What it costs, and the gotchas that cost you
Lesson 5 of 5 in AWS Agents in Practice: Deploy, Authorize, Guard, Observe, Pay.
Nobody cancels an agent project because the architecture diagram was ugly. They cancel it because the unit economics never closed — the agent worked, and it cost more per task than the human it was supposed to help.
So learn the shape of the bill rather than the numbers, because the numbers change monthly and the shape does not. AgentCore is consumption-priced with no upfront cost, metered per capability, and there is no separate charge for the harness orchestration itself. What you are buying, dimension by dimension, is below.
| Capability | Metered on | The behaviour that inflates it |
|---|---|---|
Runtime (microVM) | Actual CPU consumed and peak memory, per second, from microVM start to termination. | Sessions held open while nothing happens. Memory is billable for the whole session even when CPU is not. |
Runtime Instances | Managed compute in addition to EC2 costs for the chosen instance family. | Fourteen-day sessions nobody deletes, and GPU families chosen for work that never needed one. |
Memory | Short-term events written, long-term records stored, long-term retrieval requests. | Writing every token of every turn forever, plus a retrieval on every single loop iteration. |
Gateway | API operations, search queries, and indexed tools. | A giant catalogue of indexed tools nobody calls — and semantic search fired on every turn instead of once per task. |
Browser / Code Interpreter | Active CPU and memory per session. | Sandbox sessions left open between steps, because opening a fresh one felt slow. |
Model inference | Billed separately by the model provider — not by AgentCore. | Context that grows every turn: each iteration re-sends the whole conversation, so per-turn cost climbs within a session. |
Observability / Evaluations | CloudWatch ingestion, storage and query; evaluation results are written to CloudWatch logs and metrics. | Full-fidelity spans on 100% of traffic, kept forever, plus an online evaluation sampling rate set to 100 because the slider went there. |
Three consequences follow, and they are where cost review on AWS actually pays.
Session lifetime is a cost control, not a comfort setting. The 15-minute inactivity default is on your side; the mechanisms that defeat it — background keep-alives, 14-day Instance sessions — should be deliberate decisions with an owner, not defaults someone copied from a sample.
The compute line is often not the biggest line. Model inference is billed separately by the provider, and on most agent workloads that is the number that decides viability — especially because context grows every turn, so a 20-turn run does not cost 20× a 1-turn run, it costs more. Price your tokens per task, not per call.
Observability is a real line item. Traces you never read still cost ingestion and storage. Sample deliberately: online evaluation supports 0.01% to 100%, and the correct answer is almost never 100 in steady state — it is high while you are learning the failure modes and lower once you have alarms on the metrics that matter.
The session that never goes idle
A background task answering health checks with HealthyBusy keeps a session Active, and memory stays billable for the session’s whole life. Legitimate for genuinely long work; a silent bill multiplier when it was copied from a sample. Alarm on session count and on mean session duration, not just on errors — a rising duration curve with flat throughput is the tell.
Ephemeral state, discovered the hard way
MicroVM session state is ephemeral: on termination the microVM is destroyed and memory sanitized. The scratch file, the cached embedding index, the half-finished report — gone. Write durable things to Memory, S3 or a database during the session. If a working tree genuinely must survive a pause, that is what Runtime Instances and persistent volumes are for — and note that deleting the session deprovisions the volume.
Long-term memory is not there yet when you look
Long-term extraction is asynchronous: there is a delay between event ingestion and extracted memories becoming available, so AWS advises using short-term memory for immediate retrieval while long-term records consolidate in the background. In production this surfaces as an agent that "forgets" what the user just said — because the code read the long-term store a second after writing the event. Read short-term for the current session; read long-term for previous ones.
Availability is per service, not per platform
AgentCore went GA in nine regions in October 2025; Evaluations reached GA in nine regions in March 2026 while Policy reached GA in thirteen; GovCloud (US-West) arrived for AgentCore in May 2026 with Memory, Policy and the harness following in August 2026. A design that assumes "AgentCore is available in region X" can be wrong for one specific service. Check per-service region availability before you promise a data-residency story.
Online evaluation cannot use your ground-truth evaluators
Online evaluation continuously samples live traffic from a CloudWatch log group, but it can only use evaluators that need no ground truth — anything referencing expected responses, expected tool trajectories or behavioural assertions is on-demand only. The practical split: ground-truth evaluation in CI against a fixed set, reference-free evaluators such as Builtin.GoalSuccessRate on sampled production traffic. An online config supports up to 10 evaluators.
The tool catalogue has a standing cost
Gateway meters indexed tools as well as operations and search queries, and semantic tool search builds embeddings from each tool’s name, description and parameter descriptions at synchronization time. A catalogue of hundreds of tools nobody calls is both a cost line and a quality problem — more candidates for the model to choose wrongly among. Curate the catalogue; do not let it accrete.
Sandbox limits and recordings you forgot were sensitive
Code Interpreter supports inline file uploads up to 100 MB, and up to 5 GB when transferred to or from S3 by terminal commands inside the sandbox — so a data-heavy job needs an S3 path, not a bigger upload. Browser sessions default to a 15-minute timeout with an 8-hour maximum, and custom-browser session recording captures DOM changes, actions, console logs and network events to S3. That recording bucket contains everything the agent saw on screen: govern it like the sensitive artefact it is, and remember Live View lets a human watch and take over — a genuine human-in-the-loop control, not just a demo feature.
Interactive flashcard deck.
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.