Use AWS PrivateLink to configure private access to Amazon Bedrock

Amazonian base is a fully managed service provided by AWS that provides developers with access to foundation models (FM) and the tools to customize them for specific applications. It allows developers to build and scale generative AI applications using FM through an API, without managing infrastructure. You can choose from different FMs from Amazon and leading AI startups like AI21 Labs, Anthropic, Cohere, and Stability AI to find the best model for your use case. With the Amazon Bedrock Serverless Experience, you can get started quickly, easily experiment with FMs, privately customize them with your own data, and then seamlessly integrate and deploy them into your applications using AWS tools and features.

Customers build innovative generative AI applications using Amazon Bedrock APIs using their own first-party data. When accessing Amazon Bedrock APIs, customers are looking for a mechanism to configure a data perimeter without exposing their data to the Internet so they can mitigate potential threat vectors related to Internet exposure. The Amazon Bedrock VPC endpoint powered by AWS PrivateLink allows you to establish a private connection between your account’s VPC and the Amazon Bedrock service account. It allows VPC instances to communicate with service resources without the need for public IP addresses.

In this article, we show how to configure private access on your AWS account to access Amazon Bedrock APIs via VPC endpoints powered by PrivateLink to help you securely build generative AI applications with your own data.

Solution Overview

You can use generative AI to develop a diverse range of applications, such as text summarization, content moderation, and other features. When building such generative AI applications using FM or base models, customers want to generate a response without going through the public internet or based on their proprietary data which may reside in the bases of their company’s data.

In the following diagram, we describe an architecture for configuring your infrastructure to read your proprietary data residing in Amazon Relational Database Service (Amazon RDS) and augment the Amazon Bedrock API request with product information when answering product-related queries from your generative AI application. Although we use Amazon RDS in this diagram for illustration purposes, you can test private access of Amazon Bedrock APIs end-to-end using the instructions in this article.

The workflow steps are as follows:

1. AWS Lambda running in your private VPC subnet receives the prompt request from the generative AI application.
2. Lambda calls the proprietary RDS database, augments the prompt query context (for example, adding product information), and calls the Amazon Bedrock API with the augmented query query.
3. The API call is routed to the Amazon Bedrock VPC endpoint associated with the VPC endpoint policy with Allow Amazon Bedrock APIs permissions.
4. The Amazon Bedrock service API endpoint receives the API request through PrivateLink without going through the public Internet.
5. You can change the endpoint policy of an Amazon Bedrock VPC to Deny Permissions to validate that Amazon Bedrock API calls are denied.
6. You can also privately access Amazon Bedrock APIs through the VPC endpoint from your corporate network via a AWS Direct Connect bridge.

Preconditions

Before you begin, make sure you have the following prerequisites:

• A AWS account
• A AWS Identity and Access Management Federation role (IAM) with access to do the following:
  • Create, edit, view, and delete VPC network resources
  • Create, edit, view, and delete Lambda functions
  • Create, edit, view, and delete IAM roles and policies
  • List foundation templates and call the Amazon Bedrock foundation template
• For this article we use the us-east-1 Region
• Request access to the foundation model via the Amazon Bedrock console

Establish private access infrastructure

In this section, we configure the infrastructure such as VPC, private subnets, security groups and Lambda function using a AWS Cloud Training model.

Use the following model to create the infrastructure stack Bedrock-GenAI-Stack in your AWS account.

The CloudFormation template creates the following resources on your behalf:

• A VPC with two private subnets in separate Availability Zones
• Security groups and routing tables
• IAM role and policies for use by Lambda, Amazon Bedrock and Amazon Elastic Compute Cloud (Amazon EC2)

Configure a VPC endpoint for Amazon Bedrock

In this section we use Amazon Virtual Private Cloud (Amazon VPC) to configure a VPC endpoint for Amazon Bedrock to facilitate private connectivity from your VPC to Amazon Bedrock.

1. On the Amazon VPC console, under Virtual private cloud In the navigation pane, choose Endpoints.
2. Choose Create an endpoint.
   
3. For Name tagenter bedrock-vpce.
4. Below Servicessearch for bedrock-runtime and select com.amazonaws.<region>.bedrock-runtime.
5. For VPCspecify the VPC Bedrock-GenAI-Project-vpc that you created via the CloudFormation stack in the previous section.
   
6. In the Subnets then select the availability zones and choose the corresponding subnet IDs from the drop-down menu.
   
7. For Security groupsselect the security group with the group name Bedrock-GenAI-Stack-VPCEndpointSecurityGroup- and description Allow TLS for VPC Endpoint.

A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. Note that this VPC endpoint security group only allows traffic from the security group attached to your VPC private subnets, adding a layer of protection.

8. Choose Create an endpoint.
9. In the Policy section, select Custom and enter the following least privilege policy to ensure that only certain actions are allowed on the specified foundation template resource, arn:aws:bedrock:*::foundation-model/anthropic.claude-instant-v1 for a given principal (such as the Lambda function’s IAM role).

   {
   	"Version": "2012-10-17",
   	"Statement": (
   		{
   		    "Action": (
   		        "bedrock:InvokeModel"
   		        ),
   		    "Resource": (
   		        "arn:aws:bedrock:*::foundation-model/anthropic.claude-instant-v1"
   		        ),
   		    "Effect": "Allow",
   		    "Principal": {
                   "AWS": "arn:aws:iam::<accountid>:role/GenAIStack-Bedrock"
               }
   		}
   	)
   }

It may take up to 2 minutes until the interface endpoint is created and the status changes to Available. You can refresh the page to check the latest status.

Configure Lambda function on private VPC subnets

Complete the following steps to configure the Lambda function:

1. On the Lambda console, choose Functions in the navigation pane.
2. Choose the function gen-ai-lambda-stack-BedrockTestLambdaFunction-XXXXXXXXXXXX.
   
3. On the Configuration tab, choose Permissions in the left pane.
4. Below Execution role¸ choose the link for the role gen-ai-lambda-stack-BedrockTestLambdaFunctionRole-XXXXXXXXXXXX.
   

You are redirected to the IAM console.

5. In the Permissions Policies section, choose Add permissions and choose Create an online policy.
   
6. On the JSON modify the policy as follows:

   {
       "Version": "2012-10-17",
       "Statement": (
           {
               "Sid": "eniperms",
               "Effect": "Allow",
               "Action": (
                   "ec2:CreateNetworkInterface",
                   "ec2:DescribeNetworkInterfaces",
                   "ec2:DeleteNetworkInterface",
                   "ec2:*VpcEndpoint*"
               ),
               "Resource": "*"
           }
       )
   }

7. Choose Following.
8. For Policy Nameenter enivpce-policy.
9. Choose Create a policy.
   
10. Add the following inline policy (provide your source VPC endpoints) to restrict Lambda access to Amazon Bedrock APIs only through VPC endpoints:

    {
        "Id": "lambda-bedrock-sourcevpce-access-only",
        "Version": "2012-10-17",
        "Statement": (
            {
                "Effect": "Allow",
                "Action": (
    		   "bedrock:ListFoundationModels",
                    "bedrock:InvokeModel"
                ),
                "Resource": "*",
                "Condition": {
                    "ForAnyValue:StringEquals": {
                        "aws:sourceVpce": (
                            "vpce-<bedrock-runtime-vpce>"
                        )
                    }
                }
            }
        )
    } 

11. On the Lambda function page, on the page Configuration tab, choose VPC in the left pane, then choose To modify.
    
12. For VPCchoose Bedrock-GenAI-Project-vpc.
13. For Subnetschoose private subnets.
    
14. For Security groupschoose gen-ai-lambda-stack-SecurityGroup- (the security group for Amazon Bedrock workload in private subnets).
15. Choose To safeguard.
    

Test private access controls

You can now test private access controls (Amazon Bedrock API on VPC endpoints).

1. On the Lambda console, choose Functions in the navigation pane.
2. Choose the function gen-ai-lambda-stack-BedrockTestLambdaFunction-XXXXXXXXXXXX.
3. On the Coded tab, choose Test.

You should see the following response from the Amazon Bedrock API call (Status: Successful).

4. To deny access to Amazon Bedrock APIs on a VPC endpoints, go to the Amazon VPC console.
5. Below Virtual private cloud In the navigation pane, choose Endpoints.
6. Choose your font and go to Politics tab.

Currently, a VPC’s endpoint policy is set to Allow.

7. To deny access, choose Edit policy.
   
8. Change Allow has Deny and choose To safeguard.

It may take up to 2 minutes to update the VPC endpoint policy.

{
	"Version": "2012-10-17",
	"Statement": (
		{
		    "Action": (
		        "bedrock:InvokeModel"
		        ),
		    "Resource": (
		        "arn:aws:bedrock:*::foundation-model/anthropic.claude-instant-v1"
		        ),
		    "Effect": "Deny",
		    "Principal": {
                "AWS": "arn:aws:iam::<accountid>:role/GenAIStack-Bedrock"
            }
		}
	)
}

9. Return to the Lambda function page and to the page Coded tab, choose Test.

As shown in the following screenshot, the request to access Amazon Bedrock through the VPC endpoint was denied (Status: Failed).

Through this testing process, we demonstrated how traffic from your VPC to the Amazon Bedrock API endpoint travels through the PrivateLink connection and not through the Internet connection.

To clean

Follow these steps to avoid incurring future charges:

1. Clean up VPC endpoints.
2. Clean up the VPC.
3. Delete the CloudFormation stack.

Conclusion

In this article, we showed how to configure and operationalize a private connection between a generative AI workload deployed on your customer VPC and Amazon Bedrock using a VPC interface endpoint powered by PrivateLink. When you use the architecture described in this article, traffic between your customer VPC and Amazon Bedrock will not leave the Amazon network, ensuring that your data is not exposed to the public Internet and meeting your compliance requirements.

As a next step, try the solution in your account and share your feedback.

about the authors

Ram Vittal is a Principal ML Solutions Architect at AWS. He has over three decades of experience architecting and building distributed, hybrid, and cloud applications. He is passionate about creating secure and scalable AI/ML and Big Data solutions to help enterprise customers on their cloud adoption and optimization journey to improve business outcomes. In his spare time, he rides a motorcycle and walks with his 3-year-old Sheepadoodle!

Ray Khorsandi is an AI/ML specialist at AWS, supporting strategic customers with AI/ML best practices. With an M.Sc. and Ph.D. With degrees in electrical engineering and computer science, he leads companies to create secure and scalable AI/ML and Big Data solutions to optimize their cloud adoption. His passions include computer vision, NLP, generative AI and MLOps. Ray enjoys playing football and spending quality time with family.

Michael Daniels is an AI/ML Specialist at AWS. His expertise lies in creating and leading AI/ML and generative AI solutions for complex and challenging business problems, which are enhanced by his Ph.D. from the Univ. of Texas and his M.S. degree. in Computer Science, specializing in machine learning from the Georgia Institute of Technology. He excels at applying cutting-edge cloud technologies to innovate, inspire and transform leading organizations, while effectively communicating with stakeholders at all levels and scales. In his free time, you can see Michael skiing or snowboarding in the mountains.