AWS bedrock-agentcore medium security documentation change
Summary
Replaced generic placeholders (region, accountId) with specific example values (us-east-1, 123456789012) in IAM policy examples and added replacement instructions
Security assessment
Standardized example values and explicit replacement instructions help prevent accidental use of example credentials in production configurations. The changes emphasize proper IAM policy configuration for runtime permissions, which is critical for security. However, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/bedrock-agentcore/latest/devguide/runtime-permissions.md b/bedrock-agentcore/latest/devguide/runtime-permissions.md index 5a8e04db1..727601568 100644 --- a//bedrock-agentcore/latest/devguide/runtime-permissions.md +++ b//bedrock-agentcore/latest/devguide/runtime-permissions.md @@ -17 +17 @@ The AgentCore Runtime execution role is an IAM role that AgentCore Runtime assum - * `region` with the AWS Region that you are using + * `us-east-1` with the AWS Region that you are using @@ -19 +19 @@ The AgentCore Runtime execution role is an IAM role that AgentCore Runtime assum - * `accountId` with your AWS account ID + * `123456789012` with your AWS account ID @@ -44 +44 @@ JSON - "arn:aws:ecr:region:accountId:repository/*" + "arn:aws:ecr:us-east-1:123456789012:repository/*" @@ -54 +54 @@ JSON - "arn:aws:logs:region:accountId:log-group:/aws/bedrock-agentcore/runtimes/*" + "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock-agentcore/runtimes/*" @@ -63 +63 @@ JSON - "arn:aws:logs:region:accountId:log-group:*" + "arn:aws:logs:us-east-1:123456789012:log-group:*" @@ -73 +73 @@ JSON - "arn:aws:logs:region:accountId:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*" + "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*" @@ -113,2 +113,2 @@ JSON - "arn:aws:bedrock-agentcore:region:accountId:workload-identity-directory/default", - "arn:aws:bedrock-agentcore:region:accountId:workload-identity-directory/default/workload-identity/agentName-*" + "arn:aws:bedrock-agentcore:us-east-1:123456789012:workload-identity-directory/default", + "arn:aws:bedrock-agentcore:us-east-1:123456789012:workload-identity-directory/default/workload-identity/agentName-*" @@ -125 +125 @@ JSON - "arn:aws:bedrock:region:accountId:*" + "arn:aws:bedrock:us-east-1:123456789012:*" @@ -135,0 +136,9 @@ The trust relationship for the AgentCore Runtime execution role should allow Age +Replace the following: + + * `us-east-1` with the AWS Region that you are using + + * `123456789012` with your AWS account ID + + + + @@ -155 +164 @@ JSON - "aws:SourceAccount": "accountId" + "aws:SourceAccount": "123456789012" @@ -158 +167 @@ JSON - "aws:SourceArn": "arn:aws:bedrock-agentcore:region:accountId:*" + "aws:SourceArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:*"