Enhanced Network Security Capability 4 · Tools 👤 Customer

c4.6 Keep tool integration on private connectivity

Reach AgentCore Gateway and Runtime over private network paths and inspect traffic to external tools, so tool integration is not exposed to the internet and an agent cannot get around the egress allow-list.

Foundational

Enhanced

Advanced

Effort: Medium Impact: Medium GenAI scopes: 3 · Pre-trained models; 4 · Fine-tuned models

Implementation guidance

How to implement on AWS

Create VPC endpoints (AWS PrivateLink) for AgentCore Gateway and Runtime, deploy Lambda tools in private subnets with restrictive security groups, and restrict endpoint access to authorized applications. Use AWS Network Firewall to inspect traffic between the AI app and external tools, and turn on Route 53 resolved IP validation so the firewall only allows connections to IPs the VPC Resolver actually returned. Run AgentCore Runtime in VPC network mode: in public mode its traffic never reaches your firewall.

Acceptance criteria

AgentCore is reached via PrivateLink; tools run in private subnets; endpoint policies restrict callers; egress to external tools is inspected; AgentCore Runtime uses VPC network mode; resolved IP validation blocks connections to IPs the VPC Resolver did not return.

Practical implementation

How this control is implemented in each reference architecture:

AgentCore Gateway/Runtime are reached over PrivateLink in the Generative AI account, tools run in private subnets, and Network Firewall inspects egress to external tools with resolved IP validation so the allow-list cannot be bypassed.

Create VPC endpoints (AWS PrivateLink) for AgentCore Gateway and Runtime and restrict endpoint access to authorized applications.

Generative AI account AWS PrivateLink AgentCore Gateway Amazon VPC
Deploy Lambda tools in private subnets with restrictive security groups so they have no direct internet path.

Generative AI account AWS Lambda Amazon VPC
Use AWS Network Firewall to inspect traffic between the AI app and external tools for malicious patterns.

Network / inspection Network Firewall
Turn on Route 53 resolved IP validation on the Network Firewall policy, with a DNS Firewall rule group associated with the agent and tool VPCs, so an agent cannot reach an IP the VPC Resolver did not return. If inspection is centralized, add the agent VPC CIDRs as source ranges (by default only the firewall VPC's own CIDR is validated) and use a Transit Gateway-attached firewall. Start in ALERT mode, then switch to DROP. Run AgentCore Runtime in VPC network mode so its egress actually traverses the firewall.

Network / inspection Network Firewall Route 53 DNS Firewall AgentCore Runtime

How to validate: AgentCore is reached via PrivateLink; tools run in private subnets; endpoint policies restrict callers; egress to external tools is inspected; a test connection from the agent to an unrelated IP while claiming an allowed domain is blocked by resolved IP validation.

Avoid: Letting tools reach external APIs directly over the internet with no inspection, or trusting a domain allow-list on its own. Route egress through inspection and validate destination IPs so tool traffic is visible and controllable.

Generative AI OU (multi-account) →

PrivateLink to AgentCore, tools in private subnets, and Network Firewall egress inspection with resolved IP validation keep tool integration off the public internet within the account.

Create PrivateLink endpoints for AgentCore Gateway/Runtime and restrict them to the app.

Generative AI tier (IAM role) AWS PrivateLink AgentCore Gateway Amazon VPC
Run Lambda tools in private subnets with restrictive security groups.

Generative AI tier (IAM role) AWS Lambda Amazon VPC
Inspect egress to external tools with AWS Network Firewall.

Generative AI tier (IAM role) Network Firewall
Turn on Route 53 resolved IP validation on the firewall policy, with a DNS Firewall rule group associated with the agent VPC. Start in ALERT mode, then switch to DROP, and route each subnet to the firewall endpoint in its own Availability Zone. Run AgentCore Runtime in VPC network mode so its egress traverses the firewall.

Generative AI tier (IAM role) Network Firewall Route 53 DNS Firewall AgentCore Runtime

How to validate: AgentCore is reached via PrivateLink; tools run in private subnets; egress to external tools is inspected; connections to IPs the VPC Resolver did not return are blocked.

Avoid: Tools with open outbound internet access, or an allow-list an agent can sidestep by connecting straight to an IP. Constrain, inspect, and validate egress so a compromised tool cannot freely exfiltrate.

Single account (entry point) →

Threats addressed

Tool integration traffic exposed on the public internet.
Man-in-the-middle or malicious patterns in tool communication.
A prompt-injected agent or compromised tool exfiltrating data by connecting straight to an attacker's IP address, spoofing an allowed domain in the SNI/Host, or using SSH/SFTP, which a domain allow-list alone does not stop.

AWS services

AWS PrivateLink Amazon Bedrock AgentCore

AWS Network Firewall

Amazon Route 53 Resolver DNS Firewall

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

LLM02 Sensitive Information Disclosure

NIST AI Risk Management Framework (AI 100-1)

MANAGE.1 AI risks are prioritized, responded to and managed

AWS Security Hub — AI Security Best Practices

BedrockAgentCore.1 Bedrock AgentCore runtimes should be configured with VPC network mode
BedrockAgentCore.5 Bedrock AgentCore custom browsers should not use public network mode

AWS Well-Architected Generative AI Lens (Security)

GENSEC01-BP02 Implement private network communication between foundation models and applications