Secure Amazon Bedrock AgentCore Runtime with AWS WAF

A new guide outlines two distinct architectural approaches for enhancing the security of Amazon Bedrock AgentCore Runtime deployments. Both methods leverage an internet-facing Application Load Balancer (ALB) integrated with AWS WAF to manage incoming traffic, directing it through a VPC Interface Endpoint to the AgentCore Runtime. The first pattern introduces an AWS Lambda proxy between the ALB and the VPC Endpoint, offering granular control over request modifications. The second, more direct pattern, routes traffic from the ALB straight to the VPC Endpoint's Elastic Network Interface (ENI) IP addresses, eliminating the Lambda layer. The guide also provides instructions on implementing a resource policy to prevent direct access, ensuring all traffic is filtered through AWS WAF, and confirms end-to-end testing with SigV4 and OAuth (Amazon Cognito JWT) authentication.