AWS bedrock documentation change

Service: bedrock · 2025-08-22 · Documentation low

File: bedrock/latest/userguide/agents-create-cb.md

Summary

Updated IAM policy example with new statements for InvokeInlineAgent, S3AccessForCodeInterpreter, KnowledgeBaseAccess, GuardrailAccess, LambdaInvoke, and KMSAccess. Modified existing resource ARNs to use concrete examples.

Security assessment

The changes demonstrate granular IAM permissions for Bedrock agent operations, promoting least-privilege access. While security-related through IAM policy examples, there's no evidence of addressing a specific vulnerability.

Diff

diff --git a/bedrock/latest/userguide/agents-create-cb.md b/bedrock/latest/userguide/agents-create-cb.md
index c5f02b28c..80f9dd24d 100644
--- a//bedrock/latest/userguide/agents-create-cb.md
+++ b//bedrock/latest/userguide/agents-create-cb.md
@@ -104,0 +105,18 @@ JSON
+          "Sid": "InvokeInlineAgent",
+          "Effect": "Allow",
+          "Action": "bedrock:InvokeInlineAgent",
+          "Resource": "*",
+          "Condition": {
+            "StringEquals": {
+              "bedrock:InlineAgentName": "AgentName-123"
+            }
+          }
+        },
+        {
+          "Sid": "InvokeFoundationModel",
+          "Effect": "Allow",
+          "Action": "bedrock:InvokeModel",
+          "Resource": "arn:aws:bedrock:us-east-1::foundation-model/{modelId}"
+        },
+        {
+          "Sid": "S3AccessForKBAndActions",
@@ -107 +125 @@ JSON
-                    "bedrock:InvokeModel"
+            "s3:GetObject"
@@ -109,5 +127 @@ JSON
-                "Resource": [
-                    "arn:aws:bedrock:{us-east-1}::foundation-model/anthropic.claude-3-sonnet-20240229-v1:0"
-                ]
-            }
-        ]
+          "Resource": "arn:aws:s3:::bucket-name/*"
@@ -116,2 +130,18 @@ JSON
-        "Version": "2012-10-17",
-        "Statement": [
+          "Sid": "S3AccessForCodeInterpreter",
+          "Effect": "Allow",
+          "Action": [
+            "s3:GetObjectVersion",
+            "s3:GetObjectVersionAttributes",
+            "s3:GetObjectAttributes"
+          ],
+          "Resource": "arn:aws:s3:::bucket/path/to/file"
+        },
+        {
+          "Sid": "KnowledgeBaseAccess",
+          "Effect": "Allow",
+          "Action": [
+            "bedrock:Retrieve",
+            "bedrock:RetrieveAndGenerate"
+          ],
+          "Resource": "arn:aws:bedrock:us-east-1:123456789012:knowledge-base/knowledge-base-id"
+        },
@@ -118,0 +149,13 @@ JSON
+          "Sid": "GuardrailAccess",
+          "Effect": "Allow",
+          "Action": "bedrock:ApplyGuardrail",
+          "Resource": "arn:aws:bedrock:us-east-1:123456789012:guardrail/guardrail-id"
+        },
+        {
+          "Sid": "LambdaInvoke",
+          "Effect": "Allow",
+          "Action": "lambda:InvokeFunction",
+          "Resource": "arn:aws:lambda:us-east-1:123456789012:function:function-name"
+        },
+        {
+          "Sid": "KMSAccess",
@@ -121 +164,2 @@ JSON
-                    "bedrock:InvokeBuilder"
+            "kms:GenerateDataKey*",
+            "kms:Decrypt"
@@ -123 +167 @@ JSON
-                "Resource": ["*"]
+          "Resource": "arn:aws:kms:us-east-1:123456789012:key/key-id"