High BedrockAgentCore Regional

Bedrock AgentCore Gateways should require authorization for inbound requests

Description

Flags Amazon Bedrock AgentCore gateways that do not require authorization for inbound requests. Without inbound authorization the gateway is reachable by any caller, exposing the underlying agent tools to abuse.

Remediation

Configure inbound authorization on every AgentCore gateway.

Steps

Open the Amazon Bedrock AgentCore console and select the gateway.
Choose Edit and configure an authorizer.
Choose either AWS IAM or a custom JWT authorizer with the appropriate JWKS or Cognito issuer.
Save the changes.

Start Your Free Security Check