How to Keep LLM API Traffic Off the Public Internet on AWS

Enterprise security reviews regularly ask whether prompts and responses cross the public internet. On AWS, you can keep calls to Amazon Bedrock on private network paths with VPC interface endpoints, which run on AWS PrivateLink.

Step 1: Map the traffic

List every workload that calls Bedrock and where it runs: private subnets, containers on EKS or ECS, Lambda functions attached to a VPC. Workloads with no VPC connection, such as a Lambda function outside any VPC, need to move into one first.

Step 2: Create interface endpoints

Create endpoints for the Bedrock services your applications use. The runtime endpoint handles model invocation:

resource "aws_vpc_endpoint" "bedrock_runtime" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.us-east-1.bedrock-runtime"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.bedrock_endpoint.id]
  private_dns_enabled = true
}

With private DNS enabled, the standard endpoint name resolves to private addresses inside the VPC, so application code doesn't change. Add endpoints for the other services your workloads call, such as CloudWatch Logs and Secrets Manager.

Step 3: Restrict the security group

Allow HTTPS on port 443 to the endpoint only from the security groups of workloads that need it.

Step 4: Add an endpoint policy

An endpoint policy limits what can be done through the endpoint, for example invoking only approved models by principals in your own account. Together with IAM policies, it gives security teams two independent controls.

Step 5: Remove the public route

Once calls work through the endpoint, remove the route these workloads used through a NAT gateway, or block it with firewall rules. Then test both sides: a Bedrock call should still succeed, and a call to an unrelated public API should fail.

Step 6: Prove it

Reviewers will ask for evidence. VPC Flow Logs show traffic going to the endpoint's private addresses, and CloudTrail records each API call along with the VPC endpoint ID.

Things to watch

• Other providers. Model APIs outside AWS need their own private connectivity options, or an egress proxy with a strict allow list.
• Regions. Endpoints are regional. Cross-region inference can still process requests in other regions, which is a data residency question rather than a networking one.
• DNS. Private DNS only works when the VPC uses AWS-provided DNS or forwards those names correctly.

Start in a development VPC and write down each step as you go. That document becomes your evidence for the security review.