AWS AgentCore Cloud Migration: Multi-Agent Orchestration for Infrastructure-as-Code Generation

AWS Professional Services just published production data on a multi-agent system that compresses infrastructure-as-code development from weeks to minutes. The system chains four specialized agents (discovery, IaC generation, governance, operations) using Amazon Bedrock AgentCore primitives. This is not a demo. It is a deployed enterprise migration workflow with real customer proof points. The interesting part is how AWS routes tasks between agents without creating circular dependencies, and how they instrument handoffs when a single migration spans four agents with different failure modes. Architecture: Four Agents, One Workflow The system decomposes cloud migration into four agent roles: Discovery Agent : Scans existing infrastructure, builds dependency graphs, identifies migration candidates IaC Generation Agent : Converts discovered resources into Terraform or CloudFormation templates Portfolio Governance Agent : Validates generated IaC against organizational policies, cost budgets, security baselines Post-Migration Operations Agent : Monitors deployed resources, handles drift detection, executes remediation Each agent is a Bedrock Agent with tool access scoped to its domain. The discovery agent cannot deploy infrastructure. The IaC generation agent cannot read production credentials. The governance agent has read-only access to policy repositories. AgentCore orchestrates handoffs using a state machine pattern. When the discovery agent completes a scan, it writes structured output (JSON schema with resource metadata, dependencies, and migration readiness scores) to an S3 bucket. The IaC generation agent subscribes to that bucket via EventBridge and begins template generation only after the discovery agent marks the scan as complete. State Management and Handoff Primitives The key orchestration primitive is a migration manifest stored in DynamoDB. Each migration project gets a manifest with these fields: project_id : Unique identifier for the migration current_sta