AWS bedrock-agentcore documentation change
Summary
Added advanced configuration options for private endpoints to connect to identity providers hosted inside a VPC, including managed and self-managed VPC Lattice modes with detailed networking and security group settings.
Security assessment
This change documents how to securely connect to private identity providers via VPC endpoints, which enhances security by keeping traffic within the AWS network and allowing configuration of security groups. However, there is no evidence of addressing a specific security vulnerability or incident.
Diff
diff --git a/bedrock-agentcore/latest/devguide/identity-add-oauth-client-custom.md b/bedrock-agentcore/latest/devguide/identity-add-oauth-client-custom.md index 2b87e156d..7d0cb011e 100644 --- a//bedrock-agentcore/latest/devguide/identity-add-oauth-client-custom.md +++ b//bedrock-agentcore/latest/devguide/identity-add-oauth-client-custom.md @@ -45 +45 @@ Custom providers enable you to connect to any OAuth2-compatible resource server - 6. Choose **Add OAuth Client**. + 6. (Optional) Expand **Advanced configuration** to configure a private endpoint for connecting to an identity provider hosted inside your VPC. Choose one of the following modes: @@ -46,0 +47 @@ Custom providers enable you to connect to any OAuth2-compatible resource server + 1. **Managed Lattice** : AgentCore creates and manages the VPC Lattice resource gateway and resource configuration on your behalf. This is the simpler option for in-account VPC connectivity. @@ -47,0 +49 @@ Custom providers enable you to connect to any OAuth2-compatible resource server + 1. For **VPC** , select your VPC identifier. @@ -48,0 +51,20 @@ Custom providers enable you to connect to any OAuth2-compatible resource server + 2. For **Subnets** , select one or more subnets that have network access to your IdP. + + 3. For **IP address type** , choose `IPV4` or `IPV6`. + + 4. (Optional) For **Security groups** , select security groups that allow traffic to your IdP. + + 5. (Optional) For **Routing domain** , enter a publicly resolvable domain to use for routing if your IdP domain is not publicly resolvable. For more information, see [Workaround for private DNS support: routing domain](./vpc-egress-private-endpoints.html#lattice-vpc-egress-routing-domain). + + 2. **Self-managed Lattice** : You create and manage the VPC Lattice resource gateway and resource configuration yourself. This option supports cross-account connectivity via AWS RAM and provides full governance visibility. + + 1. For **Resource configuration ARN** , select the ARN of your VPC Lattice resource configuration. + + 2. (Optional) For **Domain overrides** , enter additional domains that should be routed through the private endpoint. Use this when your identity provider endpoints (such as token or authorization endpoints) are hosted on different domains than the primary IdP domain configured in your resource configuration. + + 7. Choose **Add OAuth Client**. + + + + +For a detailed comparison of managed vs self-managed Lattice modes, see [Supported VPC egress modes](./vpc-egress-private-endpoints.html#lattice-vpc-egress-compare-modes).