Bedrock AgentCore runtimes should be configured with VPC network mode

How to fix it

Set the AgentCore runtime's network mode to VPC, over subnets and security groups of your own, so its traffic leaves through network interfaces in your VPC. UpdateAgentRuntime rewrites the runtime whole rather than patching it, so read its current configuration first and resupply it: anything optional left out of the call is cleared, including the environment variables, the inbound authorizer, the protocol configuration and the description.

In the console

Bedrock AgentCore → Agent runtimes → the runtime → Network configuration → VPC

With the AWS CLI

aws bedrock-agentcore-control update-agent-runtime --agent-runtime-id <agent-runtime-id> --role-arn <execution-role-arn> --agent-runtime-artifact '{"containerConfiguration":{"containerUri":"<container-image-uri>"}}' --network-configuration '{"networkMode":"VPC","networkModeConfig":{"subnets":["<subnet-id>"],"securityGroups":["<security-group-id>"]}}' --region <region>

With Terraform

resource "aws_bedrockagentcore_agent_runtime" "this" {
  agent_runtime_name = var.agent_runtime_name
  role_arn           = var.role_arn

  agent_runtime_artifact {
    container_configuration {
      container_uri = var.container_image_uri
    }
  }

  network_configuration {
    network_mode = "VPC"

    network_mode_config {
      security_groups = var.security_group_ids
      subnets         = var.subnet_ids
    }
  }
}