AWS bedrock medium security documentation change

Service: bedrock · 2025-08-01 · Security-related medium

File: bedrock/latest/userguide/ltm-permissions.md

Summary

Updated KMS resource ARNs and changed StringEquals to StringLike in policy conditions

Security assessment

Changing StringEquals to StringLike for KMS encryption context conditions ensures proper wildcard matching for agent aliases, reducing misconfiguration risks. Specific account ID in ARNs enforces correct scope.

Diff

diff --git a/bedrock/latest/userguide/ltm-permissions.md b/bedrock/latest/userguide/ltm-permissions.md
index 321a8ad1d..d20551b2d 100644
--- a//bedrock/latest/userguide/ltm-permissions.md
+++ b//bedrock/latest/userguide/ltm-permissions.md
@@ -101 +101 @@ JSON
-                "Resource": "arn:aws:kms:$region:$account-id:key/$key-id",
+                "Resource": "arn:aws:kms:us-east-1:123456789012:key/$key-id",
@@ -103,2 +103,2 @@ JSON
-                    "StringEquals": {
-                        "kms:EncryptionContext:aws-crypto-ec:aws:bedrock:arn": "arn:aws:bedrock:${region}:${account-id}:agent-alias/*"
+                    "StringLike": {
+                        "kms:EncryptionContext:aws-crypto-ec:aws:bedrock:arn": "arn:aws:bedrock:us-east-1:123456789012:agent-alias/*"
@@ -114 +114 @@ JSON
-                "Resource": "arn:aws:kms:$region:$account-id:key/$key-id",
+                "Resource": "arn:aws:kms:us-east-1:123456789012:key/$key-id",
@@ -116,2 +116,2 @@ JSON
-                    "StringEquals": {
-                        "kms:EncryptionContext:aws-crypto-ec:aws:bedrock:arn": "arn:aws:bedrock:${region}:${account-id}:agent-alias/*"
+                    "StringLike": {
+                        "kms:EncryptionContext:aws-crypto-ec:aws:bedrock:arn": "arn:aws:bedrock:us-east-1:123456789012:agent-alias/*"