AWS bedrock medium security documentation change
Summary
Removed references to prompt caching preview and cachePoint fields in examples, added S3 URI integration details for media/content blocks, updated format specifications, and clarified security requirements for S3 access.
Security assessment
The changes introduce security documentation by specifying required S3 permissions (s3:GetObject) and cross-account bucket ownership requirements when using S3 URIs. This addresses potential misconfiguration risks that could lead to unauthorized data access. The removal of cachePoint fields does not indicate a security issue but rather a feature adjustment.
Diff
diff --git a/bedrock/latest/userguide/conversation-inference-call.md b/bedrock/latest/userguide/conversation-inference-call.md index b71f74275..337784bd5 100644 --- a//bedrock/latest/userguide/conversation-inference-call.md +++ b//bedrock/latest/userguide/conversation-inference-call.md @@ -81 +81 @@ You can maintain conversation context by including all the messages in the conve -The `content` field maps to an array of [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html) objects. Within each [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html), you can specify one of the following fields (to see what models support what modalities, see [Supported models and model features](./conversation-inference-supported-models-features.html)): +The `content` field maps to an array of [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html) objects. Within each [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html), you can specify one of the following fields (to see what models support what blocks, see [Supported models and model features](./conversation-inference-supported-models-features.html)): @@ -88,6 +87,0 @@ The `text` field maps to a string specifying the prompt. The `text` field is int -(Optional) For certain models, you can add cache checkpoints using `cachePoint` fields to utilize prompt caching. Prompt caching is a feature that enables you to begin caching the context of conversations to achieve cost and latency savings. For more information, see [Prompt caching for faster model inference](./prompt-caching.html). - -###### Note - -Amazon Bedrock prompt caching is currently only available to a select number of customers. To learn more about participating in the preview, see [Amazon Bedrock prompt caching](https://aws.amazon.com/bedrock/prompt-caching/). - @@ -98,13 +92 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe - "role": "user | assistant", - "content": [ - { - "text": "string" - } - ] - } - -The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Message.html) object with a `content` array containing a text [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html) and an optional `cachePoint` field. The content in the text [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html) is added to the cache as a result. - - - { - "role": "user | assistant", + "role": "user", @@ -114,5 +95,0 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe - }, - { - "cachePoint": { - "type": "default" - } @@ -130,7 +107 @@ If you exclude the `text` field, the model describes the image. -(Optional) For certain models, you can add cache checkpoints using `cachePoint` fields to utilize prompt caching. Prompt caching is a feature that enables you to begin caching the context of conversations to achieve cost and latency savings. For more information, see [Prompt caching for faster model inference](./prompt-caching.html). - -###### Note - -Amazon Bedrock prompt caching is currently only available to a select number of customers. To learn more about participating in the preview, see [Amazon Bedrock prompt caching](https://aws.amazon.com/bedrock/prompt-caching/). - -The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Message.html) object with a `content` array containing only an image [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html): +The following shows an example [Message](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Message.html) object with a `content` array containing only an image [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html): @@ -144 +115 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe - "format": "png | jpeg | gif | webp", + "format": "png", @@ -153 +124 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe -The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Message.html) object with a `content` array containing an image [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html) and an optional `cachePoint` field. The image content is added to the cache as a result. +You can also specify an Amazon S3 URI instead of passing the bytes directly in the request body. The following shows a sample `Message` object with a content array containing the source passed through an Amazon S3 URI. @@ -161 +132 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe - "format": "png | jpeg | gif | webp", + "format": "png", @@ -163 +134,3 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe - "bytes": "image in bytes" + "s3Location": { + "uri": "s3://amzn-s3-demo-bucket/myImage", + "bucketOwner": "111122223333" @@ -166,4 +138,0 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe - }, - { - "cachePoint": { - "type": "default" @@ -203,7 +172 @@ The `name` field is vulnerable to prompt injections, because the model might ina -(Optional) For certain models, you can add cache checkpoints using `cachePoint` fields to utilize prompt caching. Prompt caching is a feature that enables you to begin caching the context of conversations to achieve cost and latency savings. For more information, see [Prompt caching for faster model inference](./prompt-caching.html). - -###### Note - -Amazon Bedrock prompt caching is currently only available to a select number of customers. To learn more about participating in the preview, see [Amazon Bedrock prompt caching](https://aws.amazon.com/bedrock/prompt-caching/). - -The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Message.html) object with a `content` array containing only a document [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html) and a required accompanying text [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html). +The following shows a sample [Message](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Message.html) object with a `content` array containing only a document [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html) and a required accompanying text [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html). @@ -220,2 +183,2 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe - "format": "pdf | csv | doc | docx | xls | xlsx | html | txt | md", - "name": "string", + "format": "pdf", + "name": "MyDocument", @@ -230 +193 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe -The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Message.html) object with a `content` array containing a document [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html) and a required accompanying text [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html), as well as a **cachePoint** that adds both the document and text contents to the cache. +You can also specify an Amazon S3 URI instead of passing the bytes directly in the request body. The following shows a sample `Message` object with a content array containing the source passed through an Amazon S3 URI. @@ -241,2 +204,2 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe - "format": "pdf | csv | doc | docx | xls | xlsx | html | txt | md", - "name": "string", + "format": "pdf", + "name": "MyDocument", @@ -244 +207,3 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe - "bytes": "document in bytes" + "s3Location": { + "uri": "s3://amzn-s3-demo-bucket/myDocument", + "bucketOwner": "111122223333" @@ -247,4 +211,0 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe - }, - { - "cachePoint": { - "type": "default" @@ -263 +224 @@ If you don't include the `text` field, the model will describe the video. -The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Message.html) object with a `content` array containing only a video [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html). +The following shows a sample [Message](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Message.html) object with a `content` array containing only a video [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html). @@ -271 +232 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe - "format": "mov | mkv | mp4 | webm | flv | mpeg | mpg | wmv | three_gp", + "format": "mp4", @@ -280 +241 @@ The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIRe -You can also pass a video through an Amazon S3 URI instead of passing the bytes directly in the request body. +You can also specify an Amazon S3 URI instead of passing the bytes directly in the request body. The following shows a sample `Message` object with a content array containing the source passed through an Amazon S3 URI. @@ -282 +242,0 @@ You can also pass a video through an Amazon S3 URI instead of passing the bytes -###### Note @@ -284 +244,16 @@ You can also pass a video through an Amazon S3 URI instead of passing the bytes -The following restrictions apply to specifying a video with an S3 URI: + { + "role": "user", + "content": [ + { + "video": { + "format": "mp4", + "source": { + "s3Location": { + "uri": "s3://amzn-s3-demo-bucket/myVideo", + "bucketOwner": "111122223333" + } + } + } + } + ] + } @@ -286 +261 @@ The following restrictions apply to specifying a video with an S3 URI: - * You must make the request in US East (N. Virginia). +###### Note @@ -288 +263 @@ The following restrictions apply to specifying a video with an S3 URI: - * You can't use an [inference profile](./inference-profiles.html). +The assumed role must have the `s3:GetObject` permission to the Amazon S3 URI. The `bucketOwner` field is optional but must be specified if the account making the request does not own the bucket the Amazon S3 URI is found in. For more information, see [Configure access to Amazon S3 buckets](./s3-bucket-access.html). @@ -289,0 +265 @@ The following restrictions apply to specifying a video with an S3 URI: +cachePoint @@ -291,0 +268 @@ The following restrictions apply to specifying a video with an S3 URI: +You can add cache checkpoints as a block in a message alongside an accompanying prompt by using `cachePoint` fields to utilize prompt caching. Prompt caching is a feature that lets you begin caching the context of conversations to achieve cost and latency savings. For more information, see [Prompt caching for faster model inference](./prompt-caching.html). @@ -293 +270 @@ The following restrictions apply to specifying a video with an S3 URI: -The following shows a `Message` object with a content array containing only a video `ContentBlock` with the video source passed through an Amazon S3 URI. +The following shows a sample [Message](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Message.html) object with a `content` array containing a document [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html) and a required accompanying text [ContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ContentBlock.html), as well as a **cachePoint** that adds both the document and text contents to the cache. @@ -300,2 +277,6 @@ The following shows a `Message` object with a content array containing only a vi - "video": { - "format": "mov | mkv | mp4 | webm | flv | mpeg | mpg | wmv | three_gp", + "text": "string" + }, + { + "document": { + "format": "pdf", + "name": "string", @@ -303,3 +284 @@ The following shows a `Message` object with a content array containing only a vi - "s3Location": { - "uri": "${S3Uri}", - "bucketOwner": "${AccountId}" + "bytes": "document in bytes" @@ -307,0 +287,4 @@ The following shows a `Message` object with a content array containing only a vi + }, + { + "cachePoint": { + "type": "default" @@ -313,4 +295,0 @@ The following shows a `Message` object with a content array containing only a vi -###### Note - -The assumed role must have the `s3:GetObject` permission to the Amazon S3 URI. The `bucketOwner` field is optional but must be specified if the account making the request does not own the bucket the Amazon S3 URI is found in. For more information, see [Configure access to Amazon S3 buckets](./s3-bucket-access.html). - @@ -322 +301 @@ The `guardContent` field maps to a [GuardrailConverseContentBlock](https://docs. - * **text** – The following shows a [Message](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Message.html) object with a `content` array containing only a text [GuardrailConverseContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_GuardrailConverseContentBlock.html): + * **text** – The following shows an example [Message](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Message.html) object with a `content` array containing only a text [GuardrailConverseContentBlock](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_GuardrailConverseContentBlock.html): @@ -328 +307 @@ The `guardContent` field maps to a [GuardrailConverseContentBlock](https://docs. - "text": "string", + "text": "Tell me what stocks to buy.", @@ -330,2 +309 @@ The `guardContent` field maps to a [GuardrailConverseContentBlock](https://docs. - "grounding_source | query | guard_content", - ... + "guard_content" @@ -345 +323 @@ You define the text to be evaluated and include any qualifiers to use for [conte - "format": "png | jpeg", + "format": "png", @@ -499,4 +476,0 @@ You can also optionally add cache checkpoints to the `system` or `tools` fields -###### Note - -Amazon Bedrock prompt caching is currently only available to a select number of customers. To learn more about participating in the preview, see [Amazon Bedrock prompt caching](https://aws.amazon.com/bedrock/prompt-caching/). -