Amplify + Bedrock AgentCore, A Clean Pattern for GenAI Apps
Amplify gives you a production full-stack app for free; AgentCore drops a managed AI agent on top, sharing auth and deploying in one stack.
Amplify + Bedrock AgentCore: A Clean Pattern for GenAI Apps
A generative-AI product is never just the model. Before your agent does anything a user would pay for, you've quietly signed up to build two entirely different systems: a full-stack web application, and a managed inference runtime. Most teams underestimate both.
After building a few GenAI apps on AWS, the pairing I keep coming back to is AWS Amplify Gen 2 for the app and Amazon Bedrock AgentCore for the agent. The reason it works so well is that they divide the labor along exactly the right seam — and because they're both AWS, the whole system comes up from a single CDK deployment and authenticates through one identity layer end to end. No glue infrastructure to build, no second auth system to run. This post walks through why that matters.
The two problems hiding inside every GenAI app
To ship a real generative-AI product, you need at minimum:
- Auth — who is this user, and what can they see?
- A data layer — chat sessions, agent configs, message history, per-user records.
- Hosting — a real web app, served securely, with an environment per branch.
- An inference runtime — something that calls the model, streams tokens back, and survives long-lived connections.
- Memory — so the agent remembers the user across turns and sessions.
- Tools — a way to give the agent access to external systems, with auth on each call.
Teams routinely spend their first month building 1–3 (the undifferentiated full-stack plumbing) before they write a line of agent logic, then another month on 4–6 (the inference plumbing) before the agent is useful.
The insight is that these are two different problems, and AWS has a purpose-built tool for each. Amplify owns the app. AgentCore owns the agent. They compose cleanly because they share Amazon Cognito .
What Amplify gives you: the full-stack app, for free
Amplify Gen 2 is a TypeScript-first, code-defined backend. You describe your backend as code and Amplify provisions it as CloudFormation. A single
ampx sandbox command stands up:Capability | What Amplify provisions |
|---|---|
Auth | Cognito User Pool + Identity Pool |
Data | AppSync GraphQL API over DynamoDB, with per-model authorization |
Functions | Lambda handlers, typed and wired to the API |
Hosting | S3 + CloudFront static site, per-branch environments |
The developer experience is the pitch: you write
a.model({...}) in a schema file and get a typed GraphQL API, DynamoDB tables, resolvers, and fine-grained per-owner authorization — no resolver code, no hand-authored IAM policies, no CloudFormation YAML. Frontend hooks are generated and typed end to end, and every branch gets its own isolated environment .This is the part of a GenAI app that is not differentiated. Amplify makes it disappear.
What AgentCore adds: the generative-AI layer
Bedrock AgentCore provides the managed runtime pieces that a GenAI app needs and that Amplify deliberately does not try to be:
Capability | What AgentCore provides |
|---|---|
Managed runtime | A hosted, serverless runtime that owns model invocation, the tool loop, and token streaming |
Persistent memory | Memory with short- and long-term strategies (semantic, user-preference, summarization), namespaced per user |
Gateway | A Gateway that validates Cognito JWTs and brokers the agent's access to external MCP tools |
Built-in tools | Managed tools like Browser and Code Interpreter — no tool-hosting infrastructure to run yourself |
Robust streaming | A binary event stream the SDK decodes into typed events, owning connection timeouts and retries |
None of this is app plumbing, and none of it is something you'd want to hand-build. The long-lived streaming connection that doesn't drop mid-response is the exact thing teams get wrong. AgentCore is the differentiated GenAI layer that Amplify has no opinion about.
The seam: why they compose cleanly
What makes this pairing more than "two services in one repo" is that the integration surface is genuinely small. Three properties keep it that way.
1. One identity layer, from the browser to the tool call
This is where being all-AWS pays off directly. Amplify owns the Cognito User Pool and Identity Pool, and every actor in the system authenticates through it — no bolt-on auth for the AI half, no token-translation shim between the app and the agent:
- The browser invokes the runtime with a request signed by AWS Signature Version 4 , using the temporary, scoped IAM credentials that Amplify's
fetchAuthSession()already hands out from the Cognito Identity Pool. The same credential model that guards the rest of your AWS resources guards the agent.
- The AgentCore Gateway validates the same Cognito JWTs before letting the agent reach a tool — so per-tool access is enforced by the identity you already have, not a second set of API keys.
- Server-side callers (a background Lambda, a webhook handler) sign with their Amplify-provisioned IAM execution roles, scoped to least privilege.
One identity system, one login, one authorization model spanning the whole app and the agent. Auth is often the single hardest thing to get right in a GenAI app — here it's inherited, not built.
2. The entire system deploys in one CDK operation
There is no separate
agentcore deploy step, no second pipeline, no manual wiring between the app and the agent. Amplify Gen 2 is AWS CDK under the hood, so the AgentCore runtime, memory, and gateway build inside the same CDK sub-stack as everything else — I use the AgentCoreApplication CDK construct for this, which I wrote about in Host Claude Code on Bedrock AgentCore with the AgentCoreApplication CDK Construct . The entire system — Cognito, AppSync, DynamoDB, Lambdas, S3/CloudFront hosting, and the agent runtime — comes up from a single command as one CloudFormation deployment.That single-operation deploy is worth dwelling on. Because everything is same-stack, the cross-references (runtime ARN, memory ARN, gateway ID) are CDK tokens resolved at synth time — the app and the agent are wired to each other by the framework, correctly, every time. Every branch gets a complete, isolated copy of the whole system, app and agent together. And tearing it down is one operation too. No post-deploy wiring, no copying ARNs between consoles, no drift between the two halves.
3. Agent behavior is runtime-injectable via the app's data layer
The agent's system prompt, model ID, and MCP tool URLs don't have to be baked into the runtime. They can live as records in the Amplify DynamoDB/AppSync data layer and be injected into each invocation. Change an agent's configuration in the app's database and it takes effect on the next message — no redeployment of the agent runtime.
This is the clearest expression of the division of labor: Amplify stores what the agent should be; AgentCore runs it.
The request path, end to end
The full round trip touches both halves and shows how little custom glue there is:
Plain text
Browser (React chat UI)│ fetchAuthSession() → Cognito Identity Pool credentials ← Amplify▼SigV4-signed invoke request▼AgentCore Runtime ← AgentCore├── injects systemPrompt / modelId / MCP tools from a config record ← Amplify data layer├── reads persistent memory for this user/session ← AgentCore├── calls the model, runs the tool loop│ └── Gateway validates the Cognito JWT per tool call ← shared auth└── streams typed events back▼React UI renders the response incrementally
Everything labeled "Amplify" was free with the framework. Everything labeled "AgentCore" is managed runtime you didn't build. The seam between them is a shared credential and a config record.
If your frontend is React and you want a drop-in chat UI over this runtime, I walked through wiring one up in Wiring CopilotKit to a Managed Bedrock AgentCore Harness . And if you want the agent to actually remember users across sessions, Persist Claude Code Turns in Bedrock AgentCore Memory goes deep on the memory side.
The bottom line
Building it yourself | With Amplify + AgentCore |
|---|---|
Build auth, data, hosting, CI/CD by hand | ampx sandbox — one command |
Build and operate an inference runtime, streaming, retries | Managed runtime |
Build a memory system | Built-in memory strategies |
Build tool auth and hosting | Gateway on the shared Cognito |
Wire two systems together, sync ARNs | One CloudFormation stack, CDK tokens |
Maintain a second auth system for the AI | One Cognito identity, end to end |
Amplify makes the undifferentiated full-stack work disappear. AgentCore makes the undifferentiated GenAI-runtime work disappear. What's left is the part that's actually yours: the agent's behavior, its prompts, its tools, and your product.
That's the pitch — and the two halves meet at a single Cognito credential and a config record. If you're standing up a GenAI app on AWS and find yourself about to hand-build auth or an inference loop, that's the signal to reach for these two instead.
Related reading
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article