Bedrock batch inference job running without VPC configuration

Severity: Medium
Service: Bedrock
Check ID: BEDROCK_BATCH_JOB_NO_VPC

What this check finds

A Bedrock batch inference job was submitted without a VPC configuration. Without VPC isolation, data processed by the batch job travels over the public AWS network and is not restricted to your private network perimeter.

Passing looks like: Bedrock batch job runs inside VPC.

How to fix it

Submit batch inference jobs with a vpcConfig specifying private subnets and a security group. Add --vpc-config SubnetIds=...,SecurityGroupIds=... to the CreateModelInvocationJob call.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Bedrock batch inference job running without VPC configuration
Framework	Controls
PCI-DSS v4.0.1	1.3 Network access to and from the cardholder data environment is restricted
HIPAA Security Rule	164.312(e)(1) Implement technical security measures to guard against unauthorized access to ePHI in transit
SOC 2 — Trust Services Criteria	CC6.4 Network Security Controls
NIST SP 800-53 Rev5 (Moderate)	SC-7 Boundary Protection
NIST Cybersecurity Framework 2.0	PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
ISO/IEC 27001:2022 Annex A	A.8.20 Networks security

AI risk mappings

AI risk taxonomies mapped to Bedrock batch inference job running without VPC configuration
Framework	Controls
MITRE ATLAS (Adversarial Threat Landscape for AI Systems)	AML.T0024 Exfiltration via ML Inference API AML.T0025 Exfiltration via Cyber Means

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Bedrock checks

All Bedrock checks