AWS bedrock-agentcore documentation change
Summary
Added 'Supported Availability Zones' section with regional AZ mappings and validation requirements for VPC configuration
Security assessment
The changes provide operational guidance about supported AZs for VPC configuration but don't address specific security vulnerabilities. While VPC configuration impacts security posture, this update focuses on compatibility requirements rather than security controls.
Diff
diff --git a/bedrock-agentcore/latest/devguide/agentcore-vpc.md b/bedrock-agentcore/latest/devguide/agentcore-vpc.md index 3013e26e2..97e929342 100644 --- a//bedrock-agentcore/latest/devguide/agentcore-vpc.md +++ b//bedrock-agentcore/latest/devguide/agentcore-vpc.md @@ -5 +5 @@ -VPC connectivity for Amazon Bedrock AgentCore Runtime and toolsPrerequisitesIAM permissionsBest practicesConfiguring VPC access for runtime and toolsSecurity group considerationsVPC endpoint configurationMonitoring and troubleshooting +VPC connectivity for Amazon Bedrock AgentCore Runtime and toolsPrerequisitesSupported Availability ZonesIAM permissionsBest practicesConfiguring VPC access for runtime and toolsSecurity group considerationsVPC endpoint configurationMonitoring and troubleshooting @@ -44,0 +45,2 @@ Before configuring Amazon Bedrock AgentCore Runtime and tools for VPC access, en + * Subnets located in supported Availability Zones for your region. For information about supported Availability Zones, see Supported Availability Zones. + @@ -59,0 +62,46 @@ Amazon Bedrock AgentCore creates a network interface in your account with a priv +## Supported Availability Zones + +Amazon Bedrock AgentCore supports VPC connectivity in specific Availability Zones within each supported region. When configuring subnets for your Amazon Bedrock AgentCore Runtime and built-in tools, ensure that your subnets are located in the supported Availability Zones for your region. + +The following table shows the supported Availability Zone IDs for each region: + +Region | Region Code | Supported Availability Zones +---|---|--- +US West (Oregon) | us-west-2 | + + * usw2-az1 (us-west-2a) + * usw2-az2 (us-west-2b) + * usw2-az3 (us-west-2c) + + +US East (N. Virginia) | us-east-1 | + + * use1-az1 (us-east-1a) + * use1-az2 (us-east-1b) + * use1-az4 (us-east-1d) + + +Europe (Frankfurt) | eu-central-1 | + + * euc1-az1 (eu-central-1a) + * euc1-az2 (eu-central-1b) + * euc1-az3 (eu-central-1c) + + +Asia Pacific (Sydney) | ap-southeast-2 | + + * apse2-az1 (ap-southeast-2a) + * apse2-az2 (ap-southeast-2b) + * apse2-az3 (ap-southeast-2c) + + + +###### Important + +Subnets must be located in the supported Availability Zones listed above. If you specify subnets in unsupported Availability Zones, the configuration will fail during resource creation. + +To identify the Availability Zone ID of your subnets, you can use the following CLI command: + + + aws ec2 describe-subnets --subnet-ids subnet-12345678 --query 'Subnets[0].AvailabilityZoneId' + @@ -86 +134 @@ For optimal performance and security with VPC-connected Amazon Bedrock AgentCore - * Configure at least two private subnets in different Availability Zones. + * Configure at least two private subnets in different Availability Zones. For a list of supported Availability Zones, see Supported Availability Zones.