AWS bedrock documentation change
Summary
Removed documentation for AmazonBedrockStudioPermissionsBoundary policy including its policy definition, usage notes, and version history. Updated policy references and examples to focus on Bedrock Agents instead of Bedrock Studio.
Security assessment
The changes remove documentation for a permissions boundary policy, which is a security-related feature. However, there's no evidence this was done to address a specific security vulnerability. The removal appears to be part of deprecating Bedrock Studio-related policies rather than fixing a disclosed security issue.
Diff
diff --git a/bedrock/latest/userguide/security-iam-awsmanpol.md b/bedrock/latest/userguide/security-iam-awsmanpol.md index 300f0fd21..28ca95800 100644 --- a/bedrock/latest/userguide/security-iam-awsmanpol.md +++ b/bedrock/latest/userguide/security-iam-awsmanpol.md @@ -5 +5 @@ -AmazonBedrockFullAccessAmazonBedrockReadOnlyAmazonBedrockStudioPermissionsBoundaryPolicy updates +AmazonBedrockFullAccessAmazonBedrockReadOnlyPolicy updates @@ -21,2 +20,0 @@ Additionally, AWS supports managed policies for job functions that span multiple - * AWS managed policy: AmazonBedrockStudioPermissionsBoundary - @@ -315,211 +312,0 @@ This policy grants read-only permissions that allow users to view all resources -## AWS managed policy: AmazonBedrockStudioPermissionsBoundary - -###### Note - - * This policy is a _permissions boundary_. A permissions boundary sets the maximum permissions that an identity-based policy can grant to an IAM principal. You should not use and attach Amazon Bedrock Studio permissions boundary policies on your own. Amazon Bedrock Studio permissions boundary policies should only be attached to Amazon Bedrock Studio managed roles. For more information on permissions boundaries, see [Permissions boundaries for IAM entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) in the IAM User Guide. - - * The current version of Amazon Bedrock Studio continues to expect a similar policy named `AmazonDataZoneBedrockPermissionsBoundary` to exist in your AWS account. For more information, see [Step 2: Create permissions boundary, service role, and provisioning role](./administer-create-workspace.html#administer-creating-roles). - - - - -When you create Amazon Bedrock Studio projects, apps, and components, Amazon Bedrock Studio applies this permissions boundary to the IAM roles produced when creating those resources. - -Amazon Bedrock Studio uses the `AmazonBedrockStudioPermissionsBoundary` managed policy to limit permissions of the provisioned IAM principal it is attached to. Principals might take the form of the user roles that Amazon DataZone can assume on behalf of Amazon Bedrock Studio users, and then conduct actions such as reading and writing Amazon S3 objects or invoking Amazon Bedrock agents. - -The `AmazonBedrockStudioPermissionsBoundary` policy grants read and write access for Amazon Bedrock Studio to services such as Amazon S3, Amazon Bedrock, Amazon OpenSearch Serverless, and AWS Lambda. The policy also gives read and write permissions to some infrastructure resources that are required to use these services such as AWS Secrets Manager secrets, Amazon CloudWatch log groups, and AWS KMS keys. - -This policy consists of the following sets of permissions. - - * `s3` – Allows read and write access to objects in Amazon S3 buckets that are managed by Amazon Bedrock Studio. - - * `bedrock` – Grants the ability to use Amazon Bedrock agents, knowledge bases, and guardrails that are managed by Amazon Bedrock Studio. - - * `aoss` – Allows API access to Amazon OpenSearch Serverless collections that are managed by Amazon Bedrock Studio. - - * `lambda` – Grants the ability to invoke AWS Lambda functions that are managed by Amazon Bedrock Studio. - - * `secretsmanager` – Allows read and write access to AWS Secrets Manager secrets that are managed by Amazon Bedrock Studio. - - * `logs` – Provides write access to Amazon CloudWatch Logs that are managed by Amazon Bedrock Studio. - - * `kms` – Grants access to use AWS keys for encrypting Amazon Bedrock Studio data. - - - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AccessS3Buckets", - "Effect": "Allow", - "Action": [ - "s3:ListBucket", - "s3:ListBucketVersions", - "s3:GetObject", - "s3:PutObject", - "s3:DeleteObject", - "s3:GetObjectVersion", - "s3:DeleteObjectVersion" - ], - "Resource": "arn:aws:s3:::br-studio-${aws:PrincipalAccount}-*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "AccessOpenSearchCollections", - "Effect": "Allow", - "Action": "aoss:APIAccessAll", - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "InvokeBedrockModels", - "Effect": "Allow", - "Action": [ - "bedrock:InvokeModel", - "bedrock:InvokeModelWithResponseStream" - ], - "Resource": "arn:aws:bedrock:*::foundation-model/*" - }, - { - "Sid": "AccessBedrockResources", - "Effect": "Allow", - "Action": [ - "bedrock:InvokeAgent", - "bedrock:Retrieve", - "bedrock:StartIngestionJob", - "bedrock:GetIngestionJob", - "bedrock:ListIngestionJobs", - "bedrock:ApplyGuardrail", - "bedrock:ListPrompts", - "bedrock:GetPrompt", - "bedrock:CreatePrompt", - "bedrock:DeletePrompt", - "bedrock:CreatePromptVersion", - "bedrock:InvokeFlow", - "bedrock:ListTagsForResource", - "bedrock:TagResource", - "bedrock:UntagResource" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}", - "aws:ResourceTag/AmazonBedrockManaged": "true" - }, - "Null": { - "aws:ResourceTag/AmazonDataZoneProject": "false" - } - } - }, - { - "Sid": "RetrieveAndGenerate", - "Effect": "Allow", - "Action": "bedrock:RetrieveAndGenerate", - "Resource": "*" - }, - { - "Sid": "WriteLogs", - "Effect": "Allow", - "Action": [ - "logs:CreateLogGroup", - "logs:CreateLogStream", - "logs:PutLogEvents" - ], - "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/br-studio-*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}", - "aws:ResourceTag/AmazonBedrockManaged": "true" - }, - "Null": { - "aws:ResourceTag/AmazonDataZoneProject": "false" - } - } - }, - { - "Sid": "InvokeLambdaFunctions", - "Effect": "Allow", - "Action": "lambda:InvokeFunction", - "Resource": "arn:aws:lambda:*:*:function:br-studio-*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}", - "aws:ResourceTag/AmazonBedrockManaged": "true" - }, - "Null": { - "aws:ResourceTag/AmazonDataZoneProject": "false" - } - } - }, - { - "Sid": "AccessSecretsManagerSecrets", - "Effect": "Allow", - "Action": [ - "secretsmanager:DescribeSecret", - "secretsmanager:GetSecretValue", - "secretsmanager:PutSecretValue" - ], - "Resource": "arn:aws:secretsmanager:*:*:secret:br-studio/*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}", - "aws:ResourceTag/AmazonBedrockManaged": "true" - }, - "Null": { - "aws:ResourceTag/AmazonDataZoneProject": "false" - } - } - }, - { - "Sid": "UseKmsKeyWithBedrock", - "Effect": "Allow", - "Action": [ - "kms:Decrypt", - "kms:GenerateDataKey" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}", - "aws:ResourceTag/EnableBedrock": "true" - }, - "Null": { - "kms:EncryptionContext:aws:bedrock:arn": "false" - } - } - }, - { - "Sid": "UseKmsKeyWithAwsServices",