Securing Amazon Bedrock AgentCore Runtime with AWS WAF

Amazon Bedrock AgentCore Runtime can be secured with AWS WAF by integrating it with an internet-facing Application Load Balancer (ALB) and routing traffic through a VPC Interface Endpoint. However, standard ALB health checks fail due to AgentCore's authentication requirements, prompting the need for alternative architecture patterns. Two patterns are presented: one using an AWS Lambda proxy and the other targeting VPC Endpoint ENI IP addresses directly, both of which have been tested with SigV4 and OAuth authentication. The practical implication for engineers building AI systems is the ability to secure their generative AI agents with web application firewall policies and rate limiting while maintaining authentication and authorization.

⚡ Key Takeaways

• AWS WAF integrates with Elastic Load Balancing Application Load Balancers (ALBs) to provide rate limiting, SQL injection protection, XSS filtering, and bot control.
• AgentCore Runtime requires authentication, SigV4 or OAuth, on API calls, including health check requests, which standard ALB health checks cannot handle.
• Two architecture patterns are presented to address the health check issue: one using an AWS Lambda proxy and the other targeting VPC Endpoint ENI IP addresses directly.
• The VPC Interface Endpoint (com.amazonaws.<region>.bedrock-agentcore) provides private connectivity to AgentCore through PrivateLink.
• AgentCore Runtime supports both SigV4 and OAuth authentication on internal port 8080.

Securing Amazon Bedrock AgentCore Runtime with AWS WAF is crucial for protecting generative AI agents from common web threats and enforcing rate limiting, which is essential for maintaining the integrity and reliability of AI systems in production environments. By using the presented architecture patterns, engineers can ensure the security and authenticity of their AI agents while maintaining the

✅ Practical Steps

1. Integrate AWS WAF with an internet-facing Application Load Balancer (ALB) to secure Amazon Bedrock AgentCore Runtime.
2. Use an AWS Lambda proxy or target VPC Endpoint ENI IP addresses directly to address the health check issue with standard ALB health checks.
3. Configure the VPC Interface Endpoint (com.amazonaws.<region>.bedrock-agentcore) to provide private connectivity to AgentCore through PrivateLink.
4. Implement SigV4 or OAuth authentication on AgentCore Runtime to ensure secure and authorized access to the AI agents.

Want the full story? Read the original article.