Default-deny egress at the Runtime ENI. One terraform apply.
Govern what a Bedrock AgentCore agent can reach at the network layer. No code changes, no new nodes, no security review to clear. Clone it. Read it. Run it.
or browse the VCA product page for full deployment detail
No agent on the workload.
No code changes to the agent itself.
Seven-rule policy pack.
Monitor before you enforce. Reverse in one step.
Give your security team the deployment detail.
Our VCA product page covers what's currently supported and what isn't, in more depth than the repo README.
Video
Watch the Demo.
An AI agent with valid credentials tries to exfiltrate data to an external endpoint. See what happens when Aviatrix Validated Containment for AWS Bedrock AgentCore enforces default-deny at every path, no detection required, zero blast radius.
Secure Your Cloud for the Future of AI
Leverage the cloud network as a unifying enforcement layer to secure all your agentic software and cloud workload communications.