AWS bedrock-agentcore documentation change
Summary
Updated service name references from 'Amazon Bedrock AgentCore' to 'AgentCore' and expanded VPC connectivity documentation to include inbound traffic handling via VPC endpoints with PrivateLink for secure API access
Security assessment
The change adds documentation about establishing private connectivity via VPC endpoints using AWS PrivateLink for inbound traffic, which enhances security by enabling secure API calls without internet traversal. While this improves security documentation, there is no evidence it addresses a specific existing vulnerability.
Diff
diff --git a/bedrock-agentcore/latest/devguide/agentcore-vpc.md b/bedrock-agentcore/latest/devguide/agentcore-vpc.md index 50fb9cb72..be0cb8c34 100644 --- a//bedrock-agentcore/latest/devguide/agentcore-vpc.md +++ b//bedrock-agentcore/latest/devguide/agentcore-vpc.md @@ -13 +13 @@ You can configure Amazon Bedrock AgentCore Runtime and built-in tools (Code Inte -To enable Amazon Bedrock AgentCore Runtime and built-in tools to securely access resources in your private VPC, Amazon Bedrock AgentCore provides VPC connectivity capabilities. This feature allows your runtime and tools to: +To enable Amazon Bedrock AgentCore Runtime and built-in tools to securely access resources in your private VPC, AgentCore provides VPC connectivity capabilities. This feature allows your runtime and tools to: @@ -39 +39 @@ When you configure VPC connectivity for Amazon Bedrock AgentCore Runtime and too -VPC connectivity impacts only outbound network traffic from the runtime or tool. Inbound requests to the runtime (such as invocations) are not routed through the VPC and are unaffected by this configuration. +VPC connectivity impacts inbound and outbound network traffic from AgentCore services. When you host your application in an AWS VPC, you can establish private connectivity to the AgentCore Runtime and AgentCore Gateway APIs by adding the AgentCore VPC endpoint to your VPC. This enables secure API calls, without internet traversal, through VPC PrivateLink inbound connections. @@ -62 +62 @@ Before configuring Amazon Bedrock AgentCore Runtime and tools for VPC access, en -Amazon Bedrock AgentCore creates a network interface in your account with a private IP address. Using a public subnet does not provide internet connectivity. To enable internet access, place it in private subnets with a route to a NAT Gateway. +AgentCore creates a network interface in your account with a private IP address. Using a public subnet does not provide internet connectivity. To enable internet access, place it in private subnets with a route to a NAT Gateway. @@ -66 +66 @@ Amazon Bedrock AgentCore creates a network interface in your account with a priv -Amazon Bedrock AgentCore supports VPC connectivity in specific Availability Zones within each supported region. When configuring subnets for your Amazon Bedrock AgentCore Runtime and built-in tools, ensure that your subnets are located in the supported Availability Zones for your region. +AgentCore supports VPC connectivity in specific Availability Zones within each supported region. When configuring subnets for your Amazon Bedrock AgentCore Runtime and built-in tools, ensure that your subnets are located in the supported Availability Zones for your region. @@ -147 +147 @@ To identify the Availability Zone ID of your subnets, you can use the following -Amazon Bedrock AgentCore uses the service-linked role `AWSServiceRoleForBedrockAgentCoreNetwork` to create and manage network interfaces in your VPC. This role is automatically created when you first configure Amazon Bedrock AgentCore Runtime or AgentCore built-in tools to use VPC connectivity. +AgentCore uses the service-linked role `AWSServiceRoleForBedrockAgentCoreNetwork` to create and manage network interfaces in your VPC. This role is automatically created when you first configure Amazon Bedrock AgentCore Runtime or AgentCore built-in tools to use VPC connectivity. @@ -587 +587 @@ Enable CloudWatch Logs for your Amazon Bedrock AgentCore Runtime to identify any -To verify that your Amazon Bedrock AgentCore Runtime and tools have proper VPC connectivity, you can test connections to your private resources and verify that network interfaces are created correctly in your specified subnets. +To verify that your AgentCore Runtime and tools have proper VPC connectivity, you can test connections to your private resources and verify that network interfaces are created correctly in your specified subnets. @@ -589 +589 @@ To verify that your Amazon Bedrock AgentCore Runtime and tools have proper VPC c -To verify that your Amazon Bedrock AgentCore tool has internet access, you can configure a Code Interpreter with your VPC configuration and use the `Invoke` API with `executeCommand` that attempts to connect to a public API or website using `curl` command and check the response. If the connection times out, review your VPC configuration, particularly your route tables and NAT gateway setup. +To verify that your AgentCore tool has internet access, you can configure a Code Interpreter with your VPC configuration and use the `Invoke` API with `executeCommand` that attempts to connect to a public API or website using `curl` command and check the response. If the connection times out, review your VPC configuration, particularly your route tables and NAT gateway setup.