AWS bedrock medium security documentation change

Service: bedrock · 2025-08-01 · Security-related medium

File: bedrock/latest/userguide/rag-evaluation-security-data.md

Summary

Updated KMS ARNs and encryption context with specific account ID 123456789012

Security assessment

Specific account ID in encryption context ensures KMS keys are only used for intended evaluation jobs and knowledge bases, reducing cross-account risks.

Diff

diff --git a/bedrock/latest/userguide/rag-evaluation-security-data.md b/bedrock/latest/userguide/rag-evaluation-security-data.md
index bbe042b74..1705eb671 100644
--- a//bedrock/latest/userguide/rag-evaluation-security-data.md
+++ b//bedrock/latest/userguide/rag-evaluation-security-data.md
@@ -80 +80 @@ JSON
-                    "arn:aws:kms:us-east-1:account-id:key/*"
+                    "arn:aws:kms:us-east-1:123456789012:key/*"
@@ -98 +98 @@ JSON
-                    "arn:aws:kms:us-east-1:account-id:key/*"
+                    "arn:aws:kms:us-east-1:123456789012:key/*"
@@ -102 +102 @@ JSON
-                        "kms:EncryptionContext:evaluationJobArn": "arn:aws:bedrock:region:account-id:evaluation-job/*"
+                        "kms:EncryptionContext:evaluationJobArn": "arn:aws:bedrock:us-east-1:123456789012:evaluation-job/*"
@@ -113 +113 @@ JSON
-                    "arn:aws:kms:us-east-1:account-id:key/*"
+                    "arn:aws:kms:us-east-1:123456789012:key/*"
@@ -117 +117 @@ JSON
-                        "kms:EncryptionContext:knowledgeBaseArn": "arn:aws:bedrock:region:account-id:knowledge-base/*"
+                        "kms:EncryptionContext:knowledgeBaseArn": "arn:aws:bedrock:us-east-1:123456789012:knowledge-base/*"
@@ -128 +128 @@ JSON
-                    "arn:aws:kms:us-east-1:account-id:key/*"
+                    "arn:aws:kms:us-east-1:123456789012:key/*"
@@ -132 +132 @@ JSON
-                        "kms:EncryptionContext:knowledgeBaseArn": "arn:aws:bedrock:region:account-id:knowledge-base/*"
+                        "kms:EncryptionContext:knowledgeBaseArn": "arn:aws:bedrock:us-east-1:123456789012:knowledge-base/*"
@@ -148 +148 @@ JSON
-                    "arn:aws:kms:us-east-1:account-id:key/*"
+                    "arn:aws:kms:us-east-1:123456789012:key/*"
@@ -152 +152 @@ JSON
-                        "kms:EncryptionContext:CustomerAwsAccountId": "account-id",
+                        "kms:EncryptionContext:CustomerAwsAccountId": "123456789012",
@@ -169 +169 @@ JSON
-                    "arn:aws:kms:us-east-1:account-id:key/*"
+                    "arn:aws:kms:us-east-1:123456789012:key/*"
@@ -205 +205 @@ JSON
-                        "kms:EncryptionContext:evaluationJobArn": "arn:aws:bedrock:region:account-id:evaluation-job/*"
+                        "kms:EncryptionContext:evaluationJobArn": "arn:aws:bedrock:us-east-1:123456789012:evaluation-job/*"
@@ -220 +220 @@ JSON
-                        "kms:EncryptionContext:knowledgeBaseArn": "arn:aws:bedrock:region:account-id:knowledge-base/*"
+                        "kms:EncryptionContext:knowledgeBaseArn": "arn:aws:bedrock:us-east-1:123456789012:knowledge-base/*"
@@ -235 +235 @@ JSON
-                        "kms:EncryptionContext:knowledgeBaseArn": "arn:aws:bedrock:region:account-id:knowledge-base/*"
+                        "kms:EncryptionContext:knowledgeBaseArn": "arn:aws:bedrock:us-east-1:123456789012:knowledge-base/*"
@@ -254 +254 @@ JSON
-                        "kms:EncryptionContext:CustomerAwsAccountId": "account-id",
+                        "kms:EncryptionContext:CustomerAwsAccountId": "123456789012",
@@ -296,2 +296,2 @@ JSON
-                        "aws:SourceArn": "arn:aws:bedrock:region:account-id:evaluation-job/*",
-                        "kms:EncryptionContext:evaluationJobArn": "arn:aws:bedrock:region:account-id:evaluation-job/*"
+                        "aws:SourceArn": "arn:aws:bedrock:us-east-1:123456789012:evaluation-job/*",
+                        "kms:EncryptionContext:evaluationJobArn": "arn:aws:bedrock:us-east-1:123456789012:evaluation-job/*"
@@ -351 +351 @@ JSON
-                    "arn:aws:kms:us-east-1:account-id:key/keyYouUse"
+                    "arn:aws:kms:us-east-1:123456789012:key/keyYouUse"