Trusted Vendors for AI Agent Deployment in Your VPC (2026)
The short answer
Deploy agents on the agent runtime of the cloud whose network you already secure, in its private-networking mode. All three hyperscalers now run managed agents with private connectivity into your network. As of October 29, 2026:
| Vendor | Runtime | How it reaches your network | Data stays in | Pricing |
|---|---|---|---|---|
| AWS | Bedrock AgentCore Runtime (+ Code Interpreter, Browser) | ENIs in your subnets with your security groups; AgentCore VPC endpoint (PrivateLink) for inbound API calls | Your VPC resources; isolated microVMs per session | Per vCPU-hour and GB-hour; no seat fee |
| Microsoft | Foundry Agent Service, Standard Setup with private networking | Agent compute in a delegated subnet of your VNet; private endpoints; deny-by-default network rules | Your Azure Storage, AI Search and Cosmos DB (bring your own) | Model and resource consumption |
| Google Cloud | Gemini Enterprise Agent Platform Agent Runtime | Private Service Connect interface via a network attachment in your project; VPC Service Controls perimeter | Your project; public internet access blocked inside the perimeter | Consumption |
This is a spoke of our trusted agent control plane providers for enterprise ranking, which covers identity, policy and inventory; this page covers where the agent runs and how its traffic flows.
How each one works
AWS Bedrock AgentCore. When you configure VPC connectivity, AgentCore creates elastic network interfaces in the subnets you specify, using a service-linked role; each gets a private IP, and your security groups decide what the runtime and its Code Interpreter and Browser tools can reach — a private database, an internal API. In the other direction, adding the AgentCore VPC endpoint lets applications in your VPC call AgentCore Runtime and Gateway without traversing the internet. Two operational notes from AWS’s docs: ENIs are shared across agents with the same subnet and security-group configuration, and an ENI may persist for up to 8 hours after you delete an agent. Price: $0.0895 per vCPU-hour and $0.00945 per GB-hour (v1).
Microsoft Foundry Agent Service. The Standard Setup with private networking places agent compute in a subnet you delegate, so agents talk to Azure resources on the same virtual network. Standard setups require you to bring your own Azure Storage, Azure AI Search and Azure Cosmos DB, so threads, files and vector stores stay in your tenant. Microsoft provides Bicep and Terraform templates; if you have no network yet, the setup can provision one.
Google Agent Runtime. You create a VPC network, subnet and network attachment in your project, and the deployed agent connects through a Private Service Connect interface to reach private resources. Put the platform inside a VPC Service Controls perimeter and Google blocks all public internet access to your Agent Platform instance. Google’s Agent Gateway can also route agent traffic through private VPC attachments and screen it with Model Armor.
What “trusted” requires beyond the network
- Private model calls. Use the cloud’s private endpoint for the model (Bedrock, Azure OpenAI in Foundry, Gemini on Agent Platform) so prompts never cross the public internet.
- Agent identity and least privilege. Each agent gets its own role or managed identity, scoped to the tools it needs.
- Egress allowlist. Agents that browse or call SaaS APIs need a controlled path out — a NAT with an allowlist or an egress proxy — otherwise “in your VPC” still means “can send data anywhere”.
- Secrets outside the prompt. Inject credentials at runtime, never in context; see best secrets managers for AI agents.
- Audit logs in the SIEM your security team already reads.
Picks by situation
- AWS estate, agents need private databases: AgentCore Runtime in VPC mode with the AgentCore VPC endpoint.
- Microsoft 365 and Azure estate, data residency in your tenant: Foundry Agent Service Standard Setup with bring-your-own resources.
- Google Cloud estate with VPC Service Controls already in place: Agent Runtime with a Private Service Connect interface.
- Air-gapped or on-premises requirement: self-host an open-source framework on Kubernetes with open-weight models; see how to self-host an AI coding agent for the pattern.
Last verified: October 29, 2026.