AWS bedrock documentation change

Service: bedrock · 2025-08-22 · Documentation low

File: bedrock/latest/userguide/kb-permissions.md

Summary

Updated example resource ARNs and policy syntax in knowledge base permissions documentation. Replaced placeholder values with concrete examples and fixed JSON formatting.

Security assessment

Changes involve example value standardization and JSON syntax corrections without introducing or modifying security controls. No evidence of addressing vulnerabilities or security incidents.

Diff

diff --git a/bedrock/latest/userguide/kb-permissions.md b/bedrock/latest/userguide/kb-permissions.md
index cd0aa39ed..7cd386716 100644
--- a//bedrock/latest/userguide/kb-permissions.md
+++ b//bedrock/latest/userguide/kb-permissions.md
@@ -187 +187 @@ JSON
-                    "arn:aws:s3:::${Bucket}"
+                    "arn:aws:s3:::amzn-s3-demo-bucket"
@@ -191 +191 @@ JSON
-                        "aws:ResourceAccount": [123456789012]
+                        "aws:ResourceAccount": 123456789012
@@ -202 +202 @@ JSON
-                    "arn:aws:s3:::${BucketAndKeyPrefix}"
+                    "arn:aws:s3:::amzn-s3-demo-bucket"
@@ -206 +206 @@ JSON
-                        "aws:ResourceAccount": [123456789012]
+                        "aws:ResourceAccount": 123456789012
@@ -245 +245 @@ JSON
-                    "arn:aws:secretsmanager:us-east-1:123456789012:secret:${secret-id}"
+                    "arn:aws:secretsmanager:us-east-1:123456789012:secret:SecretId"
@@ -254 +254 @@ JSON
-                    "arn:aws:kms:us-east-1:123456789012:key/${KeyId}"
+                    "arn:aws:kms:us-east-1:123456789012:key/KeyId"
@@ -292 +292 @@ JSON
-                    "arn:aws:secretsmanager:us-east-1:123456789012:secret:${SecretId}"
+                    "arn:aws:secretsmanager:us-east-1:123456789012:secret:SecretId"
@@ -301 +301 @@ JSON
-                    "arn:aws:kms:us-east-1:123456789012:key/${KeyId}"
+                    "arn:aws:kms:us-east-1:123456789012:key/KeyId"
@@ -339 +339 @@ JSON
-                    "arn:aws:secretsmanager:us-east-1:123456789012:secret:${SecretId}"
+                    "arn:aws:secretsmanager:us-east-1:123456789012:secret:SecretId"
@@ -348 +348 @@ JSON
-                    "arn:aws:kms:us-east-1:123456789012:key/${KeyId}"
+                    "arn:aws:kms:us-east-1:123456789012:key/KeyId"
@@ -442 +442 @@ JSON
-                "Resource": "${KnowledgeBaseArn}"
+                "Resource": "arn:aws:bedrock:us-east-1:123456789012:knowledge-base/$KnowledgeBaseId"
@@ -465,2 +465,2 @@ JSON
-                    "kendra:Retrieve", // To call their Retrieve API
-                    "kendra:DescribeIndex" // For validation when creating the KB 
+                    "kendra:Retrieve",
+                    "kendra:DescribeIndex"
@@ -468 +468 @@ JSON
-                "Resource": "arn:${${Partition}}:kendra:${us-east-1}:${123456789012}:index/${${IndexId}}" 
+                "Resource": "arn:aws:kendra:us-east-1:123456789012:index/${IndexId}" 
@@ -514 +514,2 @@ JSON
-        "Statement": [{
+        "Statement": [
+            {
@@ -523 +524 @@ JSON
-                "arn:<partition>:es:<region>:<123456789012>:domain/<domainName>/<indexName>"
+                    "arn:aws:es:us-east-1:123456789012:domain/domainName/indexName"
@@ -527,2 +528 @@ JSON
-            "Effect": "Allow"        
-            },
+                "Effect": "Allow",
@@ -533 +533 @@ JSON
-                "arn:<partition>:es:<region>:<123456789012>:domain/<domainName>"
+                    "arn:aws:es:us-east-1:123456789012:domain/domainName"
@@ -534,0 +535 @@ JSON
+            }
@@ -731 +732 @@ JSON
-                    "arn:aws:s3:::${BucketName}"
+                    "arn:aws:s3:::amzn-s3-demo-bucket"
@@ -735 +736 @@ JSON
-                        "aws:ResourceAccount": "${BucketOwnerAccountId}"
+                        "aws:ResourceAccount": "123456789012"
@@ -746 +747 @@ JSON
-                    "arn:aws:s3:::${BucketNameAndPrefix}/*"
+                    "arn:aws:s3:::amzn-s3-demo-bucket/*"
@@ -750 +751 @@ JSON
-                        "aws:ResourceAccount": "${BucketOwnerAccountId}"
+                        "aws:ResourceAccount": "123456789012"
@@ -795 +796 @@ JSON
-             "Sid": "Example ListBucket permissions",
+             "Sid": "ListBucket",
@@ -804 +805 @@ JSON
-                "arn:aws:s3:::${BucketName}"
+                "arn:aws:s3:::amzn-s3-demo-bucket"
@@ -808 +809 @@ JSON
-             "Sid": "Example GetObject permissions",
+             "Sid": "GetObject",
@@ -811 +812 @@ JSON
-                "AWS": "${KbRoleArn}"
+                "AWS": "123456789012"
@@ -817 +818 @@ JSON
-                "arn:aws:s3:::${BucketNameAndPrefix}/*"
+                "arn:aws:s3:::amzn-s3-demo-bucket/*"