---
title: AWS AgentCore public-network sandbox created with an execution role
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > AWS AgentCore public-network sandbox
  created with an execution role
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# AWS AgentCore public-network sandbox created with an execution role
Classification:attackTactic:[TA0005-defense-evasion](https://attack.mitre.org/tactics/TA0005)Technique:[T1578-modify-cloud-compute-infrastructure](https://attack.mitre.org/techniques/T1578) 
## Goal{% #goal %}

Detects creation of an Amazon Bedrock AgentCore Code Interpreter or Browser sandbox that is both attached to an IAM execution role and configured with a public network mode.

## Strategy{% #strategy %}

This rule monitors CloudTrail management events for `bedrock-agentcore.amazonaws.com` where the event `CreateCodeInterpreter` or `CreateBrowser` occurs, `@requestParameters.executionRoleArn` is present, and `@requestParameters.networkConfiguration.networkMode` is `PUBLIC`.

AgentCore Code Interpreter and Browser sandboxes execute agent-generated code or drive automated web browsing on the caller's behalf, and can be configured with an attached IAM execution role that grants the sandbox permissions to call other AWS services. Pairing that execution role with a `PUBLIC` network mode removes network-level containment, so a sandbox compromised through prompt injection, malicious tool output, or code-execution abuse could reach the public internet and pivot into other AWS resources using the attached role's permissions.

## Triage and response{% #triage-and-response %}

- Examine `{{@userIdentity.arn}}` to determine who or what created the sandbox and whether that principal normally provisions AgentCore resources.
- Review `{{@requestParameters.executionRoleArn}}` to identify the permissions granted to the sandbox and assess the impact if the sandbox were compromised.
- Check the `@requestParameters.networkConfiguration` field to confirm the sandbox is configured for `PUBLIC` network access.
- Identify which sandbox type was created using (`CreateCodeInterpreter` or `CreateBrowser`) and review its intended use case with the owning team.
- Check user agent, geo-location information, and AWS region for unexpected tooling, source networks, or regions inconsistent with normal AgentCore administration.
- Review nearby IAM and STS activity involving the attached execution role to determine whether it has been used outside the sandbox's expected scope.