Back to All Checks
High BedrockAgentCore Regional

Bedrock AgentCore custom code interpreters should use a private network configuration

Description

Flags Amazon Bedrock AgentCore custom code interpreters that use PUBLIC or SANDBOX network mode instead of a private VPC configuration. Only VPC mode keeps interpreter traffic inside your network.

Remediation

Recreate AgentCore custom code interpreters with a VPC network configuration so interpreter traffic stays inside your network.

Steps

  1. Open the Amazon Bedrock AgentCore console and go to Code interpreters.
  2. Create a new custom code interpreter (the network mode is set at creation time).
  3. Under Network configuration, choose VPC.
  4. Select the subnets and security groups for the interpreter.
  5. Migrate workloads to the new interpreter and delete the public or sandbox one.
Start Your Free Security Check