AWS bedrock documentation change

Service: bedrock · 2025-03-10 · Documentation low

File: bedrock/latest/userguide/agents-permissions.md

Summary

Added documentation for multi-agent collaboration permissions including new IAM policy allowing Bedrock to associate/invoke agent collaborators. Updated encryption reference to specify agents created before Jan 22, 2025.

Security assessment

Adds IAM policy documentation for new collaboration feature but no evidence of addressing a specific security vulnerability. Encryption reference update appears to be versioning rather than security fix.

Diff

diff --git a/bedrock/latest/userguide/agents-permissions.md
index cfe8a4ca7..d3f599877 100644
--- a/bedrock/latest/userguide/agents-permissions.md
+++ b/bedrock/latest/userguide/agents-permissions.md
@@ -5 +5 @@
-Trust relationshipIdentity-based permissions for the Agents service role(Optional) Identity-based policy to allow Amazon Bedrock to use Provisioned Throughput with your agent alias(Optional) Identity-based policy to allow Amazon Bedrock to use guardrails with your Agent(Optional) Identity-based policy to allow Amazon Bedrock to access files from S3 to use with code interpretationResource-based policy to allow Amazon Bedrock to invoke an action group Lambda function
+Trust relationshipIdentity-based permissions for the Agents service role(Optional) Identity-based policy to allow Amazon Bedrock to use Provisioned Throughput with your agent alias(Optional) Identity-based policy to allow Amazon Bedrock to associate and invoke agent collaborators(Optional) Identity-based policy to allow Amazon Bedrock to use guardrails with your Agent(Optional) Identity-based policy to allow Amazon Bedrock to access files from S3 to use with code interpretationResource-based policy to allow Amazon Bedrock to invoke an action group Lambda function
@@ -22,0 +23,2 @@ To use a custom service role for agents instead of the one Amazon Bedrock automa
+      * (Optional) If you enable multi-agent collaboration, permissions to get the aliases and invoke agent collaborators.
+
@@ -41,0 +44,2 @@ Whether you use a custom role or not, you also need to attach a **resource-based
+  * (Optional) Identity-based policy to allow Amazon Bedrock to associate and invoke agent collaborators
+
@@ -85 +89 @@ Attach the following policy to provide permissions for the service role, replaci
-If you encrypt your agent with a customer-managed KMS key, refer to [Encryption of agent resources](./encryption-agents.html) for further permissions you need to add.
+If you encrypt your agent with a customer-managed KMS key, refer to [Encryption of agent resources for agents created before January 22, 2025](./encryption-agents.html) for further permissions you need to add.
@@ -189,0 +194,22 @@ If you associate a [Provisioned Throughput](./prov-throughput.html) with an alia
+## (Optional) Identity-based policy to allow Amazon Bedrock to associate and invoke agent collaborators
+
+If you enable [multi-agent collaboration](./agents-multi-agent-collaboration.html), attach the following identity-based policy to the service role or add the statement to the policy in Identity-based permissions for the Agents service role.
+    
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Sid": "AmazonBedrockAgentMultiAgentsPolicyProd",
+                "Effect": "Allow",
+                "Action": [
+                    "bedrock:GetAgentAlias",
+                    "bedrock:InvokeAgent"
+                ],
+                "Resource": [
+                    "arn:aws:bedrock:${region}:${account-id}:agent-alias/${agent-id}/${agent-alias-id}"
+                ]
+            }
+        ]
+    }
+