why This Matters for Spring AI

Project Overview

Prerequisites

Project Structure

Core Implementation

1. Maven Dependencies

2. Application Entry Point

3. Request Model

4. Main Controller

3. Configuration

Container Deployment

Build and Push to ECR

Deploy to Amazon Bedrock Agent Core

Step 1: Create Required IAM Role

Step 2: Create Agent Runtime

Test Your Deployed Agent

Testing via AWS Console

Troubleshooting Common Issues

Model Access Denied

Connection Timeouts

Memory Issues

Conclusion

Next Steps

References

`/invocations` - POST

`/ping` - GET