A reference architecture released this week demonstrates how to run a multimodal WhatsApp ordering assistant on Amazon Bedrock AgentCore, handling text messages, voice notes, and phone calls through a single backend while preserving a shared customer memory.
Solution Overview
The design isolates three concerns: the WhatsApp front‑end, per‑channel agent runtimes, and the restaurant backend. Incoming messages arrive at a single HTTPS webhook, which immediately returns 200 and forwards the payload to an Amazon SQS queue. A Lambda worker then drives the appropriate AgentCore runtime – one for text, one for voice notes, and one for live calls – which invoke Amazon Nova 2 Lite via the Bedrock Converse API or Amazon Nova 2 Sonic for speech‑to‑speech. The agents call the restaurant services through the Model Context Protocol (MCP) exposed by an AgentCore Gateway, and all session state is stored in a shared AgentCore memory record keyed by a hashed customer identifier.
Key AWS Components
- Amazon API Gateway – provides a public webhook endpoint (regional HTTPS) and an IAM‑protected internal API for ordering logic.
- AWS Lambda – hosts the webhook ingest, queue worker, message sender, and business‑logic functions.
- Amazon SQS – decouples the fast acknowledgment path from the longer processing chain; includes a dead‑letter queue for failed messages.
- AgentCore runtime – runs each conversation in an isolated microVM, ensuring per‑channel sandboxing.
- Amazon Nova 2 Lite and Nova 2 Sonic – provide text and real‑time speech capabilities via the Bedrock APIs.
- AgentCore Gateway – a managed MCP server that maps backend REST calls to tool names the agents can invoke.
- AgentCore memory – a single cross‑channel store keyed by a hashed customer ID, enabling continuity across text and voice interactions.
- Amazon DynamoDB – holds customer profiles, menus, carts, orders, and a “last inbound” window table used by the WhatsApp layer.
- Amazon Location Service – supplies geocoding and nearest‑store lookup.
- Amazon Kinesis Video Streams – creates a TURN‑based signaling channel for live voice calls.
Operational Implications
Deploying the stack with the AWS CDK produces a set of dependent CloudFormation stacks, each responsible for a logical layer. Because the webhook returns instantly, latency is driven by downstream Lambda processing and Bedrock model calls, not by the public API. The use of microVM‑based AgentCore runtimes isolates failures to a single conversation, simplifying troubleshooting. Shared AgentCore memory reduces duplicate state management but requires careful key design to avoid collisions.
Scaling is primarily a function of the API Gateway request volume, SQS throughput, and Lambda concurrency limits. Bedrock model quotas and pricing will dictate the cost ceiling for high‑volume text or voice sessions. The architecture also enables incremental channel addition – a new Lambda that reads from the same queue and spins up a dedicated AgentCore runtime can be introduced without touching the backend.
Security and Data Isolation Considerations
The public webhook is the only internet‑facing surface; it is protected by an AWS‑managed TLS certificate. IAM authorizes the internal ordering API, limiting access to the Lambda functions that own the business logic. AgentCore runtimes run in isolated microVMs, providing a boundary between conversations. Customer identifiers are hashed before being used as memory keys, reducing the risk of direct identifier exposure.
Because the solution relies on multiple AWS services, the attack surface includes misconfigured IAM policies for Lambda, SQS, and DynamoDB. Practitioners should audit role permissions to follow the principle of least privilege and enable CloudTrail logging for all service interactions. The dead‑letter queue should be monitored for processing failures that could indicate malformed payloads or model errors.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
Teams can now deliver a unified ordering experience across WhatsApp text, voice notes, and calls without building separate backends for each channel. The pattern emphasizes asynchronous webhook handling, isolated agent runtimes, and a shared memory model, which together simplify scaling and fault isolation. Engineers should focus on CDK stack versioning, Lambda concurrency tuning, and strict IAM scoping to keep the deployment secure and cost‑effective. Monitoring the SQS dead‑letter queue and Bedrock usage metrics will be essential for maintaining reliability as traffic grows.
