AWS bedrock-agentcore documentation change
Summary
Added AgentCore Gateway-specific data protection details including PII handling, encryption methods (KMS/DynamoDB/S3), and clarified data usage policies. Updated related documentation links.
Security assessment
The changes add documentation about encryption implementations (KMS), data storage security (DynamoDB/S3), and PII handling policies. While these are security-related features, there's no evidence of addressing a specific vulnerability or incident. The changes improve transparency about existing security controls.
Diff
diff --git a/bedrock-agentcore/latest/devguide/data-protection.md b/bedrock-agentcore/latest/devguide/data-protection.md index dbc917cdd..e31b708cd 100644 --- a//bedrock-agentcore/latest/devguide/data-protection.md +++ b//bedrock-agentcore/latest/devguide/data-protection.md @@ -5,2 +4,0 @@ -Amazon Bedrock AgentCore is in preview release and is subject to change. - @@ -29,0 +28,15 @@ We strongly recommend that you never put confidential or sensitive information, +###### AgentCore Gateway-specific considerations + + * AgentCore Gateway accepts inputs from customers for tool definitions and service details, which can potentially contain personally identifiable information (PII). + + * Customer data and metadata are stored in Amazon DynamoDB and Amazon Simple Storage Service and are encrypted either with a service key or a customer-managed KMS key. + + * Customer content is not used to provide and maintain the AgentCore Gateway service. + + * Metadata doesn't include customer information (such as PII). + + * Metrics and logs are stored in CloudWatch. + + + + @@ -32 +45,5 @@ We strongly recommend that you never put confidential or sensitive information, - * [Protecting data using VPC and AWS PrivateLink](./vpc.html) + * [Data encryption](./data-encryption.html) + + * [Protecting your data using VPC and AWS PrivateLink](./vpc.html) + + * [Cross-region inference in Amazon Bedrock AgentCore Memory ](./cross-region-inference.html) @@ -45 +62 @@ Security -VPC and AWS PrivateLink +Data encryption