If you read one line: Since July 20, 2026, every new Amazon Bedrock AgentCore agent streams all of its telemetry — traces, prompts, structured logs, stdout — into one per-agent CloudWatch log group, /aws/bedrock-agentcore/runtimes/<agent_id>-<endpoint_name>, with zero config. Debugging is now one query instead of a hunt across log groups. Two gotchas: enable CloudWatch Transaction Search once or you'll see no traces, and add aws-opentelemetry-distro so your framework's spans actually flow.

If you run agents on AgentCore, a quiet default flip on July 20 changed the worst part of operating them. The old tax on a production agent was reconstruction: a single invocation sprayed its trace spans, prompts, structured logs, and raw stdout across several CloudWatch log groups, and you stitched the story back together by hand — with no way to lock down access or encryption for one agent specifically. That's over for new agents.

What actually turned on#

Per the AWS announcement, every AgentCore agent created on or after July 20, 2026 sends its complete telemetry to a single per-agent log group:

/aws/bedrock-agentcore/runtimes/<agent_id>-<endpoint_name>

Everything the agent emits — spans, the prompts it sent, your structured logs, and plain stdout — lands there together, no configuration required. Three things fall out of that one design choice:

For multi-agent systems the payoff compounds: each agent's full execution history stays together, so end-to-end debugging of a hand-off is a query, not a scavenger hunt.

Logs show up immediately; spans and traces do not until you flip one account-level switch. It's a one-time setup, easy to miss, and the reason most first-timers think observability "isn't working." From the configure-observability docs:

  1. Open the CloudWatch console.
  2. Expand Application Signals (APM) → Transaction search.
  3. Choose Enable Transaction Search.

Then wait — it can take about ten minutes for spans to become searchable. Once it's on, your traces render in the GenAI Observability dashboard, under the Bedrock AgentCore tab.

Gotcha 2: your framework has to emit OpenTelemetry#

AgentCore observability is built on OpenTelemetry, so the platform captures whatever your agent emits — which means your framework has to be instrumented. The zero-effort path is AWS's OTel distro. In your agent's requirements.txt:

aws-opentelemetry-distro        # ADOT: auto-instrumentation + CloudWatch export
strands-agents[otel]            # example: make Strands actually emit spans

Then run your agent under the OTel entrypoint instead of calling Python directly:

opentelemetry-instrument python -m my_agent

opentelemetry-instrument loads the OTel config from your environment and auto-instruments Strands, Amazon Bedrock model calls, tool and database calls, and outbound HTTP — routing all of it into the same CloudWatch destination. If you use a different framework, install its OTel auto-instrumentor the same way; the starter-toolkit quickstart has the per-framework specifics.

The two-minute checklist#

  1. Confirm the log group. For a new agent, look for /aws/bedrock-agentcore/runtimes/<agent_id>-<endpoint_name>. If it's there, unified observability is live.
  2. Enable Transaction Search once, per account (above). No traces without it.
  3. Add aws-opentelemetry-distro and launch under opentelemetry-instrument so spans actually flow.
  4. Scope it. Attach a per-agent IAM policy and, if you need it, a CMK to that one log group.
  5. Export it. Subscribe the single group to your downstream pipeline.

So do you still need Langfuse?#

That's the real question this change forces, and it deserves its own answer. Native AgentCore observability is genuinely good — free with the platform, per-agent, OTel-based — but it's AWS-shaped: it lives in CloudWatch and assumes you host on AgentCore. Dedicated LLM-observability tools still own cross-platform tracing, prompt management, datasets, and tight eval loops. We walk that decision — native AgentCore observability vs Langfuse vs Phoenix — in the companion piece. The short version: if AgentCore is your whole stack, the built-in tracing may be all the runtime visibility you need; the moment you go multi-platform or want evaluation baked in, you'll reach for a vendor on top.