AWS Security ChangesHomeSearch

AWS bedrock documentation change

Service: bedrock · 2025-03-30 · Documentation medium

File: bedrock/latest/userguide/flows-code-ex.md

Summary

Added documentation for creating flows with encryption options and node configuration details

Security assessment

Documents security-related encryption option (customerEncryptionKeyArn) but does not address a specific security vulnerability

Diff

diff --git a/bedrock/latest/userguide/flows-code-ex.md b/bedrock/latest/userguide/flows-code-ex.md
index 2b3e6d4a0..dfe7aa9d6 100644
--- a/bedrock/latest/userguide/flows-code-ex.md
+++ b/bedrock/latest/userguide/flows-code-ex.md
@@ -17,0 +18,23 @@ The following code samples assume that you've fulfilled the following prerequisi
+To create a flow, send a [CreateFlow](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent_CreateFlow.html) request with an [Agents for Amazon Bedrock build-time endpoint](https://docs.aws.amazon.com/general/latest/gr/bedrock.html#bra-bt). For example code, see Run Amazon Bedrock Flows code samples
+
+The following fields are required:
+
+Field | Basic description  
+---|---  
+name | A name for the flow.  
+executionRoleArn | The ARN of the [service role with permissions to create and manage flows](./flows-permissions.html).  
+  
+The following fields are optional:
+
+Field | Use case  
+---|---  
+definition | Contains the `nodes` and `connections` that make up the flow.  
+description | To describe the flow.  
+tags | To associate tags with the flow. For more information, see [Tagging Amazon Bedrock resources](./tagging.html).  
+customerEncryptionKeyArn | To encrypt the resource with a KMS key. For more information, see [Encryption of Amazon Bedrock Flows resources](./encryption-flows.html).  
+clientToken | To ensure the API request completes only once. For more information, see [Ensuring idempotency](https://docs.aws.amazon.com/ec2/latest/devguide/ec2-api-idempotency.html).  
+  
+While the `definition` field is optional, it is required for the flow to be functional. You can choose to create a flow without the definition first and instead update the flow later.
+
+For each node in your `nodes` list, you specify the type of node in the `type` field and provide the corresponding configuration of the node in the `config` field. For details about the API structure of different types of nodes, see [Node types in flow](./flows-nodes.html).
+
@@ -233 +256 @@ Run the following code snippet to load the AWS SDK for Python (Boto3), create an
-                "nodeName": "FlowInputNode",
+                "nodeName": "FlowInput",