AWS bedrock-agentcore documentation change

Service: bedrock-agentcore · 2025-07-19 · Documentation low

File: bedrock-agentcore/latest/devguide/runtime-permissions.md

Summary

Updated IAM role documentation with placeholder replacement instructions and corrected ARN patterns

Security assessment

The changes clarify IAM role configuration requirements and correct ARN patterns for runtime permissions. While related to security practices, there is no evidence of addressing a specific vulnerability. The updates improve documentation accuracy for security configurations but do not indicate a security fix.

Diff

diff --git a/bedrock-agentcore/latest/devguide/runtime-permissions.md b/bedrock-agentcore/latest/devguide/runtime-permissions.md
index 308ea6ba8..5bcbc04e9 100644
--- a//bedrock-agentcore/latest/devguide/runtime-permissions.md
+++ b//bedrock-agentcore/latest/devguide/runtime-permissions.md
@@ -15 +15,10 @@ To run agent or tool in AgentCore Runtime you need an AWS Identity and Access Ma
-The AgentCore Runtime execution role is an IAM role that AgentCore Runtime assumes to run an agent. 
+The AgentCore Runtime execution role is an IAM role that AgentCore Runtime assumes to run an agent. Replace the following:
+
+  * `region` with the AWS Region that you are using
+
+  * `accountId` with your AWS account ID
+
+  * `agentName` with the name of your agent. You'll need to decide the agent name before creating the role and AgentCore Runtime. 
+
+
+
@@ -29 +38 @@ The AgentCore Runtime execution role is an IAM role that AgentCore Runtime assum
-                    "arn:aws:ecr:{{region}}:{{accountId}}:repository/{{repository-name}}"
+                    "arn:aws:ecr:region:accountId:repository/*"
@@ -39 +48 @@ The AgentCore Runtime execution role is an IAM role that AgentCore Runtime assum
-                    "arn:aws:logs:{{region}}:{{accountId}}:log-group:/aws/bedrock-agentcore/runtimes/*"
+                    "arn:aws:logs:region:accountId:log-group:/aws/bedrock-agentcore/runtimes/*"
@@ -48 +57 @@ The AgentCore Runtime execution role is an IAM role that AgentCore Runtime assum
-                    "arn:aws:logs:{{region}}:{{accountId}}:log-group:*"
+                    "arn:aws:logs:region:accountId:log-group:*"
@@ -58 +67 @@ The AgentCore Runtime execution role is an IAM role that AgentCore Runtime assum
-                    "arn:aws:logs:{{region}}:{{accountId}}:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*"
+                    "arn:aws:logs:region:accountId:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*"
@@ -98,2 +107,2 @@ The AgentCore Runtime execution role is an IAM role that AgentCore Runtime assum
-                  "arn:aws:bedrock-agentcore:{{region}}:{{accountId}}:workload-identity-directory/default",
-                  "arn:aws:bedrock-agentcore:{{region}}:{{accountId}}:workload-identity-directory/default/workload-identity/{{agentName}}-*"
+                  "arn:aws:bedrock-agentcore:region:accountId:workload-identity-directory/default",
+                  "arn:aws:bedrock-agentcore:region:accountId:workload-identity-directory/default/workload-identity/agentName-*"
@@ -110 +119 @@ The AgentCore Runtime execution role is an IAM role that AgentCore Runtime assum
-                "arn:aws:bedrock:{{region}}:{{accountId}}:*"
+                "arn:aws:bedrock:region:accountId:*"
@@ -133 +142 @@ The trust relationship for the AgentCore Runtime execution role should allow Age
-                    "aws:SourceAccount": "{{accountId}}"
+                    "aws:SourceAccount": "accountId"
@@ -136 +145 @@ The trust relationship for the AgentCore Runtime execution role should allow Age
-                    "aws:SourceArn": "arn:aws:bedrock-agentcore:{{region}}:{{accountId}}:*"
+                    "aws:SourceArn": "arn:aws:bedrock-agentcore:region:accountId:*"