Amazon Bedrock AgentCore Secures Traffic with AWS WAF
AWS documented two patterns for putting AWS WAF in front of Amazon Bedrock AgentCore Runtime while preserving SigV4 or OAuth authentication. The July 8, 2026 AWS post uses an internet-facing Application Load Balancer and a VPC Interface Endpoint, then offers either a Lambda proxy for request transformation or direct targeting of VPC Endpoint ENI IPs for a simpler path. For practitioners, the operational lesson is specific: standard ALB health checks fail because AgentCore requires authenticated API calls, and teams must close the direct-access bypass with resource policies. This is practical security guidance for production agent endpoints, not a new AgentCore feature announcement.
Production agent endpoints need perimeter inspection without breaking authentication. AWS's guidance is useful because it describes the networking and policy tradeoffs required to put WAF controls in front of an authenticated managed runtime.
What happened
AWS published a technical how-to on securing Amazon Bedrock AgentCore Runtime with AWS WAF. The post explains that CloudFront caching is a poor fit for dynamic agent invocations and that API Gateway can create double-authentication problems with AgentCore's built-in SigV4 and OAuth handling. AWS instead recommends an internet-facing Application Load Balancer with AWS WAF, routing traffic through a VPC Interface Endpoint for the AgentCore data plane.
Technical context
The post describes two patterns. Pattern 1 inserts a Lambda proxy between the ALB and VPC Endpoint, giving teams request transformation, custom logging and authentication translation at the cost of latency and complexity. Pattern 2 targets VPC Endpoint ENI IP addresses directly from the ALB, reducing components but requiring careful health-check handling and resource policies. AWS emphasizes that direct AgentCore access must be denied unless traffic originates from the expected VPC Endpoint.
Security context
The key security control is making WAF the inspection point without leaving a bypass path. That means combining WAF, ALB security groups, VPC Endpoint security groups, AgentCore authentication, resource policies and optional endpoint policies. Teams should test both authorized ALB-routed traffic and direct public endpoint attempts.
For practitioners
Choose the proxy pattern when transformation or custom audit logging is required. Choose direct VPC Endpoint targeting when lower latency and fewer components matter more. In both cases, validate health checks, authentication method, source-VPC endpoint conditions and operational monitoring before exposing the runtime.
Key Points
- 1AWS shows WAF in front of AgentCore Runtime through ALB and VPC Endpoint patterns that preserve authentication.
- 2A Lambda proxy adds transformation and logging flexibility, while direct ENI targeting lowers latency and component count.
- 3Resource policies are required to prevent valid callers from bypassing WAF through direct AgentCore endpoint access.
Scoring Rationale
This is practical, deployable security guidance for engineers running production AgentCore endpoints on AWS. It remains a vendor how-to rather than a broad platform shift, so the score stays in the solid-to-notable range.
Sources
Public references used for this report.
Practice with real Retail & eCommerce data
90 SQL & Python problems · 15 industry datasets
250 free problems · No credit card
See all Retail & eCommerce problems
