Protecting Amazon Bedrock AgentCore with AWS WAF
AWS ML Blog · rss · 2026-07-08
This post explores how to implement security protection and rate limiting using AWS WAF when deploying Amazon Bedrock AgentCore as a production-grade API.
- Integration Challenge: Because AgentCore enforces authentication, standard ALB health checks fail since they send unauthenticated requests.
- Architecture Pattern 1 (Lambda Proxy): Introduces an AWS Lambda proxy between the ALB and VPC Endpoint. Ideal for scenarios requiring request transformation, custom logging, or multi-authentication transformations.
- Architecture Pattern 2 (Direct VPC ENI): The ALB routes traffic directly to the VPC Endpoint IP, removing the Lambda component to provide the lowest latency and simplest architecture.
- Security Closed Loop: Both patterns use resource policies to close direct backdoor access, ensuring all traffic must pass through AWS WAF inspection.
More from coding & agent
- A roundup of AI agents and MCP resources, including how to evaluate agents — _jaydeepkarale · 2026-07-21
- A full course shows how to build and deploy an AI agent with OpenAI and LangChain — _jaydeepkarale · 2026-07-21
- A beginner guide to AI agents points readers to a Stanford webinar — _jaydeepkarale · 2026-07-21
- A practical guide on how to evaluate AI agents — _jaydeepkarale · 2026-07-21
- MCP is headed toward easier scale, event-driven extensions, and workable file uploads — EricBuess · 2026-07-21
- Developers debate the missing composition model for AI agents — threepointone · 2026-07-21