AWS bedrock documentation change
Summary
Restructured query engine configuration details, added authentication methods (IAM role, Secrets Manager), and clarified supported data stores
Security assessment
The changes provide explicit documentation about authentication methods (e.g., IAM roles, Secrets Manager) and query engine security configurations. While this improves security guidance, there is no evidence of addressing a specific vulnerability. It strengthens security practices documentation.
Diff
diff --git a/bedrock/latest/userguide/knowledge-base-structured-create.md b/bedrock/latest/userguide/knowledge-base-structured-create.md index 441d8124b..223ee9d9b 100644 --- a//bedrock/latest/userguide/knowledge-base-structured-create.md +++ b//bedrock/latest/userguide/knowledge-base-structured-create.md @@ -9 +9 @@ To connect a knowledge base to a structured data store, you specify the followin - * The data store containing your data. You can connect to the following data stores: + * ###### Query engine configuration @@ -11 +11 @@ To connect a knowledge base to a structured data store, you specify the followin - * Amazon Redshift +The configuration for the compute service that will execute the generated SQL querries. The query engine is used to convert natural language user queries into SQL queries that can be used to extract data from your data store. You can choose from Amazon Redshift or Amazon Athena as your query engine. When choosing this configuration, you must specify: @@ -13 +13 @@ To connect a knowledge base to a structured data store, you specify the followin - * AWS Glue Data Catalog (AWS Lake Formation) + * The compute connnection metadata such as the cluster ID or the workgroup ARN depending on the chosen query engine. @@ -15 +15 @@ To connect a knowledge base to a structured data store, you specify the followin - * The query engine (currently, only Amazon Redshift is supported) to use to convert natural language user queries into SQL queries that can be used to extract data from your data store. + * The authentication method for using the query engine, which can be using an IAM service role with the appropriate permissions, a query engine database user, or an AWS Secrets Manager secret that is linked to your database credentials. @@ -17 +17 @@ To connect a knowledge base to a structured data store, you specify the followin - * The authentication method for using the query engine. The following options are available: +###### Note @@ -19 +19 @@ To connect a knowledge base to a structured data store, you specify the followin - * **IAM role** – Authenticate using the IAM service role with permissions to manage your knowledge base. +If you choose Athena as your query engine, only IAM service role based authentication is supported. @@ -21 +21 @@ To connect a knowledge base to a structured data store, you specify the followin - * **Temporary credentials user name** – Authenticate using the query engine database user. + * ###### Storage configuration @@ -23 +23 @@ To connect a knowledge base to a structured data store, you specify the followin - * **Secrets Manager** – Authenticate with an AWS Secrets Manager secret that is linked to your database credentials. +The configuration for the data store containing your data. You can connect to Amazon Redshift Provisioned or Amazon Redshift Serverless and use Amazon Redshift or AWS Glue Data Catalog as your data store. @@ -25 +25 @@ To connect a knowledge base to a structured data store, you specify the followin -The authentication methods available differ by the query engine and data store that you use. To see support for different authentication types, see [Set up query engine for your structured data store in Amazon Bedrock Knowledge Bases](./knowledge-base-prereq-structured-query-engine.html) and [Allow your Amazon Bedrock Knowledge Bases service role to access your data store](./knowledge-base-prereq-structured-db-access.html). + * ###### (Optional) Query configurations @@ -27 +27 @@ The authentication methods available differ by the query engine and data store t - * (Optional) Query configurations for improving the accuracy of SQL generation: +You can use optional query configurations for improving the accuracy of SQL generation: @@ -62 +62 @@ To connect to a structured data store using the AWS Management Console, do the f - 3. Choose an IAM service role with the proper permissions to create and manage this knowledge base. You can let Amazon Bedrock create the service role or choose a custom role that you have created. For more information about creating a custom role, see [Prerequisites for creating an Amazon Bedrock knowledge base with a structured data store](./knowledge-base-prereq-structured.html). + 3. Choose an IAM service role with the proper permissions to create and manage this knowledge base. You can let Amazon Bedrock create the service role or choose a custom role that you have created. For more information about creating a custom role, see [Set up your query engine and permissions for creating a knowledge base with structured data store](./knowledge-base-prereq-structured.html). @@ -391 +391 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Allow your service role to access your data store +Set up query engine and configure permissions