AWS bedrock documentation change
Summary
Updated Sids for clarity and replaced placeholder values in KMS key ARNs and encryption context.
Security assessment
Standard documentation refinement for encryption policies. No evidence of security vulnerability fixes; changes improve clarity but don't alter security posture.
Diff
diff --git a/bedrock/latest/userguide/encryption-agents.md b/bedrock/latest/userguide/encryption-agents.md index d03b47858..268f5657f 100644 --- a//bedrock/latest/userguide/encryption-agents.md +++ b//bedrock/latest/userguide/encryption-agents.md @@ -58 +58 @@ JSON - "Sid": "Allow account root to modify the KMS key, not used by Amazon Bedrock.", + "Sid": "AllowRootModifyKMSKey", @@ -64 +64 @@ JSON - "Resource": "arn:aws:kms:us-east-1:123456789012:key/${key-id}" + "Resource": "arn:aws:kms:us-east-1:123456789012:key/KeyId" @@ -67 +67 @@ JSON - "Sid": "Allow Amazon Bedrock to encrypt and decrypt Agent resources on behalf of authorized users", + "Sid": "AllowBedrockEncryptAgent", @@ -76 +76 @@ JSON - "Resource": "arn:aws:kms:us-east-1:123456789012:key/${key-id}", + "Resource": "arn:aws:kms:us-east-1:123456789012:key/KeyId", @@ -79 +79 @@ JSON - "kms:EncryptionContext:aws:bedrock:arn": "arn:aws:bedrock:us-east-1:123456789012:agent/${agent-id}" + "kms:EncryptionContext:aws:bedrock:arn": "arn:aws:bedrock:us-east-1:123456789012:agent/AgentId" @@ -84 +84 @@ JSON - "Sid": "Allow the service role to use the key to encrypt and decrypt Agent resources", + "Sid": "AllowRoleEncryptAgent", @@ -93 +93 @@ JSON - "Resource": "arn:aws:kms:us-east-1:123456789012:key/${key-id}" + "Resource": "arn:aws:kms:us-east-1:123456789012:key/KeyId" @@ -96 +96 @@ JSON - "Sid": "Allow the attachment of persistent resources", + "Sid": "AllowAttachmentPersistentResources",