AWS bedrock-agentcore documentation change
Summary
Updated AWS PrivateLink endpoint structure from single endpoint to three separate endpoints (data plane, control plane, gateway) and added detailed support table for primitives
Security assessment
Change clarifies VPC endpoint configuration but doesn't address a specific security vulnerability. Network isolation through PrivateLink is a security best practice, but this update is primarily structural/organizational documentation.
Diff
diff --git a/bedrock-agentcore/latest/devguide/vpc-interface-endpoints.md b/bedrock-agentcore/latest/devguide/vpc-interface-endpoints.md index b1161411d..f425b3162 100644 --- a//bedrock-agentcore/latest/devguide/vpc-interface-endpoints.md +++ b//bedrock-agentcore/latest/devguide/vpc-interface-endpoints.md @@ -19 +19 @@ Before you set up an interface endpoint for AgentCore, review [Considerations](h -AgentCore supports the following primitives through the singular interface endpoint `com.amazonaws.`region`.bedrock-agentcore`: +AgentCore provides three AWS PrivateLink endpoints: @@ -21 +21 @@ AgentCore supports the following primitives through the singular interface endpo - * **Runtime** \- Agent runtime operations + * **Data plane endpoint** \- `com.amazonaws.`region`.bedrock-agentcore` @@ -23 +23 @@ AgentCore supports the following primitives through the singular interface endpo - * **Built-in Tools** \- Code Interpreter and Browser Tool operations + * **Control plane endpoint** \- `com.amazonaws.`region`.bedrock-agentcore-control` @@ -25 +25 @@ AgentCore supports the following primitives through the singular interface endpo - * **Memory** \- Memory store operations + * **Gateway endpoint** \- `com.amazonaws.`region`.bedrock-agentcore.gateway` @@ -27 +26,0 @@ AgentCore supports the following primitives through the singular interface endpo - * **Identity** \- Identity management operations @@ -30,0 +30 @@ AgentCore supports the following primitives through the singular interface endpo +The following table shows AWS PrivateLink support status for each AgentCore primitive: @@ -32,10 +32,7 @@ AgentCore supports the following primitives through the singular interface endpo -The following primitive uses a separate endpoint: - - * **AgentCore Gateway** \- Uses endpoint `com.amazonaws.`region`.bedrock-agentcore.gateway` - - - - -###### Note - -AWS PrivateLink is currently not supported for AgentCore control plane endpoints. +AWS PrivateLink support by primitive Primitive | Data plane | Control plane +---|---|--- +Runtime | Supported | Supported +Memory | Supported | Supported +Built-in Tools (Code Interpreter, Browser Tool) | Supported | Supported +Identity | Supported | Not yet supported +Gateway | Supported | Not yet supported @@ -57 +54 @@ Create an interface endpoint for AgentCore using the following service name form - * All primitives (Runtime, Built-in Tools, Memory, Identity): `com.amazonaws.`region`.bedrock-agentcore` + * All data plane primitives (Runtime, Built-in Tools, Memory, Identity): `com.amazonaws.`region`.bedrock-agentcore` @@ -60,0 +58,2 @@ Create an interface endpoint for AgentCore using the following service name form + * For control plane operations (Runtime and Memory management): `com.amazonaws.`region`.bedrock-agentcore-control` +