Scaling Enterprise Cloud Migrations with Agentic AI on Amazon Bedrock AgentCore

Large-scale cloud migration programs often struggle not because organizations lack engineering resources, but because repetitive activities consume too much time. Application discovery can take weeks, infrastructure-as-code (IaC) must be created individually for each workload, and post-migration operations often become a cycle of reactive troubleshooting.

When these challenges are multiplied across a portfolio of more than 300 applications and a fixed migration deadline, traditional approaches can make it difficult to maintain the required pace.

Agentic AI provides a different approach. By assigning repetitive, high-volume activities to specialized AI agents while keeping humans responsible for decisions and approvals, organizations can automate significant parts of the migration lifecycle.

Amazon Bedrock AgentCore provides a platform for building, connecting, deploying, and operating AI agents at scale. Combined with the Strands Agents SDK, Amazon Bedrock foundation models, and Model Context Protocol (MCP), it can support multi-agent workflows across discovery, infrastructure provisioning, migration governance, and post-migration operations.

A framework developed by AWS Professional Services reduced IaC development time from 3–4 weeks per application to minutes across a portfolio of more than 300 applications. This result is based on internal project tracking data, and actual results will vary depending on application complexity, organizational requirements, and existing tooling.

At a Glance

• Agentic AI can automate repetitive activities across the cloud migration lifecycle.
• Amazon Bedrock AgentCore provides the runtime, identity, gateway, memory, observability, and policy capabilities required to operate AI agents at scale.
• An Intake Agent automates application discovery and target architecture definition.
• An IaC Agent generates infrastructure code based on established organizational patterns and security standards.
• A Migration Intelligence and Governance Agent provides portfolio-wide visibility and automated reporting.
• An SRE Agent supports proactive monitoring and post-migration optimization.
• Human-in-the-loop approval gates ensure that AI agents support decision-making rather than independently executing changes in production.
• The approach integrates AWS services such as AWS Database Migration Service (AWS DMS) and AWS Transform into the broader migration workflow.

Why Large-Scale Migration Programs Need a Different Approach

Enterprise data center exit and cloud migration programs typically encounter three recurring bottlenecks.

Manual discovery and intake: Migration teams need to understand existing infrastructure, application dependencies, business requirements, and compliance constraints before defining a target architecture. Manual discovery can take weeks for a single application. Across hundreds of workloads, this becomes a significant constraint on the migration timeline.

Redundant infrastructure development: Once a target architecture has been defined, engineers need to create IaC to provision the required AWS infrastructure. Without automation and reusable patterns, developing infrastructure code from scratch can require 3–4 weeks per application.

Reactive post-migration operations: After workloads move to AWS, teams frequently rely on manual monitoring and incident response. Without proactive intelligence and automated remediation recommendations, operational overhead continues to accumulate after the migration itself is complete.

These bottlenecks affect different stages of the migration lifecycle, but they share a common characteristic: a significant amount of repetitive work can be standardized and automated.

Agentic AI provides an opportunity to shift this work to specialized agents while keeping humans in control of architectural decisions, approvals, governance, and production changes.

Multi-Agent Architecture for Cloud Migration

A multi-agent framework can address the migration lifecycle through purpose-built AI agents. Instead of relying on a single general-purpose agent, each agent is assigned a specific responsibility and operates with access to the tools and data required for that function.

The architecture can be organized into two connected journeys: the migration journey, which covers discovery through deployment, and the operations journey, which covers post-migration monitoring and optimization.

Migration Journey

• Intake Agent: Automates application discovery, dependency mapping, and target-state architecture definition.
• IaC Agent: Generates infrastructure-as-code based on approved architectural and security patterns.
• Migration Intelligence and Governance Agent: Provides portfolio-wide reporting, governance, and Well-Architected assessments.

Operations Journey

• SRE Agent: Provides proactive post-migration monitoring, recommendations, and automated remediation workflows with human approval.

AWS managed services complement these custom agents:

• AWS Database Migration Service (AWS DMS) supports database migration, including generative AI-assisted schema conversion and automated cutover capabilities.
• AWS Transform provides application-specific modernization capabilities for legacy applications and code.

How Amazon Bedrock AgentCore Connects the Components

Each agent can be implemented as a Strands agent consisting of a foundation model, system prompt, and a defined set of tools.

Amazon Bedrock AgentCore Runtime hosts agents in a serverless environment and provides capabilities for session isolation and multi-agent orchestration. Amazon Bedrock foundation models provide the reasoning capabilities required to interpret documents, generate infrastructure code, and execute multi-step workflows.

For information about foundation model availability by AWS Region, see Supported foundation models in Amazon Bedrock.

Agents can access MCP tools through AgentCore Gateway. Gateway can expose APIs, AWS Lambda functions, and existing services as MCP-compatible tools.

AgentCore Identity authenticates agent actions using scoped AWS Identity and Access Management (IAM) roles and the organization's identity provider.

AgentCore Memory stores session state and shared context. This allows one agent to pass its outputs to another without requiring manual data transfer between migration teams.

For example, after the Intake Agent completes discovery, it can store the target architecture and dependency mappings in AgentCore Memory. The IaC Agent can then retrieve this information and use it as the basis for infrastructure code generation.

Defining an AI Agent with Amazon Bedrock AgentCore

The following Python example illustrates the basic structure of an IaC Agent prepared to run on Amazon Bedrock AgentCore. The agent connects to MCP tools through AgentCore Gateway and uses an Amazon Bedrock foundation model with an Amazon Bedrock Guardrails policy.

import logging
import os
from bedrock_agentcore.runtime import BedrockAgentCoreApp
from strands import Agent
from strands.models import BedrockModel
from strands.tools.mcp import MCPClient
from strands.tools.mcp.mcp_types import MCPClientCredentials

logger = logging.getLogger(__name__)
app = BedrockAgentCoreApp()

REGION = os.environ["AWS_REGION"]

gateway = MCPClient(
    url=os.environ["GATEWAY_MCP_URL"],
    auth=MCPClientCredentials(
        client_id=os.environ["GATEWAY_CLIENT_ID"],
        client_secret=get_secret("gateway/client_secret"),
        scopes=[os.environ["GATEWAY_SCOPE"]],
    ),
)

model = BedrockModel(
    model_id=os.environ["MODEL_ID"],
    region_name=REGION,
    guardrail_id=os.environ["GUARDRAIL_ID"],
    guardrail_version=os.environ.get("GUARDRAIL_VERSION", "1"),
    guardrail_trace="enabled",
)

@app.entrypoint
def invoke(payload, context):
    prompt = (payload.get("prompt") or "").strip()

    if not prompt:
        return {
            "status": "error",
            "error": "missing required field: prompt"
        }

    try:
        agent = Agent(
            model=model,
            system_prompt=IAC_AGENT_PROMPT,
            tools=[gateway],
        )

        result = agent(prompt)

        if result.stop_reason == "guardrail_intervened":
            logger.warning(
                "guardrail blocked request, session_id=%s",
                getattr(context, "session_id", None)
            )
            return {"status": "blocked_by_guardrail"}

        return {
            "status": "ok",
            "iac": str(result)
        }

    except Exception as e:
        logger.exception(
            "invocation failed, session_id=%s",
            getattr(context, "session_id", None)
        )
        return {
            "status": "error",
            "error": str(e)
        }

if __name__ == "__main__":
    app.run()

In this architecture, the agent returns generated IaC to the caller while AgentCore Runtime manages session isolation and scaling.

For deployable examples, see the Amazon Bedrock AgentCore samples repository and the Strands Agents samples repository. Deployment guidance is available in Getting started with AgentCore Runtime.

Phase 1: Intake Agent for Automated Discovery

The Intake Agent automates one of the most time-consuming stages of a migration: understanding the existing on-premises environment and determining how applications should be deployed on AWS.

The agent can ingest:

• On-premises architecture documentation
• Application inventory information
• Migration intake questionnaires
• Dependency maps
• Existing architecture documentation

It then produces a target AWS architecture, recommended migration pattern, resource sizing specifications, dependency information, and compliance validation results.

The resulting information can be passed directly to the IaC Agent, creating an automated handoff between application discovery and infrastructure provisioning.

Phase 2: IaC Agent for Automated Infrastructure Generation

The IaC Agent provides one of the most immediately measurable benefits of the multi-agent architecture. Instead of requiring engineers to create infrastructure code from scratch for every application, the agent generates IaC using established organizational patterns and security standards.

How the IaC Agent Works

Step 1: Ingest the steering document. The agent reads the migration steering document and extracts deployment scope, compliance requirements, and approved wave-specific exceptions.

Step 2: Interpret the target architecture. Using the Intake Agent's output, the IaC Agent identifies infrastructure components, relationships, and dependencies represented in the target architecture.

Step 3: Generate IaC. The agent generates infrastructure code using approved organizational patterns. It applies wave-specific parameters, configures remote state management, implements mandatory tagging, and adds required monitoring configurations.

Step 4: Validate through Policy in AgentCore. Before execution, Policy in AgentCore evaluates tool calls against Cedar rules. It can calculate the potential scope of changes, check dependency conflicts, and validate whether the requested operation complies with the defined change window.

Step 5: Execute and report. A centralized execution plane triggers the IaC deployment, monitors its progress, and reports results through AgentCore Observability. Post-deployment validation runs automatically and compliance metrics can be updated in real time.

Custom MCP Tools as a Security Foundation

Each action can pass through custom MCP tools exposed by AgentCore Gateway and governed through AgentCore Identity and Policy in AgentCore.

AgentCore Identity authenticates individual agent actions through scoped IAM roles following the principle of least privilege. Input validation ensures that malformed requests are rejected at the boundary.

Credentials and sensitive values do not need to pass through the agent's context. Instead, AgentCore Identity can resolve secrets at runtime through a centralized credential provider.

AgentCore Observability and AWS CloudTrail provide an audit trail for agent and tool activity. Policy in AgentCore uses Cedar rules to enforce additional controls on agent operations.

Generating IaC from Approved Patterns

The IaC Agent generates infrastructure code from established organizational patterns. These patterns can encode enterprise standards into reusable constructs, including:

• Network configurations
• Security group rules
• IAM roles
• Amazon CloudWatch alarms
• Amazon Elastic Compute Cloud (Amazon EC2) configurations
• Amazon Virtual Private Cloud (Amazon VPC) layouts
• Mandatory resource tagging

This approach helps maintain consistency across migration waves while allowing engineering teams to avoid repeatedly writing infrastructure code from scratch.

It also allows security and architecture updates to propagate through approved reusable patterns and be incorporated into subsequent deployments.

IaC Agent Output

For each application, the agent can produce:

• Infrastructure-as-code
• Automated test cases
• Compliance reports
• Deployment runbooks

Generated code can be pushed directly to an existing code repository, such as AWS CodeCommit, GitLab, or Bitbucket. From there, it can enter the organization's established review and deployment pipeline without requiring a complete change to the existing toolchain.

Migration Intelligence and Governance Agent

Managing a migration portfolio of more than 300 applications requires continuous visibility into progress, architecture, dependencies, compliance, and outstanding actions.

Manual aggregation of this information creates substantial overhead for project managers, architects, and delivery teams.

The Migration Intelligence and Governance Agent provides automated, on-demand intelligence across the migration portfolio.

The agent can aggregate information from multiple enterprise systems through AgentCore Gateway:

• Jira: sprint progress, impediments, and outstanding tasks.
• Confluence: architecture documentation, migration information, and operational runbooks.
• Webex: meeting notes and action items.

The agent can provide:

• Portfolio-wide migration reporting
• Well-Architected assessments
• Compliance and governance validation
• Architecture pattern adherence tracking
• Migration progress analysis

Automated actions can include updating Confluence pages with migration status, creating Jira tasks for identified actions, and generating ServiceNow tickets for escalations.

These actions require explicit human approval before execution. This approval-gated architecture is an important design principle across the agent suite: AI agents support human decision-making rather than replacing it.

According to internal project tracking data from the implementation described by AWS Professional Services, on-demand reporting across a portfolio of more than 300 applications eliminated the need for manual aggregation. Actual results will vary depending on portfolio size, processes, and tool integrations.

Phase 3: SRE Agent for Proactive Post-Migration Operations

The migration process does not end when an application is successfully deployed to AWS. Post-migration operations are critical for maintaining application performance, reliability, and cost efficiency.

The SRE Agent is designed to shift operations from reactive troubleshooting toward proactive monitoring and optimization.

The agent can analyze Amazon CloudWatch metrics, application performance information, and historical patterns to identify potential issues before they significantly affect production workloads.

It can also publish remediation playbooks for common failure patterns and recommend optimization opportunities.

Potential areas for optimization, subject to human approval, include:

• Database cluster right-sizing
• Performance tuning
• Storage tiering
• Compute scaling
• Infrastructure efficiency improvements

This creates a continuous lifecycle in which applications are not simply migrated to AWS but can be continuously monitored and optimized after migration.

Data Migration with AWS DMS and AWS Transform

The custom AI agents can work alongside AWS managed services responsible for database migration and application modernization.

AWS Database Migration Service: DMS Schema Conversion with generative AI can reduce manual schema conversion effort by helping convert database objects that rules-based conversion may not fully handle, including stored procedures, functions, and triggers.

AWS DMS can then execute migration tasks and help reduce the cutover window. In the described architecture, the IaC Agent provisions the target infrastructure while AWS DMS performs the corresponding data migration activities.

Organizations should confirm service and feature availability in their target AWS Regions during migration planning.

AWS Transform: AWS Transform supports application-level transformation and modernization for legacy code. This extends the migration strategy beyond simple lift-and-shift approaches and can support modernization initiatives where application changes are required.

Security and Compliance by Design

Security is integrated into the architecture rather than added after the automation workflow has been created.

Key security and governance controls include:

• Security standards enforcement: Enterprise security standards can be retrieved from approved sources such as Confluence and applied during IaC generation.
• Landing zone validation: Generated infrastructure can be validated against enterprise landing zone requirements before deployment.
• Human-in-the-loop approval: Automated actions require explicit human approval before execution. Agents do not independently execute production changes.
• AgentCore Gateway coordination: AgentCore Gateway provides a controlled interface between agents and enterprise tools and services.
• CI/CD integration: Security controls and automated testing can be integrated into the existing continuous integration and continuous delivery pipeline.
• Responsible AI controls: Amazon Bedrock Guardrails can apply content filters, denied topics, sensitive information filters, and contextual grounding checks to model interactions.
• Observability and auditing: AgentCore Observability and AWS CloudTrail provide visibility into agent actions and tool calls.

Amazon Bedrock Guardrails can be applied at the inference layer so that agent workflows operate only on model outputs that meet defined policies.

This architecture aligns with the AWS shared responsibility model. AWS is responsible for security of the underlying cloud infrastructure, while customers remain responsible for security in the cloud, including configuration, access management, and workload-specific controls.

In the implementation described by AWS Professional Services, the framework maintained enterprise security standards across a portfolio of more than 300 applications while significantly increasing the speed of repetitive migration activities. Actual results will vary based on organizational requirements and security standards.

How the Agentic AI Approach Changes Cloud Migration

Migration Challenge	Traditional Approach	Agentic AI Approach
Application discovery	Manual documentation review and questionnaires	Automated document analysis, dependency mapping, and target architecture generation
Infrastructure development	Engineers create IaC for individual applications	AI generates IaC from approved enterprise patterns
Migration governance	Manual aggregation across project management and documentation systems	Automated portfolio intelligence and reporting
Compliance validation	Manual checks and reviews	Automated policy and compliance validation
Post-migration operations	Reactive monitoring and troubleshooting	Proactive monitoring, recommendations, and approved remediation

Measurable Impact

The multi-agent framework described in the AWS Professional Services implementation produced measurable improvements across the migration program.

• IaC development time reduced from weeks to minutes: Infrastructure code generation decreased from approximately 3–4 weeks per application to minutes of automated generation, based on internal project tracking data.
• Consistent infrastructure patterns: Migration waves use approved IaC patterns rather than independently developed infrastructure configurations.
• Automated security compliance: Infrastructure and deployment controls can be validated automatically with a complete audit trail.
• Improved architecture-to-deployment fidelity: The agent interprets the target architecture and generates infrastructure designed to implement it.
• On-demand portfolio reporting: Migration information across more than 300 applications can be aggregated without manual reporting processes.
• Improved wave team onboarding: Teams can provide required documentation while the framework automates subsequent analysis and infrastructure generation activities.

These metrics reflect a specific implementation and should not be interpreted as guaranteed outcomes. Results will vary depending on application complexity, migration methodology, team structure, security requirements, and existing tool integrations.

Responsible Automation: Keeping Humans in Control

One of the most important principles of the architecture is that automation does not eliminate human decision-making.

AI agents can perform repetitive analysis, generate infrastructure code, identify potential issues, prepare reports, and recommend remediation actions. However, critical operations remain subject to explicit approval gates.

This human-in-the-loop model helps organizations combine the speed and scalability of agentic AI with established governance and operational accountability.

The result is not an autonomous migration program in which AI independently controls production infrastructure. Instead, it is an AI-assisted operating model where agents perform high-volume tasks and humans retain authority over important decisions and changes.

Cleaning Up Test Resources

If you use the framework for testing or evaluation, remove resources that are no longer required to avoid ongoing AWS charges.

• Delete agents deployed to AgentCore Runtime and remove associated Gateway targets and Gateway resources.
• Delete AgentCore Memory resources used for session state and shared context.
• Delete Guardrails, Policy in AgentCore definitions, and IAM roles created specifically for testing.
• Delete Amazon CloudWatch log groups created for AgentCore Observability if the logs are no longer required.
• Delete AWS DMS replication instances and endpoints created for test migrations.

Confirm in the Amazon Bedrock AgentCore console that no active agent sessions remain.

Conclusion

Scaling a migration of hundreds of applications to AWS cannot always be solved simply by adding more engineers. At enterprise scale, the challenge is also about automating repetitive activities, standardizing infrastructure, maintaining security controls, and providing continuous visibility across the migration portfolio.

Agentic AI provides a new approach by assigning specialized tasks to purpose-built agents while keeping humans responsible for architecture, governance, approvals, and production decisions.

The multi-agent framework described by AWS Professional Services demonstrates how Amazon Bedrock AgentCore, Strands Agents, Amazon Bedrock foundation models, MCP tools, and AWS managed services can work together across the migration lifecycle.

The result is an integrated workflow that can automate application discovery, accelerate IaC generation, improve migration governance, and support proactive post-migration operations.

For organizations planning large-scale cloud migrations, this approach can help move beyond repetitive manual processes toward a more scalable, governed, and AI-assisted migration model.

As an official Amazon Web Services partner, Softprom helps organizations evaluate and implement AWS cloud solutions, including cloud migration, modernization, infrastructure automation, and AI-driven workloads. Contact Softprom to discuss how AWS services and agentic AI can support your organization's cloud transformation strategy.