AWS bedrock documentation change
Summary
Simplified policy statement IDs and updated KMS ARNs with concrete values for agent encryption
Security assessment
Documents encryption mechanisms for Agents but only updates examples rather than addressing vulnerabilities
Diff
diff --git a/bedrock/latest/userguide/encryption-agents.md b/bedrock/latest/userguide/encryption-agents.md index ba870553f..130e9abd6 100644 --- a//bedrock/latest/userguide/encryption-agents.md +++ b//bedrock/latest/userguide/encryption-agents.md @@ -29 +29 @@ JSON - "Sid": "Allow Amazon Bedrock to encrypt and decrypt Agent resources on behalf of authorized users", + "Sid": "EncryptDecryptAgents", @@ -35 +35 @@ JSON - "Resource": "arn:aws:kms:us-east-1:${account-id}:key/${key-id}", + "Resource": "arn:aws:kms:us-east-1:123456789012:key/key-id", @@ -38 +38 @@ JSON - "kms:EncryptionContext:aws:bedrock:arn": "arn:aws:bedrock:${region}:${account-id}:agent/${agent-id}" + "kms:EncryptionContext:aws:bedrock:arn": "arn:aws:bedrock:us-east-1:123456789012:agent/agent-id" @@ -61 +61 @@ JSON - "AWS": "arn:aws:iam::${account-id}:root" + "AWS": "arn:aws:iam::123456789012:root" @@ -64 +64 @@ JSON - "Resource": "arn:aws:kms:${region}:${account-id}:key/${key-id}" + "Resource": "arn:aws:kms:us-east-1:123456789012:key/${key-id}" @@ -76 +76 @@ JSON - "Resource": "arn:aws:kms:${region}:${account-id}:key/${key-id}", + "Resource": "arn:aws:kms:us-east-1:123456789012:key/${key-id}", @@ -79 +79 @@ JSON - "kms:EncryptionContext:aws:bedrock:arn": "arn:aws:bedrock:${region}:${account-id}:agent/${agent-id}" + "kms:EncryptionContext:aws:bedrock:arn": "arn:aws:bedrock:us-east-1:123456789012:agent/${agent-id}" @@ -87 +87 @@ JSON - "AWS": "arn:aws:iam::${account-id}:role/${role}" + "AWS": "arn:aws:iam::123456789012:role/Role" @@ -93 +93 @@ JSON - "Resource": "arn:aws:kms:${region}:${account-id}:key/${key-id}" + "Resource": "arn:aws:kms:us-east-1:123456789012:key/${key-id}"