2 ms·
How do you handle network egress filtering when an agent legitimately needs to install dependencies or pull docs versus preventing arbitrary outbound traffic du
by xms17189 18d ago
How do you handle network egress filtering when an agent legitimately needs to install dependencies or pull docs versus preventing arbitrary outbound traffic during autonomous execution?
- new23d 17d agoIf the workload's network interface (ENI in AWS) is in a VPC that you manage, an outbound traffic filtering solution can prevent that. See AWS Network Firewall or the product we develop, DiscrimiNAT (https://chasersystems.com/ https://chasersystems.com/), for example. Rules can be per Security Group, too, for fine-grained access control. I would also strongly recommend that installation of dependencies is a build-time task, not a run-time task, and if those two stages are separated, it makes egress filtering a whole lot more effective since the build-time allowlists are often multi-tenant CDNs where a threat actor can host their own data capturing or malicious payload delivering service.
- cdani 16d agoRight now there is no such filter, but it'up to the administrator to se the boundaries. You can deploy the AgentCore Runtime in a VPC and so you can apply whataver traffic rules you want