Bedrock AgentCore custom browsers should not use public network mode

How to fix it

Set at creation: fixing it means replacing the resource.

Run the custom browser with its network mode set to VPC. A browser's network mode is fixed when it is created, so create a second browser carrying a VPC network configuration, move the agents that open browser sessions onto it, then delete the flagged one; deleting it is what clears this finding. Nothing carries over to the replacement, so its execution role, description and any session recording configuration have to be set again.

In the console

Bedrock AgentCore → Built-in tools → Create Browser tool → Network settings (fixed at creation)

With the AWS CLI

aws bedrock-agentcore-control create-browser --name <browser-name> --network-configuration '{"networkMode":"VPC","vpcConfig":{"subnets":["<subnet-id>"],"securityGroups":["<security-group-id>"]}}' --region <region>

With Terraform

resource "aws_bedrockagentcore_browser" "this" {
  name = var.browser_name

  network_configuration {
    network_mode = "VPC"

    vpc_config {
      security_groups = var.security_group_ids
      subnets         = var.subnet_ids
    }
  }
}