Day 36: VPC Endpoints and Secret Hygiene for AI

An internal coding agent that calls Bedrock over the public internet with long-lived secrets in environment variables fails security review for good reason. Day 36 treats model access like payments: private connectivity, IAM roles, short-lived secrets fetched at tool time, and aggressive log redaction.

⚡ TL;DR: Interface VPC endpoints for Bedrock Runtime (and STS, Secrets Manager, Logs). Never put tokens in prompts. Rotate secrets and invalidate caches. Redact traces.

Private Bedrock path

Place compute in private subnets. Enable private DNS on the Bedrock Runtime interface endpoint. Optionally attach endpoint policies that allowlist model ARNs.

resource "aws_vpc_endpoint" "bedrock_runtime" {
  vpc_id              = var.vpc_id
  service_name        = "com.amazonaws.${var.region}.bedrock-runtime"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = var.private_subnets
  security_group_ids  = [aws_security_group.vpce.id]
}

Secrets never belong in prompts

Prompt injection exfiltrates whatever you leave in context. Tools that need GitHub or Jira credentials read Secrets Manager inside the sandbox and return only safe fields.

def tool_open_pr(repo: str, branch: str, title: str):
    gh = github_client_from_secret(f"tenants/{tenant}/github-app")
    pr = gh.open_pr(repo, branch, title)
    return {"prUrl": pr.html_url}

SYSTEM = f"GitHub token is {os.environ['GH_TOKEN']}; use it wisely."

On rotation, bump a version counter tools check before each external call so async jobs (Day 34) do not reuse dead credentials forever.

Production checklist

• [ ] Bedrock Runtime VPC endpoint + private DNS
• [ ] No long-lived third-party keys in plain Lambda env
• [ ] Tool results and prompts scrubbed in logs
• [ ] Rotation runbook tested
• [ ] Endpoint policies / SCPs as required
• [ ] Security review checklist attached to the service

Series navigation

← Day 35 · Day 37 →

Last updated September 11, 2026