AWS bedrock documentation change
Summary
Removed OpenSearch Serverless vector database stack, Knowledge Bases role stack, Agents stack, and Flows stack. Consolidated Knowledge Bases stack with added chunking configuration parameters and updated CloudFormation template structure.
Security assessment
The changes restructure CloudFormation templates to simplify the mortgage flow example by removing standalone stacks and enhancing the Knowledge Base configuration. No security vulnerabilities or explicit security feature additions are evident. Removed IAM roles/policies were replaced with Bedrock Knowledge Base native integrations, but no direct evidence of security fixes or new security controls introduced.
Diff
diff --git a/bedrock/latest/userguide/getting-started-mortgage-flow-template.md b/bedrock/latest/userguide/getting-started-mortgage-flow-template.md index b79c7c74e..dcd45b286 100644 --- a//bedrock/latest/userguide/getting-started-mortgage-flow-template.md +++ b//bedrock/latest/userguide/getting-started-mortgage-flow-template.md @@ -5 +5 @@ -Main stackAmazon Bedrock Guardrails stackAmazon Bedrock Prompt management stackAmazon OpenSearch Serverless vector database stackAmazon Bedrock Knowledge Bases role stackAmazon Bedrock Knowledge Bases stackAmazon Bedrock Agents stackAmazon Bedrock Flows stack +Main stackAmazon Bedrock Guardrails stackAmazon Bedrock Prompt management stackAmazon Bedrock Knowledge Bases stack @@ -68,4 +67,0 @@ The following topics show the AWS CloudFormation templates used for each stack. - * Amazon OpenSearch Serverless vector database stack - - * Amazon Bedrock Knowledge Bases role stack - @@ -74,4 +69,0 @@ The following topics show the AWS CloudFormation templates used for each stack. - * Amazon Bedrock Agents stack - - * Amazon Bedrock Flows stack - @@ -1064,21 +1056 @@ JSON -## Amazon OpenSearch Serverless vector database stack - -This template creates the following resources to set up the Amazon OpenSearch Serverless collection with a vector database for the knowledge base. - - * OSSProviderRole – The service role for the Amazon OpenSearch Serverless service ([AWS::IAM::Role](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html)). - - * Collection – The Amazon OpenSearch Serverless collection ([AWS::OpenSearchServerless::Collection](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-opensearchserverless-collection.html)). - - * The following policy resources for the collection: - - * EncryptionPolicy ([AWS::OpenSearchServerless::SecurityPolicy](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-opensearchserverless-securitypolicy.html)) - - * NetworkPolicy (AWS::OpenSearchServerless::SecurityPolicy) - - * DataAccessPolicy ([AWS::OpenSearchServerless::AccessPolicy](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-opensearchserverless-securitypolicy.html)) - - * The following resources for Lambda functions to help set up the collection: - - * OpenSearchLambdaExecutionRole (AWS::IAM::Role) – The Lambda service role. - - * OpenSearchPyLayer ([AWS::Lambda::LayerVersion](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-layerversion.html)) +## Amazon Bedrock Knowledge Bases stack @@ -1086 +1058 @@ This template creates the following resources to set up the Amazon OpenSearch Se - * OSSIndexCreationProviderframeworkonEventLambda ([AWS::Lambda::Function](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-layerversion.html)) +This template creates the [knowledge base](./knowledge-base.html) and its data source containing the loan guidelines: @@ -1088 +1060 @@ This template creates the following resources to set up the Amazon OpenSearch Se - * BKBOSSInfraSetupLambda (AWS::Lambda::Function) + * KnowledgeBase ([AWS::Bedrock::KnowledgeBase](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide /aws-resource-bedrock-knowledgebase.html)) @@ -1090 +1062 @@ This template creates the following resources to set up the Amazon OpenSearch Se - * OSSIndexCreationCustomResource ([AWS::CloudFormation::CustomResource](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudformation-customresource.html)) + * KnowledgeBaseDataSource ([AWS::Bedrock::DataSource](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide /aws-resource-bedrock-datasource.html)) @@ -1102,0 +1074,4 @@ YAML + KnowledgeBaseName: + Type: String + Description: Name of knowledge base + Default: MortgageKB @@ -1105 +1080 @@ YAML - Description: Name of S3 bucket where OSS functions are stored + Description: Name of S3 bucket where knowledge base data is stored @@ -1108 +1083,10 @@ YAML - Description: Choose Embedding model + Description: Selected Embedding model + Q07pKBChunkingStrategy: + Type: String + Description: Selected Chunking strategy + Q08pKBMaxTokens: + Type: Number + Description: Maximum number of tokens in a chunk + Q09pKBOverlapPercentage: + Type: Number + Description: Percent overlap in each chunk @@ -1114,0 +1099,15 @@ YAML + Q13pVectorFieldName: + Type: String + Description: Vector field name + Default: bedrock-knowledge-base-default-vector + Q14pMetaDataFieldName: + Type: String + Description: Metadata field name + Default: AMAZON_BEDROCK_METADATA + Q15pTextFieldName: + Type: String + Description: Text field name + Default: AMAZON_BEDROCK_TEXT_CHUNK + pCollectionArn: + Type: String + Description: Name of the Collection Arn @@ -1120,0 +1120,17 @@ YAML + Conditions: + IsChunkingStrategyFixed: + Fn::Equals: + - Ref: Q07pKBChunkingStrategy + - Fixed-size chunking + IsChunkingStrategyDefault: + Fn::Equals: + - Ref: Q07pKBChunkingStrategy + - Default chunking + IsChunkingStrategyNoChunking: + Fn::Equals: + - Ref: Q07pKBChunkingStrategy + - No chunking + IsChunkingStrategyFixedOrDefault: + Fn::Or: + - Condition: IsChunkingStrategyFixed + - Condition: IsChunkingStrategyDefault @@ -1122,170 +1138,2 @@ YAML - EncryptionPolicy: - Type: AWS::OpenSearchServerless::SecurityPolicy - Properties: - Name: !Sub ${Q11pOSSCollectionName}-enc - Policy: - Fn::Sub: '{"Rules": [{"ResourceType": "collection", "Resource": ["collection/${Q11pOSSCollectionName}"]}], - "AWSOwnedKey": true}' - Type: encryption - NetworkPolicy: - Type: AWS::OpenSearchServerless::SecurityPolicy - DependsOn: - - EncryptionPolicy - Properties: - Name: !Sub ${Q11pOSSCollectionName}-net - Policy: - Fn::Sub: '[{"Description": "Public access for ct-kb-aoss-collection collection", - "Rules": [{"ResourceType": "dashboard", "Resource": ["collection/${Q11pOSSCollectionName}"]}, - {"ResourceType": "collection", "Resource": ["collection/${Q11pOSSCollectionName}"]}], - "AllowFromPublic": true}]' - Type: network - DataAccessPolicy: - Type: AWS::OpenSearchServerless::AccessPolicy - DependsOn: - - NetworkPolicy - Properties: - Name: !Sub ${Q11pOSSCollectionName}-access - Policy: - Fn::Sub: '[{"Rules": [{"Resource": ["collection/${Q11pOSSCollectionName}"], "Permission": - ["aoss:CreateCollectionItems", "aoss:UpdateCollectionItems", "aoss:DescribeCollectionItems"], - "ResourceType": "collection"}, {"ResourceType": "index", "Resource": ["index/${Q11pOSSCollectionName}/*"], - "Permission": ["aoss:CreateIndex", "aoss:DescribeIndex", "aoss:ReadDocument", - "aoss:WriteDocument", "aoss:UpdateIndex", "aoss:DeleteIndex"]}], "Principal": - ["arn:aws:iam::${AWS::AccountId}:role/${pKBRole}"]}]' - Type: data - Collection: - Type: AWS::OpenSearchServerless::Collection - DependsOn: - - EncryptionPolicy - Properties: - Description: test bedrock KB cdk - Name: !Ref Q11pOSSCollectionName - Type: VECTORSEARCH - OpenSearchpyLayer: - Type: AWS::Lambda::LayerVersion - Properties: - CompatibleRuntimes: - - python3.8 - - python3.9 - - python3.10 - Content: - S3Bucket: !Ref Q01pS3BucketName - S3Key: artifacts/opensearchpy-layer.zip - Description: opensearchpy layer including requests, requests-aws4auth, and boto3-1.34.82 - LicenseInfo: Apache-2.0 - OpenSearchLambdaExecutionRole: - Type: AWS::IAM::Role - DependsOn: - - OpenSearchpyLayer - Properties: - AssumeRolePolicyDocument: - Version: '2012-10-17&TCX5-2025-waiver;' - Statement: - - Effect: Allow - Principal: - Service: - - lambda.amazonaws.com - Action: - - sts:AssumeRole - Policies: - - PolicyName: allowAoss - PolicyDocument: - Version: '2012-10-17&TCX5-2025-waiver;' - Statement: - - Effect: Allow - Action: - - aoss:APIAccessAll - - aoss:List* - - aoss:Get* - - aoss:Create* - - aoss:Update* - - aoss:Delete* - Resource: '*' - - PolicyName: OSSLambdaRoleDefaultPolicy - PolicyDocument: - Version: '2012-10-17&TCX5-2025-waiver;' - Statement: - - Effect: Allow - Action: - - xray:PutTelemetryRecords - - xray:PutTraceSegments - Resource: '*' - - PolicyName: allowLambdaLogs - PolicyDocument: - Version: '2012-10-17&TCX5-2025-waiver;' - Statement: - - Effect: Allow