Control which domains your AI agents can access
Amazon AWS AI Blog / 4/2/2026
💬 OpinionDeveloper Stack & InfrastructureTools & Practical Usage
Key Points
- The article explains how to configure AWS Network Firewall to limit AgentCore resources to an allowlist of approved internet domains.
- It focuses on domain-level filtering using SNI (Server Name Indication) inspection as a defense-in-depth control.
- The approach is positioned as the first layer of a broader security strategy to reduce what external endpoints AI agents can reach.
- By restricting outbound domain access, organizations can better manage and mitigate data exfiltration and unsafe browsing risks associated with agent workflows.
In this post, we show you how to configure AWS Network Firewall to restrict AgentCore resources to an allowlist of approved internet domains. This post focuses on domain-level filtering using SNI inspection — the first layer of a defense-in-depth approach.
