How to Create a VPC Endpoint for bedrock-agent-runtime

If you run agents on Amazon Bedrock from inside a private VPC, you almost certainly want a VPC interface endpoint for bedrock-agent-runtime so invocation traffic travels over AWS PrivateLink instead of the public internet. This guide gives the exact endpoint service names, the setup steps, and the DNS, security-group and policy details that commonly cause failures.

Which endpoint do you actually need?

Bedrock exposes several distinct services, and the data-plane runtime is the one agents call at invocation time:

• bedrock-agent-runtime — the runtime / data plane. Used to invoke agents, retrieve from knowledge bases, and run AgentCore Runtime sessions. This is the endpoint most people mean.
• bedrock-agent — the control plane for building and configuring agents (create/update). A separate endpoint.
• bedrock and bedrock-runtime — model control plane and model inference respectively, unrelated to agents.

For private agent invocation you create an interface endpoint for bedrock-agent-runtime. If you also build agents from within the VPC, add bedrock-agent too.

The endpoint service names

An interface endpoint’s service name follows the pattern com.amazonaws.<region>.bedrock-agent-runtime. For example:

• com.amazonaws.us-east-1.bedrock-agent-runtime (N. Virginia)
• com.amazonaws.ap-southeast-2.bedrock-agent-runtime (Sydney)

Swap in whichever region your agents run in. There is no separate “endpoint name” to invent — the service name above is what you select when creating the endpoint; AWS assigns the endpoint its own vpce- ID.

Creating the interface endpoint

1. VPC → Endpoints → Create endpoint. Choose endpoint type AWS services.
2. Search the service. Type bedrock-agent-runtime and select com.amazonaws.<region>.bedrock-agent-runtime. Confirm the type shows as Interface.
3. Pick the VPC and subnets. Select the VPC and one subnet per Availability Zone you want the endpoint reachable from. An elastic network interface is created in each chosen subnet.
4. Attach a security group that allows inbound HTTPS (TCP 443) from the resources that will call the runtime (your agent compute, Lambda, ECS tasks, etc.).
5. Enable Private DNS. Leave “Enable DNS name” on so the standard bedrock-agent-runtime.<region>.amazonaws.com hostname resolves to the private endpoint — no SDK or code changes needed.
6. Set an endpoint policy (see below), then create.

The details that trip people up

• Private DNS needs VPC DNS settings on. The VPC must have enableDnsSupport and enableDnsHostnames enabled, or private DNS resolution silently fails and the SDK keeps hitting the public endpoint.
• Security group, not just NACL. The endpoint’s own security group must permit 443 from the caller’s CIDR/SG. A missing inbound rule is the most common cause of timeouts.
• One service per endpoint. bedrock-agent-runtime and bedrock-agent are different services — if you need both, create two endpoints.
• Region match. The endpoint region must match the region your SDK client is configured for.

Locking it down with an endpoint policy

By default an interface endpoint allows all actions on the service. Tighten it with a resource policy so only the agents and actions you intend can use the endpoint — for example, restricting to specific agent ARNs or principals. This is a clean enforcement point for least privilege and pairs well with the broader controls in our agent runtime security guide.

Verifying it works

From an instance in the VPC, resolve bedrock-agent-runtime.<region>.amazonaws.com and confirm it returns a private VPC address (a 10.x/172.x/192.168.x range), not a public one. Then make a runtime call (e.g. invoke an agent) and confirm it succeeds with no public route. If resolution returns a public IP, private DNS is not active — recheck the VPC DNS settings and the endpoint’s “Enable DNS name” option.

How this fits your agent deployment

A private endpoint is one piece of running agents on the Bedrock AgentCore Runtime securely. Combine it with scoped identity, guardrails and observability for a defensible deployment, and orchestrate the agents into your wider data and AI workflows with Orchestra so each step runs in order, with lineage and recovery.

Conclusion

To keep Bedrock agent traffic private, create a VPC interface endpoint for com.amazonaws.<region>.bedrock-agent-runtime, attach a security group that allows 443 from your callers, enable private DNS, and restrict it with an endpoint policy. Verify by confirming the runtime hostname resolves to a private address. That gives your agents a PrivateLink path to the runtime with no exposure to the public internet.