Amazon Bedrock AgentCore Consolidates Traces and Logs Into One CloudWatch Group
A change shipping by default for agents created after July 20, 2026 eliminates the need to hunt across multiple log groups when debugging AI agent invocations.
Does Amazon Bedrock AgentCore now keep traces and logs in the same place?
Yes. As of July 20, 2026, all newly created AgentCore agents automatically route traces, prompts, structured logs, and standard output to a single per-agent CloudWatch log group. The path follows the pattern /aws/bedrock-agentcore/runtimes/<agent_id>-<endpoint_name>. No configuration is required for new agents.
What changed and why it matters
Previously, AgentCore split telemetry across two destinations: trace spans landed in the shared aws/spans log group, while event logs containing prompts, inputs, and outputs went to a separate resource-specific log group. Correlating a single agent invocation meant jumping between those two locations.
The split also created access-control headaches. Because trace spans shared a common log group across agents, operators could not scope IAM policies or customer-managed key (CMK) encryption to an individual agent. The new single-group model fixes both problems simultaneously.
What is included in the unified log group
Each agent's log group now collects:
- Trace spans
- Prompt content
- Structured event logs (inputs and outputs)
- Standard output
For systems that chain multiple agents together, each agent maintains its own complete execution history in its own log group, which keeps per-agent debugging self-contained.
How to enable it on existing agents
Agents created before July 20, 2026 do not get the change automatically. Two steps are required:
- Set the environment variable
UNIFIED_TRACES_DESTINATION_ENABLED=trueon the agent runtime. - Upgrade the AWS Distro for OpenTelemetry (ADOT) collector to version 0.17.1 or later.
# Example: set the environment variable when updating an existing AgentCore runtime
export UNIFIED_TRACES_DESTINATION_ENABLED=true
No additional configuration is documented beyond those two requirements.
Practical impact on access control and encryption
With all telemetry in one log group, teams can now write IAM policies scoped to a specific agent rather than granting broader access to a shared log group. CMK encryption can similarly be applied at the individual agent level, which is relevant for organizations that need to enforce data separation between agents handling different workloads or tenants.
Exporting all of an agent's telemetry also becomes simpler: subscribing to a single log group captures everything, where previously a complete export required subscribing to two separate groups.
Availability
| Detail | Value |
|---|---|
| Default for new agents | July 20, 2026 |
| Opt-in for existing agents | Set env var + ADOT ≥ 0.17.1 |
| ADOT minimum version | 0.17.1 |
| Regions | All AWS commercial regions where AgentCore runtime is supported |
AWS says the feature is available across all commercial regions where the AgentCore runtime is offered. The company did not announce pricing changes associated with the update.