EmerAgents on AWS: Bedrock, EventBridge, and a Governed Control Plane

AWS already runs the customer’s compute, data, and often the LLM. EmerSoftware’s job is not to reinvent the cloud — it is to put EmerAgents on top as a governed orchestration layer: tools allowlisted, events contracted, secrets in Secrets Manager, humans at write gates.

AI / LLM — Bedrock and SageMaker

Primary services: Amazon Bedrock, Amazon SageMaker.

EmerAgents treats Bedrock (or a SageMaker endpoint) as a replaceable inference backend under evaluation harnesses — not as the product. Tool calls are allowlisted; prompts never carry standing credentials.

• Model choice is a policy decision (latency, residency, cost) — the FactoryRun stays stable when the model changes.
• Evaluation suites run before a new prompt/tool pack reaches production.
• HITL gates sit in EmerAgents, not inside a Bedrock Agents demo alone.

Integration bus — EventBridge, SQS/SNS, Step Functions, API Gateway

Primary services: EventBridge, SQS, SNS, Step Functions, API Gateway.

Handoffs between EmerAgents roles and enterprise systems travel as versioned events and idempotent messages — the same pattern we use for SAP and Salesforce adapters.

• Each agent write becomes a message you can replay, not a fragile session.
• Step Functions encode long-running FactoryRuns with explicit compensation.
• API Gateway fronts only contracted operations — no open proxy to the core.

Data — S3, RDS, DynamoDB, Glue, Athena

Primary services: S3, RDS, DynamoDB, Glue, Athena.

Domain context for agents is curated and versioned. EmerAgents does not dump raw lakes into the prompt; retrieval is scoped by semantic ownership and retention policy.

• SpecBundles, ADRs, and run artifacts live in versioned object storage.
• Operational reads prefer contracted views over ad-hoc SQL from the model.
• Glue/Athena power diagnosis and ROI evidence — not unattended mutation.

Identity — IAM, Cognito, Secrets Manager

Primary services: IAM, Cognito, Secrets Manager.

The agent’s perimeter is an IAM role and a short-lived secret — never an API key pasted into a chat. Cognito covers human operators in the factory console.

• Least privilege per tool adapter (read vs write roles split).
• Secrets Manager + rotation; EmerAgents never logs secret material.
• Human approvers authenticate separately from the service identity.

Compute — Lambda, ECS/EKS

Primary services: Lambda, ECS, EKS.

Connectors, evaluation workers, and the EmerAgents control-plane services run as factory workloads — observable, scalable, and independent of any single LLM vendor.

• Lambda for thin adapters; EKS/ECS for long-lived orchestrators.
• Horizontal scale follows event volume, not “more chat sessions.”
• Observability (logs, traces, cost) closes the loop with the Operations role.

Commercial fit

Highest fit when the account is already event-driven and wants Bedrock as the model engine with EmerAgents as the factory control plane — especially SAP/Salesforce adapters hosted on Lambda or EKS.

What EmerAgents will not do

• No UI bots clicking SAP GUI, Salesforce screens, or Oracle Forms disguised as “agents.”
• No LLM with standing admin credentials or API keys pasted into prompts.
• No rip-and-replace of S/4, Salesforce, or ERP “because AI” — orchestrate the investment already paid.