AWS WAF adds support for Amazon Bedrock AgentCore Gateway
Apply WAF rules once at the Gateway layer to protect all your AI agents, tools, and integrations from exploits and abuse in production.
View original announcement →Visual Summary
graph TD
A{{AWS WAF for AgentCore Gateway}}:::announced
B(AgentCore Gateway):::compute
C([IP-Based Access Controls]):::feature
D([Rate-Based Rules]):::feature
E([Managed Rule Groups]):::feature
F((Internet Traffic)):::external
G(MCP Tools & Agents):::compute
H(AWS Lambda):::compute
I([Bot Control]):::feature
F ==>|"requests"| A
A ==>|"protects"| B
A -->|"enforces"| C
A -->|"throttles"| D
A -->|"applies"| E
A -.->|"detects bots"| I
B -->|"routes to"| G
B -->|"invokes"| H
classDef announced fill:#ff9900,stroke:#ec7211,color:#fff,font-weight:bold
classDef compute fill:#e3f2fd,stroke:#1565c0,color:#1565c0
classDef storage fill:#e8f5e9,stroke:#2e7d32,color:#2e7d32
classDef feature fill:#fff3e0,stroke:#e65100,color:#e65100
classDef external fill:#f5f5f5,stroke:#616161,color:#616161
What's New
AWS has announced general availability of AWS WAF integration with Amazon Bedrock AgentCore Gateway, enabling security and platform teams to apply web application firewall protections directly at the AI gateway layer. Organizations can now associate a WAF protection pack with their AgentCore Gateway to enforce IP-based access controls, rate limiting, and AWS Managed Rule Groups across all downstream agentic workloads. This launch bridges the gap between enterprise security practices and production-grade agentic AI deployments.
How It Works
- Protection Pack Association: You associate an AWS WAF protection pack (web ACL) with your AgentCore Gateway through the AWS WAF console or APIs, following the same model used for other regional resources like API Gateway and Application Load Balancers.
- Centralized Policy Enforcement: The protection pack is configured once at the Gateway level and automatically applies to every target behind that Gateway—including MCP tools, passthrough agents, Lambda functions, and model routing endpoints—eliminating per-target configuration.
- IP-Based Access Controls: Administrators can define IP sets and IP-based rules to allow or block traffic from specific addresses or CIDR ranges before requests reach any downstream agent or tool.
- Rate-Based Rules: Throttling rules can be applied to detect and limit abusive or anomalous traffic patterns, protecting agentic workloads from volumetric abuse and denial-of-service attempts.
- AWS Managed Rule Groups: Teams can enable pre-built rule sets including the Common Rule Set (CRS), Known Bad Inputs, and Bot Control to defend against OWASP top-10 exploits, malformed inputs, and automated bot traffic targeting AI endpoints.
- Regional Resource Model: The WAF protection pack must reside in the same AWS Region as the AgentCore Gateway, consistent with how WAF protects other regional resource types.
Why It's Important
- Production Readiness for Agentic AI: As enterprises graduate agentic applications from prototype to production, consistent security controls at the ingress layer are a prerequisite—this integration closes a critical gap that previously required custom workarounds.
- Single Pane of Glass Security: Security teams can manage WAF policies for agentic workloads using the same tooling, rule groups, and workflows already used for APIs and web applications, reducing operational complexity.
- Blast Radius Reduction: A single misconfigured or compromised agent endpoint could expose all downstream tools and integrations; centralized WAF enforcement at the Gateway layer limits the blast radius of any individual vulnerability.
- Bot and Abuse Protection for AI Endpoints: AI inference endpoints are attractive targets for scraping, prompt injection via automated bots, and abuse—Bot Control and rate-based rules provide purpose-built defenses at the network edge.
- Compliance and Governance Alignment: Regulated industries requiring demonstrable access controls and traffic inspection on all internet-facing endpoints can now include agentic AI workloads within existing WAF compliance postures.
- Reduced Developer Burden: Developers building agents no longer need to implement custom rate limiting or IP filtering logic within application code; the Gateway handles it uniformly across all targets.
How It's Different
- Gateway-Level vs. Per-Resource Protection: Unlike protecting individual API Gateway endpoints or Lambda functions separately, a single WAF protection pack on AgentCore Gateway covers all tools, agents, and model routes behind it simultaneously.
- AI-Native Ingress Point: AgentCore Gateway is purpose-built for agentic traffic (MCP tools, A2A routing, model inference), meaning WAF rules here are applied in the context of AI workload patterns rather than generic HTTP traffic.
- Unified Ingress + Egress Security: AgentCore Gateway already provides both ingress and egress authentication; adding WAF creates a layered security model at the entry point that no other managed AI gateway currently offers in a fully-managed configuration.
- Consistent Policy Across Heterogeneous Targets: Whether the downstream target is a Lambda function, an OpenAPI-defined tool, a Salesforce integration, or another agent, the same WAF policy applies—eliminating policy drift across diverse target types.
- Managed Rule Group Applicability: AWS Managed Rule Groups (Known Bad Inputs, Bot Control) are now applicable to AI agent traffic, extending protections originally designed for web apps to the emerging agentic AI attack surface.
When to Prefer It
- Enterprises Moving Agents to Production: Any team transitioning agentic applications from internal prototypes to externally accessible or customer-facing production deployments where security reviews require demonstrable WAF controls.
- Multi-Tenant Agentic Platforms: Platform teams hosting multiple agents or tools behind a single Gateway who need uniform security enforcement without duplicating configurations per agent.
- Regulated Industries: Financial services, healthcare, and government workloads subject to compliance frameworks (PCI-DSS, HIPAA, FedRAMP) that mandate web application firewall coverage on all internet-facing endpoints.
- High-Traffic AI Applications: Scenarios where AI endpoints may be targeted by bots, scrapers, or abusive clients—rate-based rules and Bot Control provide automated throttling without application-layer changes.
- Security-Conscious DevOps Teams: Organizations that already use AWS WAF for their API and web tiers and want to extend the same security posture to agentic workloads without adopting new tooling.
- Zero-Trust Network Architectures: Environments enforcing IP allowlisting or strict access controls where only known IP ranges should be permitted to invoke agent endpoints.
Availability
- GA Status: Generally available as of June 29, 2026—this is not a preview or beta release.
- Regional Availability: Available in all AWS Regions where both AWS WAF and Amazon Bedrock AgentCore Gateway are supported; check the AWS Regional Services List for the current intersection of supported regions.
- Resource Type Classification: AgentCore Gateway is treated as a regional resource; the WAF protection pack must be created in the same Region as the Gateway (not the global CloudFront region).
- Pricing: AWS WAF pricing applies based on the number of protection packs (web ACLs), rules, and requests processed; AgentCore Gateway pricing applies separately—refer to the AWS WAF and Amazon Bedrock AgentCore pricing pages for current rates.
- Limitations: WAF protection is applied at the Gateway level only; individual downstream targets cannot have separate, independent WAF policies through this mechanism. Availability is contingent on both services being present in the same region.
