AWS nova high security documentation change

Service: nova · 2025-05-10 · Security-related high

File: nova/latest/userguide/modalities-document-examples.md

Summary

Added S3 integration example and warning about prompt injection vulnerabilities in document name field

Security assessment

Explicitly addresses prompt injection vulnerabilities in AI model inputs by warning about the 'name' field's security risks, providing concrete mitigation guidance.

Diff

diff --git a/nova/latest/userguide/modalities-document-examples.md b/nova/latest/userguide/modalities-document-examples.md
index 1cd4db71e..6b277058b 100644
--- a//nova/latest/userguide/modalities-document-examples.md
+++ b//nova/latest/userguide/modalities-document-examples.md
@@ -52,0 +53,48 @@ The following example demonstrates how to invoke document understanding. Note th
+For passing large document files or multiple document files, where the overall payload is greater than 25 MB, you can use Amazon S3. The following example demonstrates how to use Amazon S3 to upload documents to Amazon Nova:
+    
+    
+    import boto3
+    import json
+    import base64
+    # Create a Bedrock Runtime client
+    client = boto3.client("bedrock-runtime", 
+                          region_name="us-east-1", 
+                         )
+    PRO_MODEL_ID = "us.amazon.nova-pro-v1:0"
+    LITE_MODEL_ID = "us.amazon.nova-lite-v1:0"
+    MICRO_MODEL_ID = "us.amazon.nova-micro-v1:0"
+    PREMIER_MODEL_ID = "us.amazon.nova-premier-v1:0"
+    
+    messages = [
+        {
+            "role": "user",
+            "content": [
+                {
+                 "document": {
+                    "format": "pdf",
+                     "name": "sample_doc",
+                     "source": {
+                            "s3Location": {
+                              #Replace the s3 bucket URI 
+                             "uri":  "s3://demo-bucket/document1.pdf",
+                             "bucketOwner" : "123456789012"
+                 }
+                {"text": "Describe the following document"},
+            ],
+        }
+    ]
+    inf_params = {"maxTokens": 300, "topP": 0.1, "temperature": 0.3}
+    model_response = client.converse(
+        modelId=LITE_MODEL_ID, messages=messages, inferenceConfig=inf_params
+    )
+    print("\n[Full Response]")
+    print(json.dumps(model_response, indent=2))
+    print("\n[Response Content Text]")
+    print(model_response["output"]["message"]["content"][0]["text"])
+
+###### Note
+
+Document names can include only alphanumeric characters, hyphens, parentheses, and square brackets.
+
+The `name` field is vulnerable to prompt injections, because the model might inadvertently interpret it as instructions. Therefore, we recommend that you specify a neutral name.
+