No VPC endpoint for Amazon Bedrock in region
- Severity
- Medium
- Service
- Bedrock
- Check ID
- BEDROCK_NO_VPC_ENDPOINT
What this check finds
Amazon Bedrock API calls in this region traverse the public internet rather than staying within the AWS network. VPC endpoints keep model traffic private and reduce data exfiltration risk.
Passing looks like: VPC endpoint for Bedrock configured.
How to fix it
Create an interface VPC endpoint for Bedrock: EC2 console → Endpoints → Create endpoint → select com.amazonaws.{region}.bedrock-runtime. Attach a security group restricting access.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| PCI-DSS v4.0.1 |
|
| HIPAA Security Rule |
|
| SOC 2 — Trust Services Criteria |
|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
AI risk mappings
| Framework | Controls |
|---|---|
| MITRE ATLAS (Adversarial Threat Landscape for AI Systems) |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs
More Bedrock checks
- CriticalBedrock agent IAM role has broad permissions
- CriticalBedrock API key belongs to an administrator
- HighBedrock agent has no guardrail applied
- HighBedrock knowledge base not encrypted with CMK
- HighBedrock model invocation logging not enabled
- HighExternal model weights imported into Bedrock without governance review
- HighLong-lived Bedrock API key in use
- HighNo AWS Budget alert configured for Bedrock spend