AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 5 / c5.7
Enhanced Network SecurityDefense-in-depth layer: Infrastructure Capability 5 · Generative AI agentsUse case: AI that acts 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c5.7 Keep agents private and protect public agent apps

Reach AgentCore Runtime and tools over private connectivity, and front any public-facing agent application with WAF and rate limiting.

Foundational
Enhanced
Advanced
Effort: Medium Impact: Medium GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models

Implementation guidance

How to implement on AWS

Deploy VPC endpoints for AgentCore Runtime and tools for private connectivity to enterprise resources. Put AWS WAF in front of public-facing agent apps with prompt-injection detection rules and rate limiting. Capture VPC Flow Logs on agent-to-tool traffic for analysis.

Acceptance criteria

AgentCore is reached privately via VPC endpoints; public agent apps sit behind WAF with rate limiting; flow logs capture agent-tool traffic.

Practical implementation

How this control is implemented in each reference architecture:

AgentCore Runtime and tools are reached over VPC endpoints in the Generative AI account, the public agent app sits behind WAF in the Application account, and flow logs capture agent-tool traffic.

  1. Deploy VPC endpoints for AgentCore Runtime and tools so the agent reaches enterprise resources over private connectivity.
    Generative AI account AWS PrivateLink AgentCore Runtime Amazon VPC
  2. Put AWS WAF in front of public-facing agent apps with prompt-injection detection rules and rate limiting.
    Application account AWS WAF
  3. Capture VPC Flow Logs on agent-to-tool traffic for analysis.
    Generative AI account Amazon VPC CloudWatch

How to validate: AgentCore is reached privately via VPC endpoints; public agent apps sit behind WAF with rate limiting; flow logs capture agent-tool traffic.

Avoid: A public agent endpoint with no WAF and internet-routed tool calls. Front it with WAF and keep agent-tool traffic private and logged.

Generative AI OU (multi-account) →

VPC endpoints for AgentCore/tools, WAF on the public agent app, and VPC Flow Logs keep agents private and public apps protected within the account.

  1. Deploy VPC endpoints for AgentCore Runtime and tools for private connectivity.
    Generative AI tier (IAM role) AWS PrivateLink AgentCore Runtime Amazon VPC
  2. Front public-facing agent apps with AWS WAF (prompt-injection rules + rate limiting).
    Application tier (IAM role) AWS WAF
  3. Capture VPC Flow Logs on agent-tool traffic.
    In-account logging Amazon VPC CloudWatch

How to validate: AgentCore is reached via VPC endpoints; public apps sit behind WAF with rate limiting; flow logs capture agent-tool traffic.

Avoid: Exposing the agent runtime publicly. Keep it private and only expose a WAF-protected front door.

Single account (entry point) →

Threats addressed

  • Agent traffic or tool access exposed on the public internet.
  • Abuse or prompt-injection at scale against public agent endpoints.

AWS services

AWS PrivateLink AWS WAF Amazon VPC

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM02 Sensitive Information Disclosure
  • LLM06 Unbounded Consumption

NIST AI Risk Management Framework (AI 100-1)

  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Security Hub — AI Security Best Practices

  • BedrockAgentCore.1 Bedrock AgentCore runtimes should be configured with VPC network mode

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC01-BP02 Implement private network communication between foundation models and applications

OWASP GenAI Top 10 for Agentic Applications (2025)

  • ASI07 Insecure Inter-Agent Communication

Learning resources

References

  • AWS SRA for AI — Capability 5, Network security