AWS securityhub high security documentation change
Summary
Added new security control [BedrockAgentCore.7] requiring private network configuration for custom code interpreters to prevent public exposure.
Security assessment
The change explicitly addresses a security vulnerability by preventing public/sandbox network modes that could lead to unauthorized access and data exfiltration. The high-severity control provides concrete remediation guidance to mitigate this risk.
Diff
diff --git a/securityhub/latest/userguide/bedrockagentcore-controls.md b/securityhub/latest/userguide/bedrockagentcore-controls.md index 4144aa428..941b7428e 100644 --- a//securityhub/latest/userguide/bedrockagentcore-controls.md +++ b//securityhub/latest/userguide/bedrockagentcore-controls.md @@ -7 +7 @@ -[BedrockAgentCore.1] Bedrock AgentCore runtimes should be configured with VPC network mode[BedrockAgentCore.2] Bedrock AgentCore Gateways should require authorization for inbound requests[BedrockAgentCore.3] Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys[BedrockAgentCore.4] Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys[BedrockAgentCore.5] Bedrock AgentCore custom browsers should not use public network mode[BedrockAgentCore.6] Bedrock AgentCore custom browsers should have session recording enabled +[BedrockAgentCore.1] Bedrock AgentCore runtimes should be configured with VPC network mode[BedrockAgentCore.2] Bedrock AgentCore Gateways should require authorization for inbound requests[BedrockAgentCore.3] Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys[BedrockAgentCore.4] Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys[BedrockAgentCore.5] Bedrock AgentCore custom browsers should not use public network mode[BedrockAgentCore.6] Bedrock AgentCore custom browsers should have session recording enabled[BedrockAgentCore.7] Bedrock AgentCore custom code interpreters should use a private network configuration @@ -148,0 +149,22 @@ For instructions on how to enable browser session recording, see [Session Record +## [BedrockAgentCore.7] Bedrock AgentCore custom code interpreters should use a private network configuration + +**Category:** Protect > Secure network configuration > Resources within VPC + +**Severity:** High + +**Resource type:** `AWS::BedrockAgentCore::CodeInterpreterCustom` + +**AWS Config rule:** [bedrockagentcore-codeinterpreter-networkmode-check](https://docs.aws.amazon.com/config/latest/developerguide/bedrockagentcore-codeinterpreter-networkmode-check.html) + +**Schedule type:** Change triggered + +**Parameters:** None + +This control checks whether an Amazon Bedrock AgentCore custom code interpreter is configured with a private network mode. The control fails if the network mode is set to `PUBLIC` or `SANDBOX`. + +Configuring Bedrock AgentCore custom code interpreters with a private network mode ensures that code execution environments are isolated within your VPC. Public or sandbox network modes expose the code interpreter to the internet, increasing the risk of unauthorized access and data exfiltration. Using private network mode restricts network access and helps protect sensitive data processed during code interpretation. + +### Remediation + +To remediate this finding, delete the non-compliant Bedrock AgentCore custom code interpreter and recreate it with VPC network mode. For instructions, see [Configuring VPC access for runtime and tools](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html#agentcore-configuration) in the _Amazon Bedrock AgentCore Developer Guide_. + @@ -155 +177 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -AWS Batch controls +Amazon Bedrock controls