AWS bedrock medium security documentation change
Summary
Updated permissions documentation for knowledge bases: Removed GenerateQuery permissions, simplified explanations, and restructured content
Security assessment
Removal of 'GenerateQuery' and 'sqlworkbench:GetSqlRecommendations' permissions from required policies indicates a security improvement to reduce excessive privileges. The change explicitly removes API operations that might have posed a risk if over-permissioned, enforcing least privilege principles.
Diff
diff --git a/bedrock/latest/userguide/knowledge-base-prereq-permissions-general.md b/bedrock/latest/userguide/knowledge-base-prereq-permissions-general.md index 8f5a6b85e..c444777f6 100644 --- a//bedrock/latest/userguide/knowledge-base-prereq-permissions-general.md +++ b//bedrock/latest/userguide/knowledge-base-prereq-permissions-general.md @@ -7 +7 @@ -For a user or role to perform actions related to Amazon Bedrock Knowledge Bases, you must attach policies to it that grant permissions to perform the actions. This topic describes permissions that allow a user to create and manage a knowledge base connected to a structured data store. It also describes permissions that allow a user to retrieve information from these knowledge bases and generate responses from them. +For a user or role to perform actions related to Amazon Bedrock Knowledge Bases, you must attach policies to it that grant permissions to perform the actions. It describes permissions that allow a user to retrieve information from these knowledge bases and generate responses from them. @@ -55 +55,3 @@ After you create a knowledge base, we recommend that you scope the permissions i -To allow an IAM role to query a knowledge base connected to a structured data store, attach the following policy to the role: +This section describes the permissions that you need to perform the `Retrieve` and `RetrieveAndGenerate` API operations for knowledge bases. + +Attach the following policy to the role: @@ -71,9 +72,0 @@ To allow an IAM role to query a knowledge base connected to a structured data st - { - "Sid": "GenerateQueryAccess", - "Effect": "Allow", - "Action": [ - "bedrock:GenerateQuery", - "sqlworkbench:GetSqlRecommendations" - ], - "Resource": "*" - }, @@ -105 +98 @@ You can remove statements that you don't need, depending on your use case: - * The `GetKB` and `GenerateQuery` statements are required to call [GenerateQuery](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_GenerateQuery.html) to generate SQL queries that take into account user queries and your connected data source. + * The `GetKB` statement is used to get the knowledge base information. @@ -107 +100 @@ You can remove statements that you don't need, depending on your use case: - * The `Retrieve` statement is required to call [Retrieve](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_Retrieve.html) to retrieve data from your structured data store. + * The `Retrieve` statement is required to call [Retrieve](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_Retrieve.html) to retrieve data from your data store. @@ -109 +102 @@ You can remove statements that you don't need, depending on your use case: - * The `RetrieveAndGenerate` statement is required to call [RetrieveAndGenerate](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_RetrieveAndGenerate.html) to retrieve data from your structured data store and generate responses based off the data. + * The `RetrieveAndGenerate` statement is required to call [RetrieveAndGenerate](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_RetrieveAndGenerate.html) to retrieve data from your data store and generate responses based off the data. @@ -133 +126 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Prerequisites +Chat with your document with zero setup @@ -135 +128 @@ Prerequisites -Set up a query engine +Build a knowledge base by connecting to a data source