The bedrock-mantle VPC Endpoint Service Explained

AWS PrivateLink lets you reach Amazon Bedrock from inside your VPC (Virtual Private Cloud — your isolated slice of the AWS network) without an internet gateway, NAT device, VPN, or Direct Connect connection. Instances don't even need public IP addresses. You create an interface VPC endpoint, and AWS places an endpoint network interface in each subnet you enable; that interface becomes the private front door for Bedrock-bound traffic.

The catch for Claude users is that Bedrock is not one service behind one door. Each API surface has its own PrivateLink endpoint service, and the newer "Claude in Amazon Bedrock" Messages API — the surface the AnthropicBedrockMantle client talks to — is a separate service called bedrock-mantle.

One Bedrock, several endpoint services

AWS documents distinct endpoint service names per surface:

Endpoint service name	What it carries
`com.amazonaws.{region}.bedrock`	Control plane (management APIs)
`com.amazonaws.{region}.bedrock-runtime`	Legacy inference surface (InvokeModel / Converse)
`com.amazonaws.{region}.bedrock-mantle`	Messages-API surface ("Claude in Amazon Bedrock")
`com.amazonaws.{region}.bedrock-agent`	Bedrock Agents (build-time)
`com.amazonaws.{region}.bedrock-agent-runtime`	Bedrock Agents (runtime)

The split follows the public DNS names. The legacy surface lives at bedrock-runtime.{region}.amazonaws.com, while the Messages API is served at bedrock-mantle.{region}.api.aws. Different hostnames, different endpoint services, and — as covered in the quota deep dive — even separately tracked quotas.

Practical consequence: if your VPC has an endpoint only for bedrock-runtime, traffic from AnthropicBedrockMantle or raw calls to bedrock-mantle.{region}.api.aws does not use it. In a VPC with no internet path, those calls simply fail; in a VPC with a NAT gateway, they take the public route your security team thought was closed. Create endpoints for every surface you actually use.

Private DNS: the no-code-change option

When you create an interface endpoint, you can enable private DNS. With it on, the standard service hostnames — bedrock-runtime.{region}.amazonaws.com, bedrock-mantle.{region}.api.aws, and the rest — automatically resolve to the endpoint's private interfaces from inside the VPC. Your SDK clients need no configuration changes at all.

Without private DNS, clients must target the endpoint-specific URL explicitly — for example, boto3 accepts endpoint_url="https://{vpce-id}.bedrock-runtime.us-east-1.vpce.amazonaws.com" on the legacy surface. Private DNS is usually the simpler and safer choice, because it removes the chance of one misconfigured client falling back to the public route. Bedrock endpoints are available in multiple Availability Zones, so spread the endpoint across the subnets where your workloads run.

Scoping the endpoint policy per surface

An interface endpoint carries a VPC endpoint policy — a resource-based policy attached to the endpoint itself that restricts which principals can perform which actions through that endpoint. The default policy allows full Bedrock access, so tightening it is worthwhile. Crucially, the two inference surfaces use different IAM action namespaces, so the policies look different:

For a bedrock-runtime endpoint, AWS's example policy allows bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream.
For a bedrock-mantle endpoint, the example policy allows bedrock-mantle:CreateInference — the action namespace of the Messages-API surface.

A minimal mantle endpoint policy looks like this:

{
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "bedrock-mantle:CreateInference",
    "Resource": "*"
  }]
}

Remember that an endpoint policy is a filter, not a grant: callers still need matching identity-based IAM permissions. The endpoint policy simply guarantees that nothing beyond inference (no management actions, no model-access changes) can transit that particular private path. Pair it with least-privilege identity policies — see the IAM least-privilege guide and Bedrock IAM setup.

Checklist for a locked-down deployment

Inventory which surfaces you call: Messages API (bedrock-mantle), legacy InvokeModel/Converse (bedrock-runtime), console/management (bedrock), Agents (bedrock-agent, bedrock-agent-runtime).
Create one interface endpoint per surface per region, with private DNS enabled.
Replace the default allow-all endpoint policy with the surface-appropriate action list.
If government or FIPS requirements apply, note that FIPS endpoint variants exist for some surfaces but not others — see the FIPS endpoints article.

Where to go next

For the broader private-networking picture across all four platforms, read the VPC and private networking overview, or jump to the platform comparison on the homepage.

Sources

← All articles