c1.7 Keep model access private with VPC endpoints

Keep inference traffic off the public internet

By default, calling Amazon Bedrock goes to a public service endpoint. With AWS PrivateLink you create an interface VPC endpoint so your workloads reach Bedrock over private connectivity inside your VPC — no internet gateway, NAT, or public IP involved. Traffic stays on the AWS network, and you can require that only approved networks reach the model API.

Bedrock exposes separate endpoints for the control plane and the data plane; the runtime (invocation) service is com.amazonaws.<region>.bedrock-runtime. Create the interface endpoint for that service in the subnets your workloads run in, with a security group that only allows the app tier.

Lock the endpoint down with an endpoint policy

An endpoint policy is a resource-based policy on the VPC endpoint itself. Even if an identity has broad IAM permissions elsewhere, the endpoint policy caps what can pass through this endpoint — so a leaked credential used from outside your network cannot invoke the model. This example allows only invoke actions on approved models:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowInvokeApprovedModelsThroughEndpoint",
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-5-sonnet-20240620-v1:0"
      ]
    }
  ]
}

Complete the private path

• Turn off the public route: use a security group and network design so the app tier can only reach Bedrock through the endpoint.
• Pair this with the IAM control's aws:SourceVpce condition so invocation policies also require the approved endpoint — defense in depth from both the network and the identity side.
• Enable private DNS on the endpoint so the standard Bedrock SDK/endpoint hostname resolves to the private interface automatically, with no code change.

Naming note: create the endpoint in every Region where you invoke Bedrock, and reference the matching com.amazonaws.<region>.bedrock-runtime service name.