AWS bedrock medium security documentation change

Service: bedrock · 2025-03-30 · Security-related medium

File: bedrock/latest/userguide/security_iam_id-based-policy-examples.md

Summary

Modified IAM policy condition from ForAnyValue:StringEquals to ForAllValues:StringEquals and added Null check for aws-marketplace:ProductId

Security assessment

Change tightens IAM policy conditions by adding explicit null check and switching quantifier from 'Any' to 'All', which could prevent unintended resource access

Diff

diff --git a/bedrock/latest/userguide/security_iam_id-based-policy-examples.md b/bedrock/latest/userguide/security_iam_id-based-policy-examples.md
index 807240c93..4c4f61d27 100644
--- a/bedrock/latest/userguide/security_iam_id-based-policy-examples.md
+++ b/bedrock/latest/userguide/security_iam_id-based-policy-examples.md
@@ -122 +122,4 @@ The following example shows an identity-based policy to allow a role to subscrib
-                    "ForAnyValue:StringEquals": {
+                        "Null": {
+                           "aws-marketplace:ProductId": "false"
+                    },
+                    "ForAllValues:StringEquals": {