By default, an application in your VPC (virtual private cloud — your isolated network inside AWS) reaches Bedrock over its public regional API endpoint, which typically requires an internet gateway or NAT. AWS PrivateLink removes that requirement: you create an interface VPC endpoint for the Bedrock service, and traffic between your instances and Bedrock flows over private network interfaces inside your VPC. Per AWS's documentation, instances then need no public IP addresses, and no internet gateway, NAT device, VPN, or Direct Connect connection is needed to talk to Bedrock.
Pick the right endpoint service — there are several
Bedrock is not one service name under PrivateLink. The ones most relevant to Claude workloads:
| Endpoint service name | What it carries |
|---|---|
com.amazonaws.{region}.bedrock-runtime | Inference on the classic surface: InvokeModel, Converse, streaming variants |
com.amazonaws.{region}.bedrock-mantle | Inference on the newer "Claude in Amazon Bedrock" Messages-API surface |
com.amazonaws.{region}.bedrock | Control plane: model access, logging configuration, guardrail management |
com.amazonaws.{region}.bedrock-agent / bedrock-agent-runtime | Bedrock Agents build-time and runtime |
Most Claude teams need an inference endpoint (bedrock-runtime, bedrock-mantle, or both, matching whichever surface your SDK uses) and often the control-plane bedrock endpoint for administration. FIPS variants (bedrock-fips, bedrock-runtime-fips) exist in us-east-1, us-east-2, us-west-2, ca-central-1, and the two GovCloud regions.
Setup, step by step
1. Create the interface endpoint. In the VPC console (or via infrastructure-as-code), create an interface endpoint for the service name above in your workload's region, select the subnets where your application runs, and attach a security group that allows HTTPS (port 443) from your application.
2. Decide on private DNS. With private DNS enabled — the common choice — the standard regional hostnames (bedrock-runtime.{region}.amazonaws.com, bedrock-mantle.{region}.api.aws, and so on) automatically resolve to the endpoint's private addresses inside your VPC. Nothing in your application changes; existing code silently goes private.
3. If private DNS is off, point the SDK at the endpoint explicitly. AWS documents passing the endpoint-specific URL to your client, in the form https://{vpce-id}.bedrock-runtime.{region}.vpce.amazonaws.com.
With private DNS on, your Claude code is unchanged. The same client you use today keeps working — the routing beneath it is what moved:
# Unchanged application code — private DNS routes it through the endpoint
from anthropic import AnthropicBedrockMantle
client = AnthropicBedrockMantle(aws_region="us-east-1")
message = client.messages.create(
model="anthropic.claude-sonnet-5",
max_tokens=512,
messages=[{"role": "user", "content": "Summarize this claim note..."}],
)
print(message.content)What PrivateLink does and does not give you
It keeps inference traffic on the AWS network and off the public internet, and it gives you a network chokepoint you can police — the endpoint accepts a policy document restricting which principals, actions, and model resources can pass through it (covered in the endpoint-policy article). It does not, by itself, restrict who can call Bedrock from outside the VPC; IAM still governs that. And if you use cross-region inference profiles, note AWS's statement that cross-region traffic stays on the AWS network and is encrypted in transit — routing between regions does not undo the private-networking story.
One operational nuance: quotas and surfaces stay distinct. The bedrock-runtime and bedrock-mantle endpoints are separate services with separately tracked quotas, so if your organization runs both the legacy InvokeModel/Converse surface and the newer Messages-API surface, you need an interface endpoint for each.
Where to go next
Lock the endpoint down with a VPC endpoint policy, then layer on security groups, NACLs, and Flow Logs. For the broader private-networking picture across platforms, see VPC and private networking.