AWS bedrock low security documentation change
Summary
Added documentation for new 'Inline code node' feature including configuration, considerations, inputs/outputs, and integration details. Updated multiple sections with minor wording improvements and structural changes.
Security assessment
The inline code node documentation explicitly states code executes in an isolated AWS-managed environment without internet access. This indicates security controls around code execution isolation. However, there's no mention of addressing a specific vulnerability - rather documenting security controls for a new feature.
Diff
diff --git a/bedrock/latest/userguide/flows-nodes.md b/bedrock/latest/userguide/flows-nodes.md index 8067e56a7..736aa36da 100644 --- a//bedrock/latest/userguide/flows-nodes.md +++ b//bedrock/latest/userguide/flows-nodes.md @@ -7 +7 @@ Nodes for controlling flow logicNodes for handling data in the flowSummary table -# Node types in flow +# Node types for your flow @@ -9 +9 @@ Nodes for controlling flow logicNodes for handling data in the flowSummary table -Amazon Bedrock Flows provides the following node types to build your flow. When you configure a node, you need to provide the following fields: +Amazon Bedrock Flows provides the following node types to build your flow. When you configure a node, you provide the following fields: @@ -442 +442 @@ The following shows the general structure of a knowledge base [FlowNode](https:/ -An S3 storage node lets you store data in the flow to an Amazon S3 location. In the configuration, you specify the S3 bucket to use for data storage. The inputs into the node are the content to store and the [object key](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html). The node returns the URI of the S3 location as its output. +An S3 storage node lets you store data in the flow to an Amazon S3 bucket. In the configuration, you specify the S3 bucket to use for data storage. The inputs into the node are the content to store and the [object key](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html). The node returns the URI of the S3 location as its output. @@ -519 +519 @@ In the configuration, specify the Amazon Resource Name (ARN) of the Lambda funct -The following shows the general structure of a Λ function [FlowNode](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent_FlowNode.html) object: +The following shows the general structure of a Lambda function [FlowNode](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent_FlowNode.html) object: @@ -527 +527 @@ The following shows the general structure of a Λ function [FlowNode](https://do - "name": "string", + "name": "codeHookInput", @@ -578,0 +579,79 @@ When you write a Lambda function, you define the response returned by it. This r +An inline code node lets you write and execute code directly in your flow, enabling data transformations, custom logic, and integrations without using an external Lambda function. When you include an inline code node in your flow, Amazon Bedrock executes your code in an isolated, AWS managed environment that isn't shared with anyone and doesn't have internet access. + +###### Note + +Inline code node is in preview release for Amazon Bedrock and is subject to change. + +In the node configuration, specify the code to execute along with the programming language (`Python_3` is currently the only option). Define inputs that your code can access as variables. The result of the last executed line in your code is returned as the node output. + +The following example shows the general structure of an inline code [FlowNode](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent_FlowNode.html) object: + + + { + "name": "string", + "type": "InlineCode", + "inputs": [{ + "name": "string", + "type": "String | Number | Boolean | Object | Array", + "expression": "string" + }, + ... + ], + "outputs": [{ + "name": "response", + "type": "String | Number | Boolean | Object | Array" + }], + "configuration": { + "inlineCode": { + "code": "string", + "language": "Python_3" + } + } + } + +#### Considerations when using inline code nodes + +When using inline code nodes in your flow, consider the following: + +###### Important + +We recommend that you test your code before adding it to an inline code node. + + * Currently, the only programming language supported by inline code nodes is Python 3.12 (`Python_3)`. + + * Inline code acts like an interactive Python session. Only the result of the last executed line is captured and returned as the node output. + + * Python console output (such output as from the `print` function) isn't captured. + + * Inputs for your inline code node are available as Python variables in your code. Use the exact name of the node input to reference them. + + * Configure the input and output types correctly to avoid runtime errors. You can configure up to five node inputs. + + * You can have up to five inline code nodes per flow. + + * You can have a maximum of 25 running inline code nodes per AWS account. + + * Your code can't exceed 5 MB. + + + + +#### Inline code node inputs + +The inputs you define for an inline code node are available as Python variables in your code. For example, if you define an input named `userData`, you can access it directly in your code as `userData`. + +The value of each input is populated based on the expression that you define. For example, if the input to the node is `{"name": "John", "age": 30}` and the expression is `$.name`, the value of the input variable would be `"John"`. + +#### Inline code node output + +The result of the last executed line in your code is returned as the output of the inline code node. This output is available to subsequent nodes in your flow. + +For example, the following code returns a dictionary as the node output: + + + # Process input data + result = {"processed": True, "data": userData} + + # The last line's result is returned as the node output + result + @@ -636 +715 @@ The following tables summarize the inputs and outputs that are allowed for each - * Currently, only the **Condition** , **Prompt** , and **Lambda function** nodes allow multiple inputs that you can define yourself. + * You can define multiple inputs for the **Condition** , **Prompt** , **Lambda function** , and **Inline code** nodes. @@ -655 +734 @@ Node type | Input | Name | Type | Output | Name | Type -**Prompt** | A value to fill in a variable in the prompt. (multiple inputs allowed) | ``${variable-name}`` | Any | The response returned by the model. | `modelCompletion` | String +**Prompt** | A value to fill in a variable in the prompt (multiple inputs allowed). | ``${variable-name}`` | Any | The response returned by the model. | `modelCompletion` | String @@ -658 +737 @@ The [object key](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-ke -**S3 retrieval** | The [object key](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html) for the S3 object | `objectKey` | String | The data to retrieve from an S3 bucket. | `s3Content` | Any +**S3 retrieval** | The [object key](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html) for the S3 object. | `objectKey` | String | The data to retrieve from an S3 bucket. | `s3Content` | Any @@ -663 +742,2 @@ Any [session attributes](./agents-session-state.html) to send alongside the prom -**Lambda function** | Data to send to the function. (multiple inputs allowed) | Any | The response returned from the function. | `functionResponse` | Any +**Lambda function** | Data to send to the function (multiple inputs allowed). | Any | Any | The response returned from the function. | `functionResponse` | Any +**Inline code node** | Variables for your code to execute (multiple inputs allowed). | Any | Any | The last line executed in your code. | `response` | Any