Introduction

UnifyApps connects to AWS Bedrock and returns the agents that account hosts, so they can be inventoried, monitored and brought under policy alongside every other platform you run.

Bedrock connections also support model import, which makes this one of the few providers that populates both registries from one connection.

What UnifyApps discovers

Discovery reads the platform's own APIs through a connection your tenant already holds. Agents become records in the Agent Registry; models can be imported into the Model Registry through + Add Model.

Capability support

Note: Bedrock traces need instrumentation. A sweep inventories your Bedrock agents, but traces do not come through the connection. To get traces, follow the agent's Setup tab: install unifyapps-otel and openinference-instrumentation-bedrock, grant bedrock:InvokeAgent, and invoke the agent through a PREPARED alias. Until then the agent stays Setup Pending.

Before you begin

1. Create the connection first — Discovery sweeps an existing connection rather than collecting credentials. See Create a Connection.

2. Decide the account and region scope — One connection covers what its identity can reach. Multi-account or multi-region estates need a connection per boundary you intend to govern separately.

3. Agree the identity's permissions — The identity needs to enumerate agents across the scope you intend to govern. A narrowly scoped identity produces an inventory that looks complete and is not.

Add the connection

Step 1: Open + Add Application in Discovery

Step 2: Select AWS Bedrock

Step 3: Confirm Observe · Advisory

Step 4: Choose the connection and click Connect

Verify

The row shows PLATFORM as AWS Bedrock and STATUS as Connected. DISCOVERED populates once the first sweep completes. Open the connection to see the Assets table and register what matters.

Limitations

1. Observation only — Only Flag takes effect. Other actions are recorded, not executed.

2. Scope follows the identity — Agents outside the connection identity's reach are invisible, and their absence is not reported.

3. Models are imported, not swept into the registry automatically — Use + Add Model and pick from the connection's catalogue.

Troubleshooting

Fewer agents than expected. Usually account or region scope. Confirm what the connection identity can enumerate before treating it as a product limit.

The sweep completed but DISCOVERED is empty. Either the account genuinely hosts no agents, or the identity cannot list them.