← Course Home
Module 3

Network Isolation & Runtime Security

MicroVM session isolation, control/data plane separation, VPC mode for production, and organization-wide SCP guardrails.

⏱ ~25 min · Runtime + Network / VPC / SCP
SURFACE · RUNTIME ISOLATION

Runtime Isolation Architecture

Amazon Bedrock AgentCore runs each agent session in its own MicroVM. Compute, memory, and network are isolated between sessions, so one session cannot observe or influence another — even for the same agent.

MicroVM per session

Each session gets a dedicated MicroVM. Isolation is enforced at the virtualization boundary, not just by process separation.

Control / data plane split

Management APIs (control plane) are separated from agent execution (data plane), with TLS and SigV4 authentication between them.

Provider-agnostic

Any model, any framework, any external provider gets the same isolation guarantees — the controls don't change with your stack.

Session isolation guarantee: each session runs in a dedicated microVM with isolated CPU, memory, and filesystem. When the session ends, the microVM is terminated and its memory sanitized. This is an AWS responsibility (see M1) — but you still have to configure the network boundary around it, which is the rest of this module.

Action required · MMDSv2 is mandatory Since June 30, 2026, agent runtimes must have MMDSv2 enabled. Runtimes without it cannot be invoked and return a ValidationException. Enable it by calling UpdateAgentRuntime with requireMMDSV2: true in metadataConfiguration.

The isolation boundary is the microVM — not the agent. Any code running inside the VM can read the execution role's credentials from the metadata service (MMDS), the same way EC2 code can reach IMDS. So isolation between sessions does not protect you from your own over-permissioned role: scope the execution role to exactly what the agent needs, and keep it at or below the privileges of whoever can invoke it.

SURFACE · NETWORK (VPC)

VPC Deployment — Mandatory for Production

By default a Runtime can run in a public network mode. For production that's a finding, not a choice. Security Hub enforces it.

Security Hub · BedrockAgentCore.1 This control fails if a Runtime's network mode is PUBLIC. Production runtimes must be deployed in VPC mode with private connectivity.

PrivateLink connectivity

Configure Amazon Bedrock AgentCore Runtime behind VPC PrivateLink so traffic never traverses the public internet.

Subnet & SG enforcement

Pin the runtime to approved subnets and security groups using the subnets and securityGroups condition keys from M2.

Egress control

Restrict which external endpoints agents can reach — an over-open egress path is how exfiltration (M1) completes.

Connecting the dots M1 warned that data exfiltration is the end of the attack chain. Egress restriction is the control that stops it: even a fully-compromised agent can't send data to an endpoint it can't reach.
SURFACE · NETWORK (SCP)

Organization-Level SCPs

Individual account controls can drift. Service Control Policies enforce a baseline across an entire organization or OU — no account can opt out. Four enforcement patterns cover most production baselines.

SCP 1
No non-VPC runtimes

Deny create/update unless subnets & security groups are supplied.

SCP 2
No unencrypted memory

Deny memory creation without a KMS CMK.

SCP 3
Invoke from your VPC only

Deny invocations that don't originate from an approved VPC.

SCP 4
No user-id delegation

Deny InvokeAgentRuntimeForUser where it isn't needed.

Example — SCP 1: deny runtime and tool creation unless wired into a VPC

// There is no "networkMode" condition key. VPC mode is enforced by // requiring the VPC parameters themselves to be present. // Two statements — NOT one with both keys. See the note below. "Statement": [ { "Sid": "DenyWithoutSubnets", "Effect": "Deny", "Action": [ "bedrock-agentcore:CreateAgentRuntime", "bedrock-agentcore:UpdateAgentRuntime", "bedrock-agentcore:CreateCodeInterpreter", "bedrock-agentcore:CreateBrowser" ], "Resource": "*", "Condition": { "Null": { "bedrock-agentcore:subnets": "true" } } }, { "Sid": "DenyWithoutSecurityGroups", "Effect": "Deny", "Action": [ "bedrock-agentcore:CreateAgentRuntime", "bedrock-agentcore:UpdateAgentRuntime", "bedrock-agentcore:CreateCodeInterpreter", "bedrock-agentcore:CreateBrowser" ], "Resource": "*", "Condition": { "Null": { "bedrock-agentcore:securityGroups": "true" } } } ]
Why two statements, not one Condition keys inside a single Condition block are AND-ed. So one statement checking Null on subnets and securityGroups together would only deny when both are missing — a request supplying subnets but no security groups would sail straight through. Splitting them means missing either one denies the request, which is what you actually want. Note the tool actions in the list too: leave CreateCodeInterpreter and CreateBrowser out and someone can still stand up a non-VPC tool through the side door.
SCPs and resource policies do different jobs SCPs are the only layer that can stop a non-VPC runtime from being created, and account admins can't remove them. But SCPs only evaluate IAM principals — an OAuth caller has no IAM principal, so restricting those requires a resource-based policy with Principal: "*" plus conditions. Use both.

Multi-account strategy: keep agent workload accounts separate from security control accounts. SCPs live at the org/OU level so the guardrail is enforced above the team that ships the agent — they can't accidentally weaken it.

Sources