Secure AWS Bedrock AgentCore Agent Workloads

resource "aviatrix_spoke_gateway" "mcp_containment" {
  cloud_type   = var.cloud_type
  account_name = var.account_name
  gw_name      = "mcp-containment-spoke"
  vpc_id       = var.cluster_vpc_id
  vpc_reg      = var.region
  gw_size      = var.gateway_size
  subnet       = var.subnet_cidr
}

resource "aws_route" "agent_default" {
  route_table_id         = var.agent_subnet_route_table_id
  destination_cidr_block = "0.0.0.0/0"
  network_interface_id   = module.spoke_agentcore.spoke_gateway.private_ip
}

resource "aws_iam_policy" "agentcore_guardrail" {
  name        = "agentcore-vpc-mode-guardrail"
  description = "Deny AgentCore Create* unless subnets and security groups come from the approved runtime set"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        # PUBLIC mode: no subnet key present in the request at all.
        # Null condition is required because ForAnyValue on a missing key
        # evaluates to false, which would let PUBLIC-mode creates through.
        Sid    = "DenyPublicModeCreate"
        Effect = "Deny"
        Action = [
          "bedrock-agentcore:CreateAgentRuntime",
          "bedrock-agentcore:CreateAgentRuntimeEndpoint",
          "bedrock-agentcore:UpdateAgentRuntime",
          "bedrock-agentcore:CreateBrowser",
          "bedrock-agentcore:CreateCodeInterpreter",
        ]
        Resource = "*"
        Condition = {
          "Null" = {
            "bedrock-agentcore:subnets" = "true"
          }
        }
      },
      {
        # VPC mode with subnets outside the approved set.
        Sid    = "DenyForeignSubnets"
        Effect = "Deny"
        Action = [
          "bedrock-agentcore:CreateAgentRuntime",
          "bedrock-agentcore:CreateAgentRuntimeEndpoint",
          "bedrock-agentcore:UpdateAgentRuntime",
          "bedrock-agentcore:CreateBrowser",
          "bedrock-agentcore:CreateCodeInterpreter",
        ]
        Resource = "*"
        Condition = {
          "ForAnyValue:StringNotEquals" = {
            "bedrock-agentcore:subnets" = [var.agent_subnet_id]
          }
        }
      },
      {
        # VPC mode with security groups outside the approved set.
        Sid    = "DenyForeignSecurityGroups"
        Effect = "Deny"
        Action = [
          "bedrock-agentcore:CreateAgentRuntime",
          "bedrock-agentcore:CreateAgentRuntimeEndpoint",
          "bedrock-agentcore:UpdateAgentRuntime",
          "bedrock-agentcore:CreateBrowser",
          "bedrock-agentcore:CreateCodeInterpreter",
        ]
        Resource = "*"
        Condition = {
          "ForAnyValue:StringNotEquals" = {
            "bedrock-agentcore:securityGroups" = [var.agent_security_group_id]
          }
        }
      },
    ]
  })
}

# Agent runtime subnet. Subnet-type SmartGroups match the workload by
# resource ID rather than CIDR, which is more precise for policy scoping.
resource "aviatrix_smart_group" "agentcore_runtime" {
  name = "agentcore-runtime-subnet"

  selector {
    match_expressions {
      type   = "subnet"
      res_id = var.agent_subnet_id
    }
  }
}

# FQDN SmartGroup scoping TLS decryption to GitHub hosts only.
# Used as the destination in rules 29 and 31 so that AWS service traffic
# (ECR, Bedrock, STS) is never decrypted.
resource "aviatrix_smart_group" "github_hosts" {
  name = "github-hosts"

  selector {
    match_expressions { fqdn = "api.github.com" }
    match_expressions { fqdn = "raw.githubusercontent.com" }
    match_expressions { fqdn = "github.com" }
  }
}

# Catch-all destination for default-deny and DNS exfil rules.
resource "aviatrix_smart_group" "any" {
  name = "any"

  selector {
    match_expressions {
      cidr = "0.0.0.0/0"
    }
  }
}

# East-West boundary (enterprise transit fabric deployments).
resource "aviatrix_smart_group" "adjacent_spokes" {
  name = "adjacent-spokes"

  selector {
    dynamic "match_expressions" {
      for_each = var.adjacent_spoke_cidrs
      content {
        cidr = match_expressions.value
      }
    }
  }
}

locals {
  allowed_model_domains = [
    "bedrock-runtime.*.amazonaws.com",
    "bedrock.*.amazonaws.com",
  ]

  aws_control_domains = [
    # Identity and observability
    "sts.*.amazonaws.com",
    "logs.*.amazonaws.com",
    "monitoring.*.amazonaws.com",
    "xray.*.amazonaws.com",
    "secretsmanager.*.amazonaws.com",
    # ECR auth API and registry (required for AgentCore VPC-mode image pull)
    "api.ecr.*.amazonaws.com",
    "*.dkr.ecr.*.amazonaws.com",
  ]
}

resource "aviatrix_web_group" "allowed_models" {
  name = "allowed-models"

  selector {
    dynamic "match_expressions" {
      for_each = local.allowed_model_domains
      content {
        snifilter = match_expressions.value
      }
    }
  }
}

resource "aviatrix_web_group" "aws_control" {
  name = "aws-control-domains"

  selector {
    dynamic "match_expressions" {
      for_each = local.aws_control_domains
      content {
        snifilter = match_expressions.value
      }
    }
  }
}

resource "aviatrix_web_group" "allowed_tools" {
  name = "allowed-tools"

  selector {
    dynamic "match_expressions" {
      for_each = var.allowed_tool_domains
      content {
        snifilter = match_expressions.value
      }
    }
  }
}

resource "aviatrix_web_group" "allowed_mcp_servers" {
  name = "allowed-mcp-servers"

  selector {
    dynamic "match_expressions" {
      for_each = var.allowed_mcp_server_domains
      content {
        snifilter = match_expressions.value
      }
    }
  }
}

# URL-path deny patterns for supply-chain indicators of compromise.
# urlfilter matches the full request path after decryption. Each entry
# is an independent pattern; a connection matching any entry is denied.
# Seed list covers the Shai-Hulud npm worm (Sep 2025). Append new
# entries from threat intelligence feeds as indicators are published.
resource "aviatrix_web_group" "supply_chain_ioc_github" {
  name = "supply-chain-ioc-github"

  selector {
    match_expressions {
      urlfilter = "api.github.com/repos/*/*shai-hulud*"
    }
    match_expressions {
      urlfilter = "raw.githubusercontent.com/*/*shai-hulud*"
    }
    match_expressions {
      urlfilter = "github.com/shai-hulud*"
    }
  }
}

resource "aviatrix_distributed_firewalling_config" "this" {
  enable_distributed_firewalling = true
}

resource "aviatrix_distributed_firewalling_policy_list" "agentcore" {
  depends_on = [
    aviatrix_distributed_firewalling_config.this,
    aviatrix_smart_group.agentcore_runtime,
    aviatrix_smart_group.github_hosts,
    aviatrix_smart_group.any,
    aviatrix_smart_group.adjacent_spokes,
    aviatrix_web_group.allowed_models,
    aviatrix_web_group.aws_control,
    aviatrix_web_group.allowed_tools,
    aviatrix_web_group.allowed_mcp_servers,
    aviatrix_web_group.supply_chain_ioc_github,
  ]

  # ---- 29: URL-path deny for supply-chain IoC on GitHub hosts ---------------
  # Scoped to github_hosts SmartGroup so decryption fires only for
  # GitHub-bound flows. AWS service traffic (ECR, Bedrock, STS) passes
  # through encrypted via rules 30 and 32. Requires Controller 9.0+.
  policies {
    name     = "deny-supply-chain-ioc"
    action   = "DENY"
    priority = 29
    protocol = "TCP"
    logging  = true

    src_smart_groups = [aviatrix_smart_group.agentcore_runtime.uuid]
    dst_smart_groups = [aviatrix_smart_group.github_hosts.uuid]
    web_groups       = [aviatrix_web_group.supply_chain_ioc_github.uuid]

    decrypt_policy = "DECRYPT_ALLOWED"
    tls_profile    = var.dcf_tls_profile_uuid

    port_ranges { lo = 443 }
  }

  # ---- 30: egress to sanctioned model providers ----------------------------
  # DECRYPT_NOT_ALLOWED: Bedrock uses AWS SigV4; cert-chain changes break auth.
  policies {
    name     = "allow-models"
    action   = "PERMIT"
    priority = 30
    protocol = "TCP"
    logging  = true

    src_smart_groups = [aviatrix_smart_group.agentcore_runtime.uuid]
    dst_smart_groups = [aviatrix_smart_group.any.uuid]
    web_groups       = [aviatrix_web_group.allowed_models.uuid]

    decrypt_policy = "DECRYPT_NOT_ALLOWED"

    port_ranges { lo = 443 }
  }

  # ---- 31: egress to sanctioned tool destinations --------------------------
  # Scoped to github_hosts SmartGroup. Decryption is ALLOWED so the spoke
  # gateway can confirm the URL path was not blocked by rule 29 before
  # permitting the connection. Legitimate GitHub tool calls pass here.
  policies {
    name     = "allow-tools"
    action   = "PERMIT"
    priority = 31
    protocol = "TCP"
    logging  = true

    src_smart_groups = [aviatrix_smart_group.agentcore_runtime.uuid]
    dst_smart_groups = [aviatrix_smart_group.github_hosts.uuid]
    web_groups       = [aviatrix_web_group.allowed_tools.uuid]

    decrypt_policy = "DECRYPT_ALLOWED"
    tls_profile    = var.dcf_tls_profile_uuid

    port_ranges { lo = 443 }
  }

  # ---- 32: egress to AWS control-plane service APIs ------------------------
  # DECRYPT_NOT_ALLOWED: AWS service endpoints fail TLS verification when
  # intercepted. ECR image pull and container bootstrap cannot use a
  # custom trust store in the AgentCore microVM environment.
  policies {
    name     = "allow-aws-control"
    action   = "PERMIT"
    priority = 32
    protocol = "TCP"
    logging  = true

    src_smart_groups = [aviatrix_smart_group.agentcore_runtime.uuid]
    dst_smart_groups = [aviatrix_smart_group.any.uuid]
    web_groups       = [aviatrix_web_group.aws_control.uuid]

    decrypt_policy = "DECRYPT_NOT_ALLOWED"

    port_ranges { lo = 443 }
  }

  # ---- 33: egress to sanctioned remote MCP servers -------------------------
  # DECRYPT_NOT_ALLOWED: the MCP Python client validates the server cert
  # against certifi and fails if the chain is intercepted.
  policies {
    name     = "allow-mcp-servers"
    action   = "PERMIT"
    priority = 33
    protocol = "TCP"
    logging  = true

    src_smart_groups = [aviatrix_smart_group.agentcore_runtime.uuid]
    dst_smart_groups = [aviatrix_smart_group.any.uuid]
    web_groups       = [aviatrix_web_group.allowed_mcp_servers.uuid]

    decrypt_policy = "DECRYPT_NOT_ALLOWED"

    port_ranges { lo = 443 }
  }

  # ---- 50: DNS exfiltration block ------------------------------------------
  # The runtime's legitimate DNS to the VPC resolver (169.254.169.253) is
  # intra-VPC and does not traverse the spoke gateway.
  policies {
    name     = "deny-dns-exfil"
    action   = "DENY"
    priority = 50
    protocol = "UDP"
    logging  = true

    src_smart_groups = [aviatrix_smart_group.agentcore_runtime.uuid]
    dst_smart_groups = [aviatrix_smart_group.any.uuid]

    port_ranges { lo = 53 }
  }

  # ---- 80: East-West deny (enterprise transit fabric) ----------------------
  policies {
    name     = "deny-east-west"
    action   = "DENY"
    priority = 80
    protocol = "ANY"
    logging  = true

    src_smart_groups = [aviatrix_smart_group.agentcore_runtime.uuid]
    dst_smart_groups = [aviatrix_smart_group.adjacent_spokes.uuid]
  }

  # ---- 100: default deny catch-all -----------------------------------------
  policies {
    name     = "default-deny"
    action   = "DENY"
    priority = 100
    protocol = "ANY"
    logging  = true

    src_smart_groups = [aviatrix_smart_group.agentcore_runtime.uuid]
    dst_smart_groups = [aviatrix_smart_group.any.uuid]
  }
}