AWS solutions medium security documentation change
Summary
Added a note instructing users to disable token-based access control in Kendra and use role-based access control (RBAC) instead. Clarified RBAC support limitations for Amazon Bedrock.
Security assessment
The change explicitly enforces RBAC over token-based access control for Kendra, which is a security best practice. This mitigates risks of improper access by leveraging role-based permissions instead of token-based mechanisms. The note directly impacts access control policies, a critical security concern.
Diff
diff --git a/solutions/latest/generative-ai-application-builder-on-aws/advanced-knowledge-base-settings.md b/solutions/latest/generative-ai-application-builder-on-aws/advanced-knowledge-base-settings.md index 15eaab610..a37b5558c 100644 --- a//solutions/latest/generative-ai-application-builder-on-aws/advanced-knowledge-base-settings.md +++ b//solutions/latest/generative-ai-application-builder-on-aws/advanced-knowledge-base-settings.md @@ -51,0 +52,4 @@ _Example 2: Bedrock RetrievalFilter_ +###### Note + +Under **User Access Control** in the Kendra Index you created, leave **Token-based user access control** as **No**. When you enable **Role Based Access Control** in Step 2, Generative AI Application Builder on AWS extracts the appropriate claims from the user authentication token and creates an Attribute Filter. + @@ -82 +86,3 @@ By following these steps, you will have configured role-based access control (RB -Note: As of now, only Amazon Kendra supports RBAC for knowledge bases in the Generative AI Application Builder on AWS. For Amazon Bedrock Knowledge Base, RBAC is not supported, but you can use metadata filters to achieve some level of filtering. For more information, refer to the [Amazon Bedrock User Guide.](https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html) +###### Note + +As of now, only Amazon Kendra supports RBAC for knowledge bases in the Generative AI Application Builder on AWS. For Amazon Bedrock Knowledge Base, RBAC is not supported, but you can use metadata filters to achieve some level of filtering. For more information, refer to the [Amazon Bedrock User Guide.](https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html)