AWS bedrock-agentcore documentation change
Summary
Updated VPC documentation for Amazon Bedrock AgentCore Runtime: reformatted region/availability zone table, added example sections, restructured code examples, updated VPC endpoint recommendations to strongly recommend S3 Gateway VPC Endpoint to avoid NAT gateway charges, and minor punctuation/formatting changes.
Security assessment
The changes are primarily documentation improvements, formatting updates, and cost optimization guidance. The update to VPC endpoint recommendations emphasizes avoiding NAT gateway data processing charges by using a free S3 Gateway VPC Endpoint, which is a cost and reliability consideration rather than a security fix. There is no evidence in the diff of addressing a specific security vulnerability, weakness, or incident.
Diff
diff --git a/bedrock-agentcore/latest/devguide/agentcore-vpc.md b/bedrock-agentcore/latest/devguide/agentcore-vpc.md index d23454556..2ba1bc843 100644 --- a//bedrock-agentcore/latest/devguide/agentcore-vpc.md +++ b//bedrock-agentcore/latest/devguide/agentcore-vpc.md @@ -17 +17 @@ To enable Amazon Bedrock AgentCore Runtime and built-in tools to securely access - * Maintain secure communications within your organization's network boundaries + * Maintain secure communications within your organization’s network boundaries @@ -57 +57 @@ Before configuring Amazon Bedrock AgentCore Runtime and tools for VPC access, en - * Required VPC endpoints if your VPC doesn't have internet access. For example, to configure your VPC endpoints, see VPC endpoint configuration. + * Required VPC endpoints if your VPC doesn’t have internet access. For example, to configure your VPC endpoints, see VPC endpoint configuration. @@ -76,98 +76,14 @@ Region | Region Code | Supported Availability Zones -US East (N. Virginia) | us-east-1 | - - * use1-az1 - * use1-az2 - * use1-az4 - - -US East (Ohio) | us-east-2 | - - * use2-az1 - * use2-az2 - * use2-az3 - - -US West (Oregon) | us-west-2 | - - * usw2-az1 - * usw2-az2 - * usw2-az3 - - -Asia Pacific (Sydney) | ap-southeast-2 | - - * apse2-az1 - * apse2-az2 - * apse2-az3 - - -Asia Pacific (Mumbai) | ap-south-1 | - - * aps1-az1 - * aps1-az2 - * aps1-az3 - - -Asia Pacific (Singapore) | ap-southeast-1 | - - * apse1-az1 - * apse1-az2 - * apse1-az3 - - -Asia Pacific (Tokyo) | ap-northeast-1 | - - * apne1-az1 - * apne1-az2 - * apne1-az4 - - -Europe (Ireland) | eu-west-1 | - - * euw1-az1 - * euw1-az2 - * euw1-az3 - - -Europe (Frankfurt) | eu-central-1 | - - * euc1-az1 - * euc1-az2 - * euc1-az3 - - -Europe (Stockholm) | eu-north-1 | - - * eun1-az1 - * eun1-az2 - * eun1-az3 - - -Europe (Paris) | eu-west-3 | - - * euw3-az1 - * euw3-az2 - * euw3-az3 - - -Asia Pacific (Seoul) | ap-northeast-2 | - - * apne2-az1 - * apne2-az2 - * apne2-az3 - - -Europe (London) | eu-west-2 | - - * euw2-az1 - * euw2-az2 - * euw2-az3 - - -Canada (Central) | ca-central-1 | - - * cac1-az1 - * cac1-az2 - * cac1-az4 - - +US East (N. Virginia) | us-east-1 | use1-az1 use1-az2 use1-az4 +US East (Ohio) | us-east-2 | use2-az1 use2-az2 use2-az3 +US West (Oregon) | us-west-2 | usw2-az1 usw2-az2 usw2-az3 +Asia Pacific (Sydney) | ap-southeast-2 | apse2-az1 apse2-az2 apse2-az3 +Asia Pacific (Mumbai) | ap-south-1 | aps1-az1 aps1-az2 aps1-az3 +Asia Pacific (Singapore) | ap-southeast-1 | apse1-az1 apse1-az2 apse1-az3 +Asia Pacific (Tokyo) | ap-northeast-1 | apne1-az1 apne1-az2 apne1-az4 +Europe (Ireland) | eu-west-1 | euw1-az1 euw1-az2 euw1-az3 +Europe (Frankfurt) | eu-central-1 | euc1-az1 euc1-az2 euc1-az3 +Europe (Stockholm) | eu-north-1 | eun1-az1 eun1-az2 eun1-az3 +Europe (Paris) | eu-west-3 | euw3-az1 euw3-az2 euw3-az3 +Asia Pacific (Seoul) | ap-northeast-2 | apne2-az1 apne2-az2 apne2-az3 +Europe (London) | eu-west-2 | euw2-az1 euw2-az2 euw2-az3 +Canada (Central) | ca-central-1 | cac1-az1 cac1-az2 cac1-az4 @@ -240,0 +157,2 @@ You can configure VPC access for Amazon Bedrock AgentCore Runtime and built-in t +###### Example + @@ -268,2 +186 @@ AWS CLI - - aws bedrock-agentcore-control create-agent-runtime \ + 1. aws bedrock-agentcore-control create-agent-runtime \ @@ -279 +195,0 @@ AWS CLI -AWS SDK (Python) @@ -283 +199,4 @@ AWS SDK (Python) - import boto3 +AWS SDK (Python) + + + 1. import boto3 @@ -303,0 +226,2 @@ AWS SDK (Python) +###### Example + @@ -335,2 +259 @@ AWS CLI - - aws bedrock-agentcore-control create-code-interpreter \ + 1. aws bedrock-agentcore-control create-code-interpreter \ @@ -349 +271,0 @@ AWS CLI -AWS SDK (Python) @@ -353 +275,4 @@ AWS SDK (Python) - import boto3 +AWS SDK (Python) + + + 1. import boto3 @@ -381,0 +310,2 @@ AWS SDK (Python) +###### Example + @@ -411,2 +341 @@ AWS CLI - - aws bedrock-agentcore-control create-browser \ + 1. aws bedrock-agentcore-control create-browser \ @@ -432 +360,0 @@ AWS CLI -AWS SDK (Python) @@ -436 +364,4 @@ AWS SDK (Python) - import boto3 +AWS SDK (Python) + + + 1. import boto3 @@ -472 +406 @@ Security groups act as virtual firewalls for your Amazon Bedrock AgentCore Runti - * **Inbound rules** – Ensure that the target resource's security group allows inbound connections from the security group associated with your Amazon Bedrock AgentCore Runtime. + * **Inbound rules** – Ensure that the target resource’s security group allows inbound connections from the security group associated with your Amazon Bedrock AgentCore Runtime. @@ -483 +417 @@ When your Amazon Bedrock AgentCore Runtime connects to an Amazon RDS database, c -###### Amazon Bedrock AgentCore Runtime security group +**Amazon Bedrock AgentCore Runtime security group** @@ -485 +419 @@ When your Amazon Bedrock AgentCore Runtime connects to an Amazon RDS database, c - * **Outbound** – Allow TCP traffic to the RDS database's security group on port 3306 (MySQL). + * **Outbound** – Allow TCP traffic to the RDS database’s security group on port 3306 (MySQL). @@ -492 +426 @@ When your Amazon Bedrock AgentCore Runtime connects to an Amazon RDS database, c -###### Amazon RDS database security group +**Amazon RDS database security group** @@ -503 +437 @@ When your Amazon Bedrock AgentCore Runtime connects to an Amazon RDS database, c -When running Amazon Bedrock AgentCore Runtime in a private VPC without internet access, you must configure the following VPC endpoints to ensure proper functionality: +When running Amazon Bedrock AgentCore Runtime in a VPC, we strongly recommend configuring the following VPC endpoints. These endpoints are **required** if your VPC does not have internet access, and **strongly recommended** even if your VPC has a NAT gateway, to avoid NAT gateway data processing charges. @@ -509 +443 @@ When running Amazon Bedrock AgentCore Runtime in a private VPC without internet - * Docker endpoint: `com.amazonaws.`region`.ecr.dkr` + * Docker endpoint: `com.amazonaws.region.ecr.dkr` @@ -511 +445 @@ When running Amazon Bedrock AgentCore Runtime in a private VPC without internet - * ECR API endpoint: `com.amazonaws.`region`.ecr.api` + * ECR API endpoint: `com.amazonaws.region.ecr.api` @@ -515 +449,5 @@ When running Amazon Bedrock AgentCore Runtime in a private VPC without internet - * Gateway endpoint for ECR docker layer storage: `com.amazonaws.`region`.s3` + * Gateway endpoint for ECR docker layer storage: `com.amazonaws.region.s3` + +###### Important + +For container agents, AgentCore periodically refreshes your container image from ECR, which stores image layers in Amazon S3. Without an S3 Gateway VPC Endpoint, this traffic routes through your NAT gateway and incurs data processing charges. An S3 Gateway VPC Endpoint is free and eliminates these charges. We strongly recommend adding this endpoint for all VPC-mode container agents, even if your VPC has internet access via NAT. @@ -519 +457 @@ When running Amazon Bedrock AgentCore Runtime in a private VPC without internet - * Logs endpoint: `com.amazonaws.`region`.logs` + * Logs endpoint: `com.amazonaws.region.logs` @@ -540 +478 @@ To enable internet access for your VPC-connected Amazon Bedrock AgentCore Runtim