feat(bedrockagentcore): add bedrockagentcore_runtime_vpc_configured check - #12800
Open
Nithin078 wants to merge 1 commit into
Open
feat(bedrockagentcore): add bedrockagentcore_runtime_vpc_configured check#12800Nithin078 wants to merge 1 commit into
Nithin078 wants to merge 1 commit into
Conversation
…heck - Collect AgentCore runtime network configuration - Fail public or incomplete VPC settings - Report MANUAL when runtime details cannot be read
github-actions
Bot
added
provider/aws
Contributor
|
✅ No Conflicts No conflict markers, and the branch merges cleanly into its base. |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (13)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughAdds Bedrock AgentCore runtime collection and a new AWS check that validates VPC network mode, subnets, and security groups. It also adds regional service wiring, read-only IAM permissions, metadata, changelog content, and unit tests. ChangesAgentCore VPC runtime check
Priority: ⬆️ High Estimated code review effort: 4 (Complex) | ~45 minutes Severity of issue fixed: High Sequence Diagram(s)sequenceDiagram
participant Prowler
participant BedrockAgentCore
participant AWSControlPlane
Prowler->>BedrockAgentCore: Initialize service
BedrockAgentCore->>AWSControlPlane: ListAgentRuntimes
AWSControlPlane-->>BedrockAgentCore: Runtime summaries
BedrockAgentCore->>AWSControlPlane: GetAgentRuntime and ListTagsForResource
AWSControlPlane-->>BedrockAgentCore: Runtime details and tags
Prowler->>BedrockAgentCore: Run VPC configuration check
BedrockAgentCore-->>Prowler: PASS, FAIL, or MANUAL findings
Merge Risk: ⚪ Minimal · up to No actionable merge-blocking risk remains in the reviewed change. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 22.86% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 35 functions across 6 files. (5 skipped: 5 unsupported.)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Amazon Bedrock AgentCore runtimes default to public network mode, which lets agent traffic leave a customer VPC. This PR adds a resource-level check for that posture.
Fix #12615
Related initiative: #12597 (AC-01 — Runtime Amazon VPC Configuration)
Description
BedrockAgentCoreservice that lists AgentCore runtimes (ListAgentRuntimes) and retainsGetAgentRuntimenetworkConfigurationfields (networkMode,networkModeConfig.subnets,networkModeConfig.securityGroups).bedrockagentcore_runtime_vpc_configurednetworkModeisVPCand both subnets and security groups are configured.networkModeisPUBLIC/default, or VPC mode is missing required subnets or security groups.GetAgentRuntimecould not retrieve the runtime detail. Unreadable in-scope data is never reported as PASS.ValidationExceptionand similar).bedrock-agentcore:ListAgentRuntimes,bedrock-agentcore:GetAgentRuntime, andbedrock-agentcore:ListTagsForResourceinpermissions/prowler-additions-policy.jsonand the CloudFormation scan role.bedrock-agentcore-controltoaws_regions_by_service.json(aliased frombedrock-agentcoreinutil/update_aws_services_regions.py).This check is atomic: it does not inspect public-subnet IGW routes or VPC endpoints (those are separate assertions).
Note: open PRs #12557 (shared AgentCore collector) and #12762 (JWT identity check + runtime collector) also add
bedrockagentcorefiles. This PR is self-contained so it can land independently; it will need a rebase if either of those merges first.Steps to review
uv run python prowler-cli.py aws --list-checks | grep bedrockagentcore_runtime_vpc_configuredExecution Evidence
Unit tests (17 passed) are included. Representative finding messages from those tests:
Live AWS PASS/FAIL execution against real AgentCore runtimes was not available in this environment. I can add censored CLI output from a real account as a follow-up if needed for merge.
Checklist
Community Checklist
SDK/CLI
permissions/prowler-additions-policy.jsonandpermissions/templates/cloudformation/prowler-scan-role.yml.License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Summary by CodeRabbit
New Features
Permissions
Documentation