Phase 2 · Ship to AgentCore

Ship the agent

You build the agent. The platform handles the cloud. Each stage is one command. up N provisions everything up to task N; a lower N switches later tasks off again. Your work is the app: agent code, prompts, tools, memory use, config and tests.

0 of 8 tasks complete

Your toolbox

the whole Phase 2 toolbox

uv run bootcamp.py up 4                 # provision stages 0..4
uv run bootcamp.py deploy               # ship your edited agent / MCP code
uv run bootcamp.py status               # ids: POOL_ID, GATEWAY_ID, MEMORY_ID, ...
uv run bootcamp.py test --only 4        # check one stage (or: test 4 for 0..4)
uv run bootcamp.py invoke "Hi" --actor alice-chen
uv run bootcamp.py token                # bearer token for manual calls
uv run bootcamp.py llm                  # gateway URL, models, budget spent / max
uv run bootcamp.py down                 # remove your whole stack

Every command runs from bootcamp/. test N checks stages 0 to N; test --only N just one.

Stages at a glance

Stage	The platform provisions	Check	What passing proves
0	Cognito identity	`test --only 0`	M2M token is issued; keyless LiteLLM identity works; direct Bedrock is denied
1	MCP server on AgentCore Runtime, JWT inbound	`test --only 1`	tools/list and a SELECT work
2	AgentCore Gateway, OAuth provider, semantic search	`test --only 2`	Gateway lists DataStreamDatabase___query_db
3	AgentCore Memory, UserFacts strategy	`test --only 3`	Memory is ACTIVE
4	Agent runtime wired to Gateway, Memory, LiteLLM	`test --only 4`	Agent answers, recalls across sessions, spend lands on your budget
5	Observability (traces in CloudWatch)	`test --only 5`	Spans arrive (can take ~10 min)
6	Online evaluations	`test --only 6`	Config is ACTIVE
7	Cedar policy on the Gateway	`test --only 7`	SELECT allowed, DELETE denied

Tasks

Identity with Cognito

Get a machine-to-machine token so everything you deploy can prove who is calling.

The “Enterprise Readiness” challenge

15 minEasy 1

MCP server on AgentCore Runtime

Your Phase 1 MCP server goes to the cloud behind JWT auth. You own its tools.

The “Tool Server Deployment” challenge

20 minMedium 2

AgentCore Gateway

Put a single, governed front door in front of your tools, with semantic tool search.

The “Tool Discovery” challenge

20 minMedium 3

AgentCore Memory

Long-term, per-user memory that learns facts across sessions and keeps users apart.

The “Remember Me, Not Jordan” crisis

15 minEasy 4

Your agent on AgentCore Runtime

Deploy the Phase 1 orchestrator, wired to Gateway, Memory and LiteLLM. This is where you code.

The “Agent Deployment and Tool Access” challenge

35 minAdvanced 5

Observability

See every model call, tool call and millisecond your agent spends, without adding code.

The “Black Box” panic

20 minEasy 6

Online evaluations

Score live traffic for helpfulness, goal success and correctness with LLM-as-a-judge.

The “Quality Crisis” panic

20 minMedium 7

Cedar policy on the Gateway

Enforce SELECT-only at the Gateway, so no prompt or code change can delete data.

The “Runaway Query” nightmare

20 minMedium

Optional add-ons

For fast finishers: switch on an AgentCore built-in tool with one .env flag and teach your agent to use it.

0 of 2 optional add-ons complete

Optional: Code Interpreter

Give the agent a sandboxed Python environment so it computes answers instead of guessing at arithmetic.

The “Numbers, Not Prose” request

25 minAdvanced +

Optional: Browser

Let the agent read public web pages through a managed, sandboxed headless browser.

The “What Are Competitors Doing?” request

25 minAdvanced