What Happens When a User Runs a Query

This traces the end-to-end flow inside AWS Bedrock AgentCore when a user runs a query, and shows how charges are applied at each component so you can reason about cost.

How it works

1. 1AgentCore Identity authenticates the user (no charge).
2. 2AgentCore Policies evaluate what the request can do (no charge).
3. 3AgentCore Runtime (Strands agent) orchestrates the session (charged: compute + LLM tokens).
4. 4Knowledge Bases retrieve relevant context (charged per query/data); Gateway invokes tools (charged per call).
5. 5Backend tools run business logic (your AWS charges); the runtime returns the response (no extra charge).

Key points

• Not charged: identity, policies, observability/logs, session storage, response storage.
• Charged: runtime (LLM + compute), knowledge base retrieval, gateway tool calls, your backend AWS usage.
• Charges are metered only for components that are used.
• You pay for what you use — LLM/runtime, knowledge retrieval and tool calls.

Why it matters

Understanding where charges apply helps you optimise cost — trimming tokens, caching retrieval and minimising tool calls where they matter most.

Frequently asked questions

What isn't charged?

Identity, policies, observability/logs, session and response storage are included.

Where do the main costs come from?

The runtime (LLM tokens + compute), knowledge base retrieval and gateway tool calls.