FDE Times: AWS AgentCore — Runtime, Identity and the CloudTrail audit gap FDEs must flag

FDE Times on 4 November walks Forward Deployed Engineers through Amazon Bedrock AgentCore (GA 13 October 2025) for the meeting after the demo works—when the customer’s security team asks where the agent runs, who may call it, and where the logs live. The piece focuses on Runtime, Identity and Observability rather than the full product surface.

Runtime offers microVMs that isolate and destroy each session (max ~8 hours) versus Instances on customer-account EC2 lasting up to 14 days—so a 10-hour overnight reconciliation job needs Instances, and guessing session length is a common failure mode. Identity gives each agent its own identity and integrates with Okta, Microsoft Entra ID or Cognito without forcing an IdP migration. Observability exports OpenTelemetry into CloudWatch, but AWS docs state CloudTrail currently covers only some capabilities (notably Gateway and Agent Registry)—banks and hospitals that need every API call on an audit trail must hear that gap before go-live, not after.

The guide warns against rewriting a working customer agent "to fit" the platform: Runtime accepts any framework and model, so effort belongs in placement, identity and logs. For CVs, name three decisions—compute from measured session length, IdP wiring with agent identity separated from users, and the audit gap flagged pre-production—rather than a vague "used AgentCore" line.