AWS bedrock documentation change
Summary
Updated Sid clarity, replaced placeholders in KMS ARNs, and specified concrete values for IAM role and ViaService endpoint.
Security assessment
Refined encryption policy examples for Flows. Changes improve documentation accuracy but don't address vulnerabilities or introduce new security features.
Diff
diff --git a/bedrock/latest/userguide/encryption-flows.md b/bedrock/latest/userguide/encryption-flows.md index 97ef5c94b..d547cf2de 100644 --- a//bedrock/latest/userguide/encryption-flows.md +++ b//bedrock/latest/userguide/encryption-flows.md @@ -55 +55 @@ JSON - "Sid": "Allow account root to modify the KMS key, not used by Amazon Bedrock.", + "Sid": "AllowRootModifyKMSId", @@ -61 +61 @@ JSON - "Resource": "arn:aws:kms:us-east-1:123456789012:key/${key-id}" + "Resource": "arn:aws:kms:us-east-1:123456789012:key/KeyId" @@ -64 +64 @@ JSON - "Sid": "Allow the IAM user or IAM role of Flows API caller to use the key to encrypt and decrypt data.", + "Sid": "AllowRoleUseKMSKey", @@ -67 +67 @@ JSON - "AWS": "{IAM-USER/ROLE-ARN}" + "AWS": "arn:aws:iam::123456789012:role/RoleName" @@ -76,2 +76,2 @@ JSON - "kms:EncryptionContext:aws:bedrock-flows:arn": "arn:aws:bedrock:us-east-1:123456789012:flow/${flow-id}", - "kms:ViaService": "bedrock.${region}.amazonaws.com" + "kms:EncryptionContext:aws:bedrock-flows:arn": "arn:aws:bedrock:us-east-1:123456789012:flow/FlowId", + "kms:ViaService": "bedrock.us-east-1.amazonaws.com"