AWS presented two WAF protection patterns for Amazon Bedrock AgentCore Runtime

AWS published two architectural patterns for protecting AI agents in Amazon Bedrock through AWS WAF, tested with SigV4 authentication and OAuth via Amazon Cognito JWT.

Why AgentCore Runtime needs WAF protection

AgentCore Runtime—a component of Amazon Bedrock for running AI agents in production—has no built-in web application-level filtering by default. Without additional architecture, an attacker can assault the agent with injections, DDoS, or request spoofing by accessing the service directly.

AWS WAF (Web Application Firewall) allows you to block known attack vectors, rate-limit requests, and apply managed rule groups before the request reaches the agent. Both presented patterns use an internet-accessible Application Load Balancer (ALB) with AWS WAF attached and route traffic through a VPC Interface Endpoint to AgentCore Runtime.

Key parameters of both solutions:

• ALB is exposed to the internet, AWS WAF inspects every incoming request
• Traffic is directed through VPC Interface Endpoint to AgentCore Runtime
• Resource policy forbids direct WAF bypass
• SigV4 and OAuth (Amazon Cognito JWT) authentication is supported
• Both patterns are tested in end-to-end scenarios

Pattern 1 versus Pattern 2: what's the difference

Pattern 1 places AWS Lambda between ALB and VPC Endpoint in a proxy role. The function receives the request after WAF filtering, can transform it—add headers, normalize paths, modify the body—and then passes it to AgentCore through the VPC Endpoint. This gives maximum control over traffic, particularly useful if request transformation logic or additional validation before the agent is needed. The cost is additional latency and Lambda invocation costs.

Pattern 2 eliminates the Lambda hop entirely: ALB directly addresses the IP addresses of ENIs (Elastic Network Interfaces) on the VPC Interface Endpoint. This is a more straightforward scheme with lower latency and no Lambda overhead. Suitable when request transformation is not needed and minimizing latency while maintaining WAF protection is the priority.

"Both patterns are tested end-to-end with

SigV4 and OAuth (Amazon Cognito JWT) authentication," notes AWS in the Machine Learning blog.

How to close the backdoor through resource policy

The most critical part of both patterns is correct configuration of the AgentCore Runtime resource policy. Without it, WAF protection loses its meaning: an attacker can discover the public AgentCore endpoint and call it directly, completely bypassing ALB and WAF.

The solution is the `aws:SourceVpce` condition in the resource policy. It permits calls to AgentCore only through a specific VPC Interface Endpoint, guaranteeing all traffic passes through ALB and AWS WAF. Direct backdoor is closed at the IAM policy level.

This approach implements Defence in Depth: WAF is the first line of filtration, resource policy is the second, preventing bypass of the first.

What it means

AWS guidance gives AI agent developers on Bedrock ready, tested patterns instead of reinventing protection schemes themselves. The choice between them is straightforward: if request transformation is needed—Pattern 1 with Lambda; if speed and simplicity matter most—Pattern 2 with a direct route to ENI.

Frequently asked questions

What authentication methods do both patterns support?

Both patterns are tested with AWS SigV4 (request signing via AWS access keys) and OAuth with Amazon Cognito JWT tokens. The choice depends on your application architecture.

Why is WAF alone insufficient without resource policy?

AWS WAF protects only traffic passing through ALB. If you do not close direct access to the AgentCore endpoint with resource policy using the `aws:SourceVpce` condition, an attacker can bypass WAF by accessing AgentCore directly at its public address.

Why is

Amazon Bedrock AgentCore Runtime vulnerable without WAF?

AgentCore Runtime has no built-in web application-level filtering by default. Without additional architecture, an attacker can assault the agent with injections, DDoS, or request spoofing.