Bedrock AgentCore code interpreter has public internet access

What it checks

Bedrock AgentCore code interpreter has public internet access

Where it applies

Terraform: aws_bedrockagentcore_code_interpreter

CloudFormation: AWS::BedrockAgentCore::CodeInterpreterCustom

How to fix it

1. Set network_configuration.network_mode to "SANDBOX" (fully isolated) or "VPC" (egress controlled by subnets/security groups) unless public internet access is strictly required.

Frameworks

• NIST 800-53 rev5 SC-7
• SOC 2 CC6.6

These mappings are advisory, not an attestation of compliance.

All rules