Engineering teams adopting the AI-Driven Development Lifecycle (AI-DLC) with Amazon Bedrock AgentCore and coding agents often face a gap between conceptual frameworks and working code. Two new reference implementations from AWS demonstrate concrete patterns for the AI-DLC construction phase, providing deployment-ready architectures for automated diagram generation and multi-agent code security analysis.
The implementations use Amazon Bedrock AgentCore, a service for building and scaling agents with any framework or model. Both projects link to complete deployment instructions in their respective GitHub repositories, giving developers a direct path from theory to production.
SQL schema to ER diagram automation
The first reference implementation auto-generates Mermaid entity relationship diagrams from SQL schema files. When developers check SQL code into an Amazon Simple Storage Service (S3) bucket, an event-driven workflow triggers the AgentCore runtime. The agent parses data definition language statements and produces .mmd diagram files saved back to S3.
The architecture uses a serverless pattern with S3 event triggers, AWS Lambda functions, and Amazon Cognito for OAuth2 machine-to-machine authentication. A containerized agent built with the Strands framework runs on AgentCore runtime, using Claude Sonnet 4 to analyze table structures, constraints, and foreign key relationships. AgentCore memory provides persistent session context with a 90-day expiry, supporting semantic search across previous analyses.
Key design decisions include chunked processing for large schemas with hundreds of tables, structured prompting that extracts metadata before generating diagram syntax, and OpenTelemetry instrumentation for observability into processing duration and error attribution.
Multi-agent code security analysis
The second implementation scans Python and Java code for security vulnerabilities, CVE risks in dependencies, and policy violations. Code pushed from a GitLab pipeline to S3 triggers a multi-agent workflow that produces quality scores from 1 to 10 and specific recommendations, surfaced through a real-time web dashboard.
The architecture separates concerns across three components. A code analysis agent on AgentCore runtime performs deep review of structure, logic quality, memory handling, and security patterns. Policy checking and CVE scanning are delegated to dedicated Lambda functions invoked through AgentCore Gateway using Model Context Protocol (MCP) tools. Results persist in AgentCore memory with three distinct strategies: semantic storage for detailed findings, summary storage for dashboard metrics, and user preference storage for interface customization.
This gateway-mediated tool invocation decouples the agent from implementation details and allows new security tools to be added without modifying agent code. Each component remains single-purpose and independently updatable.
Local agentic tools in the workflow
The reference implementations also demonstrate how local coding agents complement cloud-based AgentCore deployments. Kiro supports spec-driven development, transforming natural language requirements into structured specifications with acceptance criteria. Custom Kiro skills encode organizational coding standards so AI-generated code consistently meets enterprise quality bars.
The SQL-to-diagram project includes an OpenAI ChatGPT Codex integration with a local MCP server that connects to MySQL databases through INFORMATION_SCHEMA, exposing tools for schema summarization and diagram generation without accessing row data. Claude Code operates as a local command-line agent for rapid prototyping, infrastructure-as-code generation, and first-pass code review before code enters the CI/CD pipeline where the secure software handoff system provides authoritative analysis.
Recommended practices for production deployment
The AWS team recommends separating agent concerns so each agent has a single responsibility, using AgentCore memory for context continuity across sessions, and instrumenting with OpenTelemetry from day one. Configuration should be stored in Parameter Store rather than hardcoded, with OAuth2 client credentials flow for service-to-service authentication.
For production, teams should integrate agents through CI/CD events rather than manual uploads, and apply Amazon Bedrock Guardrails to block outputs containing insecure code patterns or hallucinated CVE references. The S3 trigger pattern translates directly to GitLab webhook or GitHub Actions integration. Both reference implementations are available on GitHub with step-by-step deployment scripts.
Why this matters for IT and development professionals
These reference implementations close the gap between AI-DLC theory and working code. Instead of starting from scratch, development teams can deploy the SQL-to-diagram sample as their first AgentCore agent, then extend the pattern with multi-agent coordination using the secure software handoffs sample. For developers adopting these practices, structured learning paths in AI for Software Developers provide additional context on integrating agentic workflows into existing CI/CD pipelines. The architecture patterns shown here - event-driven triggers, gateway-mediated tool invocation, and persistent memory with semantic search - represent a repeatable foundation for composing AI-driven development workflows from modular components.
Your membership also unlocks:
