FREE TOOL

AgentCore IaC Security Checker

Paste a CloudFormation template or Terraform and check its Amazon Bedrock AgentCore resources before you deploy: gateways without authorization, secrets in the template, PUBLIC network modes, JWT authorizers and execution roles.

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  AgentRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: bedrock-agentcore.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess

Agent:
    Type: AWS::BedrockAgentCore::Runtime
    Properties:
      AgentRuntimeName: support_agent
      RoleArn: !GetAtt AgentRole.Arn
      AgentRuntimeArtifact:
        ContainerConfiguration:
          ContainerUri: !Sub '${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/support-agent:latest'
      NetworkConfiguration:
        NetworkMode: PUBLIC
      EnvironmentVariables:
        OPENAI_API_KEY: sk-proj-4f9a0c1e7b2d
        LOG_LEVEL: info

ToolsGateway:
    Type: AWS::BedrockAgentCore::Gateway
    Properties:
      Name: support-tools
      RoleArn: !GetAtt AgentRole.Arn
      ProtocolType: MCP
      AuthorizerType: NONE
      ExceptionLevel: DEBUG

Sandbox:
    Type: AWS::BedrockAgentCore::CodeInterpreterCustom
    Properties:
      Name: support_code
      NetworkConfiguration:
        NetworkMode: PUBLIC

Read as CloudFormation

What is checked →What a template cannot show →Why scanners miss it →

See the check ↓

CLOUDFORMATION · 4 RESOURCES

AgentRole RoleAgent RuntimeToolsGateway GatewaySandbox CodeInterpreterCustom

FAILSecrets written in environment variables: OPENAI_API_KEY

Agent · Runtime

The values are in the template, and GetAgentRuntime returns environment variables in plain text to anyone allowed to read the runtime. Store API keys in an AgentCore Identity API key credential provider, or read them from Secrets Manager at startup.

FAILNo inbound authorization (NONE)

ToolsGateway · Gateway · Security Hub BedrockAgentCore.2

Anyone who knows the gateway URL can list and call its tools, without a token or a signature, and nothing else authorizes them: there is no policy engine in ENFORCE mode and no interceptor. Security Hub fails the gateway (High). Use CUSTOM_JWT or AWS_IAM.

AuthorizerType: CUSTOM_JWT

CHECKPUBLIC network mode

Agent · Runtime · Security Hub BedrockAgentCore.1

The agent reaches the internet directly and cannot reach private resources; security groups, network ACLs and VPC flow logs do not apply to its traffic. Security Hub fails a runtime in PUBLIC mode (High). VPC mode needs private subnets with a NAT gateway for internet access, plus endpoints for ECR, S3 and CloudWatch Logs.

NetworkConfiguration:
  NetworkMode: VPC
  NetworkModeConfig:
    SecurityGroups: [sg-...]
    Subnets: [subnet-...]

CHECKMMDSv2 not set in the template

Agent · Runtime

Since June 30, 2026 AgentCore Runtime rejects invocations of a runtime whose metadataConfiguration.requireMMDSV2 is not true, with the ValidationException "This runtime is not MMDSv2-enabled". The CloudFormation and Terraform references do not list the setting yet, so check the deployed runtime and set it with UpdateAgentRuntime if it is null.

aws bedrock-agentcore-control get-agent-runtime --agent-runtime-id RUNTIME_ID --query metadataConfiguration

CHECKDebug error messages (ExceptionLevel DEBUG)

ToolsGateway · Gateway

Callers get the details of target errors - Lambda function ARNs, permission and credential provider problems - instead of a generic internal error. AWS meant it for development; leave the property out in production.

# remove ExceptionLevel: DEBUG

CHECKPUBLIC network mode

Sandbox · CodeInterpreterCustom · Security Hub BedrockAgentCore.7

The code the model writes runs with internet access, so a prompt injection can make it send your data anywhere. SANDBOX limits it to Amazon S3; VPC keeps it in your network. Security Hub fails PUBLIC (High).

NetworkConfiguration:
  NetworkMode: VPC

CHECKTrust policy without aws:SourceAccount or aws:SourceArn

AgentRole · Role

Any AgentCore resource - in any account - that is given this role's ARN can have AgentCore assume it (the confused deputy problem). AWS recommends limiting the trust to your account and your AgentCore resources.

"Condition": {
  "StringEquals": {"aws:SourceAccount": "ACCOUNT_ID"},
  "ArnLike": {"aws:SourceArn": "arn:aws:bedrock-agentcore:REGION:ACCOUNT_ID:*"}
}

CHECKThe execution role can do everything

AgentRole · Role

Any code in the microVM - including code a prompt injection gets the agent to run - can read the execution role's credentials from the metadata service. AWS: grant only the actions and resources the agent needs, with full ARNs rather than wildcards.

NOTEEncrypted with an AWS managed key

ToolsGateway · Gateway · Security Hub BedrockAgentCore.4

Security Hub fails a gateway without a customer managed KMS key (Medium) - a compliance requirement more than a risk: your own key gives you its policy, rotation and CloudTrail records of its use.

KmsKeyArn: arn:aws:kms:REGION:ACCOUNT_ID:key/KEY_ID

OKIAM (SigV4) authorization

Agent · Runtime

Without an authorizer configuration, callers sign their requests with IAM credentials and need bedrock-agentcore:InvokeAgentRuntime on this runtime.

Least-privilege roles, confused deputies, secrets management and KMS keys are AWS Security Specialty topicsTry free SCS-C02 practice questions with answers and explanations.SCS-C02 questions →

What the checker looks for

Each check comes from AWS's own security guidance for AgentCore. Where AWS Security Hub has a control for the same setting, the finding names it: that control fails the resource once it is deployed.

Resource	Checked	Security Hub
Runtime	PUBLIC network mode; JWT authorizer without audiences or clients; AWS keys and secrets in environment variables; MMDSv2	BedrockAgentCore.1 (High)
Gateway	`NONE` or `AUTHENTICATE_ONLY` inbound auth without a policy engine in ENFORCE mode or an interceptor; JWT restrictions; policy engine in LOG_ONLY; `ExceptionLevel: DEBUG`; no customer managed key	BedrockAgentCore.2 (High), .4 (Medium)
Code Interpreter	PUBLIC or SANDBOX network mode	BedrockAgentCore.7 (High)
Browser	PUBLIC network mode; session recording off	BedrockAgentCore.5 (High), .6 (Medium)
Memory	No customer managed key	BedrockAgentCore.3 (Medium)
API key and OAuth2 credential providers	The API key or client secret written in the template, or kept in Terraform state	-
Resource policy	`Principal: "*"` without a condition	-
IAM roles AgentCore can assume	Trust policy without `aws:SourceAccount` or `aws:SourceArn`; `AdministratorAccess` or `"Action": "*"`	-

A gateway with AuthorizerType: NONE is the one to fix first: anyone who finds its URL can list and call its tools. AWS allows it only for gateways meant to be public, with your own throttling, and with authorization moved to a policy engine, an interceptor Lambda function or the targets. AUTHENTICATE_ONLY checks the SigV4 signature but not the caller's permissions, so any IAM principal gets through. The AgentCore Token Flow Planner shows how to set up the JWT authorizer instead.

Environment variables are no place for API keys: GetAgentRuntime returns them in plain text to anyone allowed to read the runtime. An AgentCore Identity API key credential provider or a Secrets Manager secret read at startup keeps them out of the configuration. In Terraform, a secret from a variable still ends up in the state file, unless it goes through the write-only api_key_wo or client_secret_wo (Terraform 1.11+) or an external Secrets Manager secret.

What a template cannot show

MMDSv2. Since June 30, 2026 AgentCore Runtime rejects invocations of a runtime whose metadataConfiguration.requireMMDSV2 is not true. Neither CloudFormation's AWS::BedrockAgentCore::Runtime nor Terraform's aws_bedrockagentcore_agent_runtime documents the setting yet, so check the deployed runtime: aws bedrock-agentcore-control get-agent-runtime --agent-runtime-id RUNTIME_ID --query metadataConfiguration, and set it with UpdateAgentRuntime if it is null.
Policies attached elsewhere. The checker reads a role's inline policies, its managed policy ARNs and, in Terraform, the aws_iam_role_policy and aws_iam_role_policy_attachment resources that reference it - not separate CloudFormation AWS::IAM::Policy resources or modules.
Session-to-user mapping. AgentCore does not tie a session ID to a user; your backend must.
Input validation. AWS warns that a non-string prompt - a list of content blocks with toolUse - can make an agent framework call a tool without the model. Validate the payload in your entrypoint.

Why IaC scanners miss AgentCore

On September 30, 2026 none of the open-source IaC scanners had AgentCore rules: Checkov's only Bedrock checks are for classic Bedrock Agents (a customer managed key) and Guardrails, and Trivy, KICS and AWS's CloudFormation Guard rules registry have none. AWS Security Hub has seven AgentCore controls, but they evaluate resources after they are deployed, through AWS Config rules that react to configuration changes. This checker runs on the template, before the deploy.

Frequently asked questions

Is my template sent anywhere?

No. It is read in your browser: nothing you paste is uploaded, processed on a server or stored. The page only counts that the checker was used, with which format and which first finding, never the template.

Does it work with CDK?

Yes, through what CDK deploys: run cdk synth and paste the template it prints, or the JSON template from cdk.out. The same goes for SAM templates, which are CloudFormation.

Is PUBLIC network mode wrong?

Not necessarily - it is what most examples use. In PUBLIC mode the agent reaches the internet directly, and your security groups, network ACLs and VPC flow logs do not apply to its traffic. Security Hub fails it (High); VPC mode needs private subnets with a NAT gateway for internet access, and VPC endpoints for ECR, S3 and CloudWatch Logs.

Why does a code interpreter in SANDBOX mode get a note?

Sandbox mode already limits the code to Amazon S3, and AWS offers it for exactly that case. Security Hub's control BedrockAgentCore.7 still fails anything but VPC mode, so the note tells you what the control will say.

Why does the trust policy need aws:SourceAccount?

Without a condition, any AgentCore resource that is given the role's ARN can have AgentCore assume it - the confused deputy problem. aws:SourceAccount limits it to your account, aws:SourceArn to your AgentCore resources.

References

Security best practices for AgentCore Runtime
Security Hub CSPM controls for Amazon Bedrock AgentCore
Set up inbound authorization for your gateway
Configure inbound JWT authorizer
Turn on debugging messages
Bedrock AgentCore resource type reference (CloudFormation)

AgentCore IaC Security Checker

Template

Or try an example

What the checker looks for

What a template cannot show

Why IaC scanners miss AgentCore

Frequently asked questions

Is my template sent anywhere?

Does it work with CDK?

Is PUBLIC network mode wrong?

Why does a code interpreter in SANDBOX mode get a note?

Why does the trust policy need aws:SourceAccount?

References