Key Takeaways

• Amazon Bedrock AgentCore provides a scalable runtime for building, connecting, and optimizing AI agents that can act as collaborators across the software development lifecycle.
• Two reference implementations—SQL‑schema‑to‑Mermaid ER‑diagram generation and multi‑agent code‑security analysis—show how to turn AI‑driven development lifecycle (AI‑DLC) concepts into working, event‑driven workflows.
• Local agentic tools such as Kiro, OpenAI Codex (via MCP), and Claude Code complement AgentCore by handling inception, prototyping, and infrastructure‑as‑code tasks while keeping humans in the loop.
• Best practices include separating agent concerns, persisting context with AgentCore memory, instrumenting with OpenTelemetry, storing configuration in Parameter Store, using chunked processing for large inputs, securing with Cognito M2M auth, integrating via CI/CD, and applying Amazon Bedrock Guardrails to ensure responsible AI outputs.

Overview of AI‑DLC and the implementation gap
Engineering teams that adopt the AI‑Driven Development Lifecycle (AI‑DLC) with Amazon Bedrock AgentCore and coding agents like Kiro often encounter a disconnect between high‑level conceptual frameworks and producible code. As the article notes, “AI‑DLC positions AI as a central collaborator across the software development lifecycle, handling routine execution while humans retain oversight of critical decisions.” The post aims to close that gap by delivering working reference implementations that illustrate how AgentCore can be used in practice.

Reference implementations and their purpose
The article walks through the architecture, design decisions, and key code patterns behind two reference implementations that demonstrate AI‑DLC construction‑phase patterns using AgentCore, Kiro, and local agentic coding tools. The first generates Mermaid entity‑relationship diagrams from SQL schemas via AgentCore runtime; the second provides automated code security analysis through a multi‑agent architecture that leverages AgentCore Gateway, AgentCore memory, and external tool integrations. Together, they show how to structure AI‑driven workflows that maintain human‑in‑the‑loop governance while accelerating delivery, with full deployment instructions available in their respective GitHub repositories.

AI‑DLC construction patterns in practice
In the AI‑DLC construction phase, AI proposes architecture, generates implementation plans, produces code, and creates deployment artifacts, while team members clarify technical decisions in real time. The two systems map directly to this pattern:

• Automated artifact generation: an agent receives structured input (SQL schema files), creates a detailed plan, generates output (Mermaid ER diagrams), and stores results for human review.
• Continuous code quality enforcement: a multi‑agent system analyzes code pushed through CI/CD pipelines, producing security assessments, CVE checks, and policy compliance reports that inform human decision‑making.
  Both systems share a common architectural foundation built on AgentCore, demonstrating how teams can compose AI‑driven workflows from modular, manageable components.

Solution 1: SQL schema to ER diagram generation – business challenge and architecture
Database teams managing evolving SQL schemas need up‑to‑date entity‑relationship documentation; manual creation is time‑intensive and documentation frequently drifts from the actual schema. The AWS Samples project auto‑generates Mermaid ER diagrams from SQL schema files using an agentic AI workflow on Amazon Bedrock AgentCore. After SQL code is checked in by developers, an S3 trigger invokes a Lambda function that calls the AgentCore runtime, which parses the DDL to produce an .mmd diagram saved back to S3. The system reads only schema metadata (tables, constraints, foreign keys), never row data, making it a clean reference for schema‑to‑diagram automation.

The architecture is serverless and event‑driven: an S3 event trigger launches a Lambda function that authenticates via Amazon Cognito OAuth2 M2M, invokes the AgentCore runtime agent (a Strands‑based container using Claude Sonnet 4), which analyzes the schema, identifies tables, columns, constraints, and foreign‑key relationships, generates a complete Mermaid erDiagram, stores the diagram in S3, and persists the analysis session in AgentCore memory for 90 days with semantic search.

Implementation details of Solution 1
The agent implementation uses the BedrockAgentCoreApp runtime wrapper with the @app.entrypoint decorator to register the handler:

python
from bedrock_agentcore.runtime import BedrockAgentCoreApp
from bedrock_agentcore.memory import MemoryClient
from strands import Agent
from strands.models import BedrockModel

app = BedrockAgentCoreApp()
model = BedrockModel(model_id="us.anthropic.claude-sonnet-4-5-20250929-v1:0", region_name="us-west-2")
erdiagram_agent = Agent(model=model)
memory_client = MemoryClient(region_name="us-west-2")

@app.entrypoint
async def generate_er_diagram(payload: Dict[str, Any]) -> Dict[str, Any]:
sql_content = payload.get("sql_content", "")
file_name = payload.get("file_name", "unknown_file.sql")

Generate diagram, store in memory, save to S3

...

Key design decisions include chunked processing of large SQL files to stay within model context limits, structured prompting that extracts tables, columns, data types, primary keys, and foreign‑key relationships before generating diagram syntax, and OpenTelemetry tracing for observability into processing duration, chunk counts, and error attribution. The complete implementation—including OpenAI Codex skills and MCP server integration—is available in the sample‑to‑create‑mermaid‑entity‑diagrams‑from‑sql‑using‑agentic‑ai‑on‑agentcore repository.

Solution 2: Secure software handoffs – business challenge and architecture
Code reviews for security compliance require specialized knowledge across CVE databases, organizational coding policies, and language‑specific security patterns; manual reviews create bottlenecks and lead to inconsistent quality. The serverless code‑security analysis solution uses Amazon Bedrock AgentCore to automatically scan Python or Java code for vulnerabilities, CVE risks in dependencies, and policy violations. When code is pushed from a GitLab pipeline to Amazon S3, a Lambda trigger initiates the AgentCore analysis workflow with OAuth2 authentication. A Strands‑based agent evaluates the code using Anthropic Claude Sonnet models on Amazon Bedrock, invoking Model Context Protocol (MCP) tools that run on AWS Lambda for CVE and policy checks. Results, including quality scores from 1 to 10 and recommendations, are stored in AgentCore memory with semantic search and surfaced through a real‑time, session‑based web dashboard. Amazon Cognito provides authentication, and AgentCore Observability plus Amazon CloudWatch supply monitoring.

Implementation details of Solution 2
The analysis agent follows the same AgentCore runtime pattern as Solution 1, with the addition of MCP tool calls routed through AgentCore Gateway:

python
from bedrock_agentcore.runtime import BedrockAgentCoreApp
from bedrock_agentcore.memory import AgentCoreMemory
from strands import Agent
from strands.models import BedrockModel

app = BedrockAgentCoreApp()
model = BedrockModel(model_id="us.anthropic.claude-sonnet-4-5-20250929-v1:0", region_name="us-west-2")
analysis_agent = Agent(model=model, tools=[analyze_code, check_quality])
memory = AgentCoreMemory(namespace="code-analysis")

@app.entrypoint
async def analyze_uploaded_code(payload: Dict[str, Any]) -> Dict[str, Any]:
file_content = payload.get("file_content", "")
file_name = payload.get("file_name", "unknown.py")
session_id = payload.get("session_id", "")

Analyze code, store results in memory, return quality score

...

Key design decisions include: separating concerns so the code analysis agent focuses solely on quality assessment while policy checking and CVE scanning are delegated to dedicated AWS Lambda functions invoked via AgentCore Gateway; persisting each analysis run as a unique session in AgentCore memory to enable historical comparison and trend analysis; and mediating tool invocation through AgentCore Gateway using MCP, which decouples the agent from tool implementation details and allows new tools to be added without modifying agent code. The full implementation resides in the sample‑agentic‑secure‑software‑handoffs repository.

Local agentic tools that complement AgentCore
While AgentCore provides the cloud runtime for deployed, event‑driven agent workloads, the development workflow itself benefits from local agentic tools that implement AI‑DLC patterns at the developer’s workstation. Kiro supports the AI‑DLC inception and construction phases through structured specifications and custom agent skills: it transforms natural language requirements into structured specifications with acceptance criteria, generates implementation plans from those specifications, and lets teams define reusable Kiro agent skills that encode organizational standards (coding patterns, security requirements, architectural guidelines). Kiro’s agent mode handles multi‑file implementation tasks with autonomous tool use while maintaining human‑in‑the‑loop review at each specification checkpoint.

The repository also includes an OpenAI ChatGPT Codex integration demonstrating how the same ER‑diagram generation workflow extends to additional coding agents via MCP and custom skills. A local stdio‑based MCP server connects Codex to MySQL or Amazon Aurora MySQL databases through INFORMATION_SCHEMA, exposing tools such as schema_summary, generate_er_markdown, and generate_mermaid. A SKILL.md file encodes the ER diagram generation workflow as a reusable Codex skill, and database credentials are securely retrieved from AWS Secrets Manager with TLS verification.

Claude Code operates as a local command‑line agent that complements AgentCore deployments: it enables rapid prototyping of agent logic, generates infrastructure‑as‑code artifacts (Dockerfiles, IAM policies, CloudFormation templates), and performs first‑pass code reviews against project rules before code enters the CI/CD pipeline where the secure‑handoff system provides authoritative security analysis.

The combined AI‑DLC workflow
A typical AI‑DLC “bolt” (short, intense work cycle) using these tools proceeds as follows:

1. Inception (Kiro) – Transform business requirements into specifications with acceptance criteria; the team validates AI‑generated specs in a mob elaboration session.
2. Construction (Claude Code and Kiro) – Generate implementation code, deployment scripts, and test suites; local agents handle file generation and iterative refinement while Kiro manages task orchestration.
3. Validation (AgentCore) – Code pushed through CI/CD triggers automated security analysis; the multi‑agent system provides a quality assessment before merge.
4. Operations (AgentCore) – Production agents (like the ER‑diagram generator) run continuously on AgentCore runtime, triggered by events, processing workloads at scale with full observability.

Best practices for production‑grade AI‑driven workflows
Based on implementing these systems, the authors recommend:

• Separate agent concerns – Design each agent with a single, well‑defined responsibility; composability comes from orchestration, not from overloading individual agents.
• Use AgentCore memory for context continuity – Persistent memory lets agents learn from previous interactions, compare current analysis with historical baselines, and maintain state across sessions without reprocessing.
• Instrument with OpenTelemetry from day one – Tracing provides visibility into agent behavior, processing duration, and failure modes, essential for debugging prompt effectiveness and identifying performance bottlenecks.
• Store configuration in Parameter Store – Decouple configuration from code; Cognito credentials, memory IDs, model selections, and bucket names should be retrievable at runtime.
• Implement chunked processing for large inputs – Split inputs that exceed model context windows, analyze independently, and consolidate results.
• Secure with Cognito M2M authentication – Use OAuth2 client‑credentials flow for service‑to‑service communication; avoid hardcoded credentials or long‑lived tokens.
• Integrate through CI/CD, not manual upload – Connect agents to repository events (merge requests, pipeline stages) rather than requiring manual file uploads; the S3 trigger pattern translates directly to GitLab webhook or GitHub Actions integration.
• Apply Amazon Bedrock Guardrails for production agent outputs – Configure content‑filtering policies, denied‑topic detection, and grounding validation to ensure agent‑generated outputs meet responsible AI standards; for code analysis agents, guardrails can block insecure code patterns or hallucinated CVE references, while for diagram agents grounding checks validate that outputs accurately reflect the source schema.

Conclusion
The AI‑DLC methodology becomes practical when backed by concrete implementation patterns. Amazon Bedrock AgentCore supplies the runtime infrastructure (containerized agents, persistent memory, secure gateways, and external tool integration), while local tools like Kiro and Claude Code accelerate the development workflow itself. Readers are encouraged to start with the SQL‑to‑ER‑Diagram sample to deploy their first AgentCore agent, follow the deployment scripts in sequence, then extend the pattern with multi‑agent coordination, MCP tool integrations, and CI/CD‑driven triggers using the Secure software handoffs sample. For further guidance, see Move your AI agents from proof of concept to production with Amazon Bedrock AgentCore and consult the Amazon Bedrock AgentCore documentation for full‑service details, API references, and configuration guidance.

About the authors
Arghya Banerjee, Ram Pathangi, Kunal Ghosh, and Ananth Kommuri are Senior Solutions Architects at AWS in the San Francisco Bay Area, specializing in big data, analytics, generative AI, agentic AI, databases, and AI/ML solutions across various industry verticals.

https://aws.amazon.com/blogs/machine-learning/ai-driven-development-lifecycle-using-amazon-bedrock-agentcore/