AI Coding in VPC: Private Bedrock Endpoints and Secret Hygiene

Regulated code cannot phone home to the public Bedrock endpoint “because the SDK default worked.” Put coding agents in private subnets, reach Bedrock through VPC interface endpoints, encrypt prompt stores with CMKs, redact CloudTrail, and pull images from private ECR — same bar you already hold for data plane Lambdas.

⚡ TL;DR: Private subnets + VPC endpoints for bedrock / bedrock-runtime (+ STS, ECR, Logs, S3); no NAT for agent tasks if policy requires; CMKs on S3 prompt archives; strip secrets before logging; sandbox tool execution. See Lambda sandboxes, VPC cold starts, Bedrock guardrails.

Network posture

# illustrative Terraform fragments
resource "aws_vpc_endpoint" "bedrock_runtime" {
  vpc_id              = var.vpc_id
  service_name        = "com.amazonaws.${var.region}.bedrock-runtime"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = var.private_subnet_ids
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

resource "aws_vpc_endpoint" "bedrock" {
  vpc_id              = var.vpc_id
  service_name        = "com.amazonaws.${var.region}.bedrock"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = var.private_subnet_ids
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

Agent task security group: egress only to VPCe SGs (and maybe CodeArtifacts). ❌ Do not open 0.0.0.0/0 “temporarily” for model access.

SDK config that stays private

import { BedrockRuntimeClient } from "@aws-sdk/client-bedrock-runtime";

export const bedrock = new BedrockRuntimeClient({
  region: process.env.AWS_REGION,
  // With private DNS on the interface endpoint, default endpoint resolves privately
});

Verify with a canary that resolves bedrock-runtime.${region}.amazonaws.com to VPC endpoint ENIs. Alert if traffic takes NAT.

Secret hygiene for prompts and traces

const SECRET = /(AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36}|xox[baprs]-[A-Za-z0-9-]+)/g;

export function redact(text: string): string {
  return text.replace(SECRET, "[REDACTED]");
}

// Before CloudWatch / Langfuse / S3 prompt archive
archive.put({ body: redact(prompt), sseKMSKeyId: cmkArn });

Enable Bedrock CloudTrail data events carefully; treat model input/output as sensitive. Prefer Guardrails + application redaction over relying on trail alone — Bedrock Agents guardrails.

Private supply chain for agent runners

• ECR pull through VPC endpoints (ecr.api, ecr.dkr, S3 gateway)
• No public base images in prod accounts; scan on push
• Tool sandboxes as Lambdas in the same VPC — safe tool sandboxes
• Watch cold starts when attaching VPCs — Node 20 cold starts

IAM that matches the network story

{
  "Effect": "Allow",
  "Action": ["bedrock:InvokeModel", "bedrock:Converse"],
  "Resource": [
    "arn:aws:bedrock:REGION::foundation-model/anthropic.*",
    "arn:aws:bedrock:REGION:ACCOUNT:inference-profile/*"
  ],
  "Condition": {
    "StringEquals": { "aws:SourceVpce": "vpce-xxxx" }
  }
}

✅ Condition keys tying invokes to your VPCe.
❌ Account-wide Bedrock access from corporate laptops for “prod” keys.

Closing checklist

✅ Dos
– ✅ Interface endpoints for bedrock + bedrock-runtime with private DNS
– ✅ Private subnets without broad NAT egress for agent tasks
– ✅ CMK-encrypt prompt/result archives; redact secrets first
– ✅ Private ECR + scanned images for runners
– ✅ IAM conditions on SourceVpce where supported

❌ Don’ts
– ❌ Don’t put prod agent keys on developer laptops
– ❌ Don’t log raw prompts with tokens to shared Slack
– ❌ Don’t use public Bedrock endpoints from regulated VPCs
– ❌ Don’t grant bedrock:* on *
– ❌ Don’t forget STS/ECR/Logs endpoints or tasks will mysteriously hang

Related reading

• LLM Coding Agents on AWS: Safe Tool Sandboxes with Lambda
• Lambda Cold Starts on Node 20: Measure, Cut, and Keep Cutting
• Amazon Bedrock Agents: Tool Use, Memory, and Production Guardrails
• AI Code Review Bots: IAM, Secrets, and Least-Privilege Pipelines

Last updated on September 11, 2026