Study guide
8.2 PrivateLink VPC Endpoints & Network Isolation
AWS Certified Generative AI Developer - Professional AIP-C01
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Exam Overview & Foundation Model Fundamentals
1.1 AIP-C01 Exam Structure, Logistics & Passing Strategy 1.2 AIP-C01 Scoring & Professional Decision Strategy 1.3 Foundation Model Landscape & Model Selection on Amazon Bedrock 1.4 Model Abstraction, Controlled Switching & Resilience 1.5 Customization Spectrum: Prompting vs RAG vs Fine-Tuning vs Continued Pre-training 1.6 Custom Model Deployment & Lifecycle Management
2 Chapter 2: Bedrock Knowledge Bases & RAG Architectures
2.1 Managed RAG Architecture with Bedrock Knowledge Bases 2.2 Knowledge Source Integration, Synchronization & Freshness 2.3 Data Ingestion, Parsing & Chunking Strategies 2.4 Embedding Models & Vector Representations 2.5 Vector Index Scale, Migration & Retrieval Evaluation 2.6 Vector Database Selection: OpenSearch Serverless vs Aurora pgvector vs Managed Stores 2.7 Vector Store Security, Multi-Tenancy & Connectivity
3 Chapter 3: Advanced Vector Search, Indexing & Data Compliance
3.1 Hybrid Search, Metadata Filtering & Semantic Reranking 3.2 Metadata Filtering, Reranking & Query Transformation 3.3 Fine-Tuning & Continued Pre-Training Data Pipeline Engineering 3.4 Data Validation, Multimodal Processing & Model Formatting 3.5 Data Privacy, Data Residency & Compliance Governance 3.6 Privacy Preservation, Source Lineage & Audit Evidence
4 Chapter 4: Prompt Engineering & Bedrock Runtime APIs
4.1 Advanced Prompt Engineering Techniques & Inference Parameters 4.2 Inference Parameters, Prompt Governance & Regression 4.3 Converse API vs InvokeModel API & Message Formatting 4.4 Tool Calling, FM API Resilience & Model Routing 4.5 Streaming Architectures & Asynchronous Event Processing 4.6 Resilient Streaming, Deployment & Asynchronous Processing
5 Chapter 5: Amazon Bedrock Agents & Tool Integration
5.1 Agentic Architecture, ReAct Reasoning Loops & Orchestration 5.2 Agent Frameworks, MCP & Lifecycle Management 5.3 Action Groups, OpenAPI Schemas & AWS Lambda Integration 5.4 Agent Memory, Session State & Multi-Agent Collaboration Patterns 5.5 Persistent State & Multi-Agent Coordination 5.6 Advanced Agent Prompt Templates & Flow Customization 5.7 Agent Safeguards, Tool Reliability & Cost Control
6 Chapter 6: Workflow Orchestration & Application Integration
6.1 Amazon Bedrock Prompt Flows & Visual Orchestration 6.2 Step Functions Orchestration & Human-in-the-Loop Workflows 6.3 Enterprise Integration: API Gateway, AppSync, and EventBridge 6.4 Hybrid Integration, GenAI Gateways & CI/CD Tooling
7 Chapter 7: AI Safety & Guardrails for Amazon Bedrock
7.1 Guardrails Architecture, Denied Topics & Content Filters 7.2 Content Safety, Defense in Depth & Threat Detection 7.3 Sensitive Information Filters & PII Redaction/Masking 7.4 Contextual Grounding Checks & Hallucination Prevention
8 Chapter 8: Security, Access Control & Network Architecture
8.1 IAM Least Privilege & Resource Policies for Bedrock 8.2 PrivateLink VPC Endpoints & Network Isolation 8.3 Encryption with AWS KMS & Cross-Account Access Patterns
9 Chapter 9: Governance, Auditing & Operational Logging
9.1 SageMaker Model Cards & AI Governance Frameworks 9.2 Lineage, Fairness, Transparency & Continuous Governance 9.3 Invocation Logging, CloudTrail Auditing & Observability 9.4 Responsible AI, Bias Mitigation & Red Teaming Methodologies
10 Chapter 10: Performance, Throughput & Cost Optimization
10.1 On-Demand vs Provisioned Throughput & Capacity Planning 10.2 Capacity Measurement, Scaling Patterns & Resilience 10.3 Batch Inference & Bedrock Intelligent Prompt Routing 10.4 Intelligent Prompt Routing & Application Eligibility 10.5 Prompt Caching, Token Optimization & Latency Reduction
11 Chapter 11: Testing, Evaluation & Troubleshooting GenAI Solutions
11.1 Amazon Bedrock Model Evaluation (Automatic & Human Workflows) 11.2 Human, RAG & Continuous Evaluation 11.3 Evaluation Metrics & RAG Quality Benchmarking (Ragas, ROUGE, BLEU) 11.4 RAG and Agent Performance Evaluation 11.5 CloudWatch Metrics, Throttling & Operational Observability 11.6 Quota Diagnosis, Retry Control & Operational Troubleshooting 11.7 Troubleshooting Common GenAI Failure Modes & Agent Traces 11.8 Prompt Maintenance, Content Handling & Deployment Validation
8.2 PrivateLink VPC Endpoints & Network Isolation
Key Takeaways Explain This Topic AI
AWS PrivateLink interface VPC endpoints establish private, secure connectivity between VPC workloads and Amazon Bedrock, ensuring that inference, management, and retrieval data never traverse the public internet.
Amazon Bedrock provides distinct interface VPC endpoint service names: com.amazonaws.{region}.bedrock for control-plane management APIs, com.amazonaws.{region}.bedrock-runtime for model inference APIs, and com.amazonaws.{region}.bedrock-agent-runtime for agent and knowledge base retrieval APIs.
VPC endpoint policies attached to interface endpoints act as an indispensable perimeter guardrail, restricting which IAM principals, AWS accounts, or specific model ARNs can be accessed from inside the VPC.
Complete network isolation for Bedrock Knowledge Bases requires configuring an interface VPC endpoint for Amazon OpenSearch Serverless (com.amazonaws.{region}.aoss) coupled with an AOSS network policy of type 'vpc' bound to that endpoint ID.
Private DNS resolution must be enabled on interface VPC endpoints so that standard AWS SDK API calls (bedrock-runtime.{region}.amazonaws.com) resolve automatically to the private IP addresses of the endpoint Elastic Network Interfaces (ENIs).
Last updated: September 2026
8.2 PrivateLink VPC Endpoints & Network Isolation
This independent study guide by ExamFinch helps candidates prepare for the AWS Certified Generative AI Developer - Professional (AIP-C01) examination. Highly regulated industries—including banking, healthcare, defense, and government—mandate that proprietary data, personally identifiable information (PII), and intellectual property must never traverse the public internet. When enterprise applications invoke foundation models, submit prompts containing confidential customer records, or perform vector embeddings over proprietary document corpora, network traffic must remain strictly confined within private network boundaries.
AWS PrivateLink enables private connectivity between Amazon Virtual Private Clouds (VPCs) and supported AWS services without requiring an Internet Gateway (IGW), NAT Gateway, Network Address Translation (NAT) instances, or AWS Direct Connect public virtual interfaces. Understanding how to configure, secure, and troubleshoot PrivateLink endpoints for Amazon Bedrock and its vector storage dependencies is a core domain on the AIP-C01 examination.
Architecture of AWS PrivateLink for Amazon Bedrock
When you provision an interface VPC endpoint for Amazon Bedrock, AWS creates Elastic Network Interfaces (ENIs) with private IP addresses in the private subnets of your VPC. Traffic destined for Bedrock is routed directly across the AWS private network backbone to the Bedrock service infrastructure. ┌────────────────────────────────────────────────────────┐
- │ Amazon VPC (10.0.0.0/16) - Private Subnet (10.0.1.0/24)│
- │ │
- │ ┌───────────────────────┐ │
- │ │ EC2 / ECS / Lambda │ │
- │ │ App Microservice │ │
- │ └──────────┬────────────┘ │
- │ │ HTTPS (443) │
- │ ▼ │
- │ ┌───────────────────────┐ │
- │ │ Interface VPC ENI │ (Private IP: 10.0.1.50) │
- │ │ (bedrock-runtime) │ │
- │ └──────────┬────────────┘ │
- └─────────────┼──────────────────────────────────────────┘
- │ AWS Private Backbone Network (Zero Public Internet)
- ▼
- ┌────────────────────────────────────────────────────────┐
- │ Amazon Bedrock Service Infrastructure │
- │ - Anthropic Claude / Amazon Nova Foundation Models │
- └────────────────────────────────────────────────────────┘
- The Three Critical Service Names
Amazon Bedrock separates its service architecture into distinct VPC endpoint service names. Configuring the wrong service name is one of the most common causes of network failure:
VPC Endpoint Service Name Operational Scope APIs Supported Common Use Case
com.amazonaws.{region}.bedrock Control Plane CreateKnowledgeBase ; CreateAgent ; CreateModelCustomizationJob ; CreateProvisionedModelThroughput DevOps pipelines, infrastructure provisioning microservices
com.amazonaws.{region}.bedrock-runtime Data Plane (Model Inference) InvokeModel ; InvokeModelWithResponseStream ; ApplyGuardrail Core application microservices generating prompt completions
com.amazonaws.{region}.bedrock-agent-runtime Data Plane (Agents & RAG) InvokeAgent ; Retrieve ; RetrieveAndGenerate ; InvokeFlow Conversational chatbots, enterprise search engines, agent runtimes
com.amazonaws.{region}.bedrock-agent Control Plane (Agents & KBs) CreateAgentActionGroup ; UpdateKnowledgeBase ; PrepareAgent Administrative agent orchestration and lifecycle management
Important
If an application in a private subnet needs to execute bedrock.invoke_model() , provisioning an interface endpoint for com.amazonaws.{region}.bedrock will not work. The invocation will fail with a connection timeout because invoke_model() targets the data plane endpoint ( bedrock-runtime ), which requires com.amazonaws.{region}.bedrock-runtime .
Private DNS Resolution Mechanics
When creating an interface VPC endpoint, enabling Private DNS ( PrivateDnsEnabled: true ) is essential.
Without Private DNS: The application must be explicitly configured to send API requests to the unique, long VPC endpoint DNS hostname (e.g., vpce-0123456789abcdef0-us-east-1a.bedrock-runtime.us-east-1.vpce.amazonaws.com ). This requires custom code modifications and breaks standard SDK defaults.
With Private DNS: AWS creates a private hosted zone in Amazon Route 53 that resolves the standard public service DNS hostname ( bedrock-runtime.us-east-1.amazonaws.com ) directly to the private IP addresses of the interface endpoint ENIs within your VPC. Applications can use standard AWS SDK clients without changing endpoint URLs, and traffic automatically routes over PrivateLink.
Prerequisites for Private DNS:
The VPC must have both enableDnsHostnames and enableDnsSupport set to true .
Security groups attached to the interface endpoint ENIs must permit inbound HTTPS (port 443) traffic from the private subnets hosting application compute.
Security groups attached to the application compute must permit outbound HTTPS (port 443) traffic to the VPC endpoint security group or subnet CIDR.
VPC Endpoint Security Policies: Perimeter Defense
An interface VPC endpoint allows attaching a VPC Endpoint Policy . An endpoint policy is an IAM resource policy attached directly to the endpoint. It does not replace identity-based policies, but rather acts as a perimeter filter : requests passing through the endpoint are denied unless both the caller's IAM policy AND the endpoint policy permit the action.
Use Case: Restricting Allowed Accounts and Models
Security compliance often dictates that corporate compute inside a private VPC must only access models within the corporate AWS account and must never invoke unapproved third-party or experimental models. {
- "Version": "2012-10-17",
- "Statement": [
- {
- "Sid": "RestrictVpcBedrockAccess",
- "Effect": "Allow",
- "Principal": "*",
- "Action": [
- "bedrock:InvokeModel",
- "bedrock:InvokeModelWithResponseStream"
- ],
- "Resource": [
- "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-5-sonnet-20240620-v1:0",
- "arn:aws:bedrock:us-east-1::foundation-model/amazon.nova-pro-v1:0",
- "arn:aws:bedrock:us-east-1:123456789012:provisioned-model/*"
- ],
- "Condition": {
- "StringEquals": {
- "aws:PrincipalAccount": "123456789012"
- }
- }
- }
- ]
- }
What this policy enforces:
Prevent Exfiltration to External Accounts: If a rogue employee attempts to use their own AWS credentials from inside an EC2 instance in this VPC to invoke models in their personal account, the aws:PrincipalAccount condition blocks the request.
Prevent Use of Unapproved Models: Calls to unapproved models (e.g., unauthorized open-source weights or external experimental models) are blocked at the network perimeter.
Securing Bedrock Knowledge Bases Vector Infrastructure
A production RAG system involves more than foundation models; it connects to Amazon OpenSearch Serverless (AOSS) vector collections and Amazon S3 document buckets. Full network isolation requires securing this supporting infrastructure.
OpenSearch Serverless Network Policies
Amazon OpenSearch Serverless manages network accessibility through Network Policies . An AOSS collection can be configured in two modes:
Public: Accessible from the internet (subject to IAM data access policies).
VPC: Accessible exclusively through designated interface VPC endpoints.
To isolate an OpenSearch Serverless vector collection:
Provision an interface VPC endpoint for the AOSS service: com.amazonaws.{region}.aoss .
- Create an OpenSearch Serverless Network Policy of type vpc referencing the VPC endpoint ID: [
- {
- "Rules": [
- {
- "Resource": ["collection/enterprise-knowledge-base"],
- "ResourceType": "collection"
- },
- {
- "Resource": ["collection/enterprise-knowledge-base"],
- "ResourceType": "dashboard"
- }
- ],
- "AllowFromPublic": false,
- "SourceVPCEs": ["vpce-0123456789abcdef0"]
- }
- ]
Attach an AOSS Data Access Policy granting the Bedrock Knowledge Base service execution role permissions ( aoss:CreateCollectionItems , aoss:UpdateCollectionItems , aoss:DescribeCollectionItems , aoss:APIAccessAll ) on the collection and its indexes.
S3 Data Source Network Isolation
To ensure raw documents stored in Amazon S3 are accessed privately:
Provision an S3 VPC Gateway Endpoint in the VPC.
Configure the S3 bucket policy to deny any traffic that does not originate from the VPC Gateway Endpoint using the aws:sourceVpce condition key, while allowing the Bedrock service principal ( bedrock.amazonaws.com ) to read objects during knowledge base synchronization.
Common Exam Traps & High-Stakes Scenarios
Trap: Provisioning only com.amazonaws.{region}.bedrock for Inference. Candidates frequently confuse the management endpoint with the runtime endpoint. When a scenario mentions Lambda functions or ECS tasks in private subnets invoking models, the required service name is com.amazonaws.{region}.bedrock-runtime .
Trap: Forgetting the Agent Runtime Endpoint. If an application invokes an Amazon Bedrock Agent via bedrock-agent-runtime:InvokeAgent , the bedrock-runtime endpoint is insufficient. The architecture must provision an interface endpoint for com.amazonaws.{region}.bedrock-agent-runtime .
Trap: Missing Inbound Security Group Rules on Endpoint ENIs. An interface endpoint creates ENIs inside your private subnets. The security group attached to these ENIs must have an inbound rule allowing TCP port 443 (HTTPS) from the security group or CIDR block of the application compute instances. Without this rule, requests hang and timeout.
Trap: Modifying AOSS Network Policies Post-Creation. When creating an OpenSearch Serverless collection, the encryption policy must exist before collection creation, and network policies must bind the VPC endpoint appropriately. Failing to bind the VPC endpoint before ingestion results in connectivity failures.