AWS WAF integration for Bedrock AgentCore Runtime solves health check auth
Two tested patterns to enforce WAF policies on AgentCore without breaking health checks.
When deploying generative AI agents with Amazon Bedrock AgentCore as production API endpoints, you need web application firewall policies, rate limiting, and threat protection. AWS WAF integrates naturally with ALBs, CloudFront, and API Gateway, but AgentCore's real-time, authenticated invocations create complications. CloudFront caching is irrelevant; API Gateway adds double-authentication with AgentCore's built-in SigV4/OAuth. That leaves an internet-facing ALB as the integration point—it passes headers transparently and supports VPC-internal routing. However, ALBs require health checks, and AgentCore Runtime rejects unauthenticated health check requests by default.
This post details two patterns tested end-to-end with SigV4 and OAuth (Cognito JWT). Both share a common foundation: client → AWS WAF → internet-facing ALB → VPC Interface Endpoint (PrivateLink) → AgentCore Runtime container on port 8080. Pattern 1 places an AWS Lambda proxy between the ALB and the VPC Endpoint, giving full control over request transformation (e.g., rewriting health check paths or adding dummy signatures). Pattern 2 targets the VPC Endpoint ENI IPs directly from the ALB, removing the Lambda hop for lower latency and simpler architecture. To close the direct-access backdoor, a resource policy on the VPC Endpoint ensures traffic flows only through the ALB's WAF. This enables production-grade security for real-time agent invocations.
- Pattern 1 uses a Lambda proxy between ALB and VPC Endpoint for request transformation and custom health check handling.
- Pattern 2 targets VPC Endpoint ENI IPs directly from ALB for simpler, lower-latency architecture.
- Both patterns support SigV4 and OAuth authentication, with resource policies to enforce WAF-only access.
Why It Matters
Enables secure deployment of generative AI agents with enterprise-grade WAF protections on AWS.