Network connectivity patterns for agents deployed on Amazon Bedrock AgentCore Runtime

This article explains four network connectivity patterns for AI agents deployed on Amazon Bedrock AgentCore Runtime, progressing from public internet access to complete network isolation.

• Pattern 1: Default public endpoint accessible over internet with OAuth/IAM authentication
• Pattern 2: VPC connectivity via ENIs enables secure access to private resources like RDS databases
• Pattern 3: Resource-based policies block public internet access; VPC endpoints restrict to private networks
• Pattern 4: Isolated VPC with VPC endpoints for AWS services; zero internet ingress/egress
• Security groups control agent access to VPC resources in all patterns
• Includes AWS CLI commands for configuring each connectivity pattern

These patterns enable enterprises to deploy AI agents with appropriate security controls matching their compliance and data sensitivity requirements.