AWS says the bedrock-agentcore namespace for AWS Agent Registry will shut down on October 30, 2026. Existing data will not move automatically: customers must migrate it, because any data left in the old namespace when it shuts down will be lost and read/write access will end. The migration window opened August 6, 2026. AWS’s migration guide covers the move and its technical requirements.
The change is limited to AWS Agent Registry. AWS says Identity, Gateway, Runtime, and Policy are unaffected; some workload identity and OAuth credential-provider resources also continue to use bedrock-agentcore.
Choose a migration approach
AWS’s migration tool extracts, transforms, and loads existing registries and records into new registries in the same AWS account and Region. The right approach depends on whether you need a one-time move, a managed or incremental job, or a way to keep writes flowing during cutover.
| AWS migration approach | Best fit | Data movement and cutover |
| Local or AWS CloudShell | A one-time full migration | Run the migration tool from a terminal or CloudShell; AWS says this does not require deploying infrastructure. |
| Managed AWS Glue jobs | Unattended runs or an incremental load at cutover | Deploy the provided CDK stack as Glue jobs, run an initial full migration, then load incremental changes at cutover. |
| Active-active | A production registry that continues to receive writes | Complete a full migration, write to both namespaces, validate, then switch reads and writes to agent-registry. |
Update code and integrations
Changing the namespace string is not enough. AWS lists changes to endpoints, IAM permissions and trust, resource ARNs, SDK clients, CLI commands, API schemas, and observability integrations.
The data-plane endpoint changes from bedrock-agentcore.{region}.amazonaws.com to agent-registry.{region}.api.aws; the control-plane endpoint changes from bedrock-agentcore-control.{region}.amazonaws.com to agent-registry-control.{region}.api.aws. The IAM action prefix changes from bedrock-agentcore:* to agent-registry:*, and the Registry service principal changes from bedrock-agentcore.amazonaws.com to agent-registry.amazonaws.com.
Update application code that builds or parses Registry requests and responses: AWS describes the API schema changes as backward-incompatible. The new schema requires name and recordType, restructures descriptors, renames inlineContent to data, and replaces schemaVersion and protocolVersion with dataSchemaVersion. For synchronization records, source moves into the descriptors.
The SDK clients change to AgentRegistryClient and AgentRegistryControlClient, and the CLI namespace changes from aws bedrock-agentcore to aws agent-registry. Update monitoring and event rules too: the CloudWatch namespace changes from AWS/BedrockAgentCore to AWS/AgentRegistry, while the EventBridge source changes from aws.bedrock-agentcore to aws.agent-registry. Rules matching the old source or changed detail types need updating; events continue to use the default bus.
For Registry access, AWS says to use AgentRegistryFullAccess: BedrockAgentCoreFullAccess does not automatically gain agent-registry:* permissions. Keep applicable permissions for workload identity and OAuth credential-provider resources under bedrock-agentcore rather than replacing every old-prefix permission.
Handle IAM-synchronized records before live loading
If a Registry record synchronizes using IAM-role credentials, update the role’s trust policy to trust agent-registry.amazonaws.com before live loading. AWS says the migration tool does not detect this dependency. The requirement is specific to IAM-role synchronization; it does not apply to OAuth-authenticated or unauthenticated records.
If a migrated record enters CREATE_FAILED, AWS’s recovery sequence is to correct the trust policy, delete the failed record in the new Registry, and rerun the load.
Run the migration and validate the new Registry
- Choose the migration pattern. Use a local or CloudShell run for a one-time full move, AWS Glue for managed or incremental loading, or active-active dual writes if the production Registry continues to change.
- Prepare the integrations. Update the relevant endpoints, IAM actions and trust, ARNs, SDK or CLI clients, API handling, monitoring, and EventBridge rules. For IAM-role synchronized records, fix the trust policy before live loading.
- Extract, transform, and load the records. AWS’s tool creates the destination registries in the same account and Region. Follow the load and cutover pattern for the approach you chose.
- Check the destination before relying on it. AWS recommends matching registry counts, comparing record counts per registry, spot-checking transformed records, updating integrations, and testing reads and writes.
AWS says the old Registry namespace will shut down on October 30, 2026. Read/write access there will end, and data remaining in that namespace will be lost.
