AWS bedrock-agentcore documentation change
Summary
Restructured documentation to emphasize IAM role configuration prerequisites for session recording. Added detailed S3 and CloudWatch permissions requirements, removed specific implementation examples, and reorganized content flow.
Security assessment
The changes focus on proper IAM role configuration and permission requirements for secure session recording. While this improves security documentation by clarifying required permissions (s3:PutObject, s3:GetObject, logs actions) and resource restrictions, there's no evidence of addressing a specific security vulnerability. The changes appear to be preventive security best practices rather than remediation of an existing issue.
Diff
diff --git a/bedrock-agentcore/latest/devguide/browser-session-replay.md b/bedrock-agentcore/latest/devguide/browser-session-replay.md index b45cc7434..3e9f77acc 100644 --- a//bedrock-agentcore/latest/devguide/browser-session-replay.md +++ b//bedrock-agentcore/latest/devguide/browser-session-replay.md @@ -5 +5 @@ -How to use session replayPermissions needed +Prerequisites for session recordingConfigure IAM role for recording @@ -28 +28 @@ Information collected during session replay includes: -## How to use session replay +## Prerequisites for session recording @@ -30 +30 @@ Information collected during session replay includes: -To use session replay functionality: +To enable session recording, you need: @@ -32 +32 @@ To use session replay functionality: - 1. Create a browser tool with recording enabled and specify an Amazon S3 bucket for storage + * An Amazon S3 bucket to store recording data @@ -34 +34 @@ To use session replay functionality: - 2. Start a browser session using the browser tool + * An IAM execution role with permissions to write to your Amazon S3 bucket @@ -36 +36 @@ To use session replay functionality: - 3. Perform browsing activities through automation or live view + * A custom browser tool configured with recording enabled @@ -38 +37,0 @@ To use session replay functionality: - 4. Stop the session to save recording data to Amazon S3 @@ -40 +38,0 @@ To use session replay functionality: - 5. Access the recorded session through the console or programmatically @@ -42,0 +41 @@ To use session replay functionality: +## Configure IAM role for recording @@ -43,0 +43 @@ To use session replay functionality: +To enable session recording, you need an IAM execution role with permissions to write recording data to Amazon S3 and log activity to CloudWatch. For detailed instructions on setting up permissions, see [Permissions](./browser-resource-session-management.html#browser-permissions). @@ -45,16 +45 @@ To use session replay functionality: -###### Note - - * Session replay captures DOM mutations and reconstructs them during playback. The browser may make cross-origin HTTP requests to fetch external assets during replay. - - * Session replay is not available in the AWS managed Browser (aws.browser.v1). - - - - -## Permissions needed - -To enable session recording, configure the following permissions for your browser tool's execution role. The executionRoleArn will be used to write the recording data to your given s3 bucket. - -###### Amazon S3 permissions for session recording - -The execution role requires the following permissions to write recording data to your Amazon S3 bucket: +The execution role requires additional permissions beyond the standard browser permissions: @@ -64 +49 @@ The execution role requires the following permissions to write recording data to - "Sid": "BedrockAgentCoreBuiltInToolsS3Policy", + "Sid": "S3Permissions", @@ -67,0 +53,2 @@ The execution role requires the following permissions to write recording data to + "s3:GetObject", + "s3:ListBucket", @@ -71,19 +58,5 @@ The execution role requires the following permissions to write recording data to - "Resource": "arn:aws:s3:::example-s3-bucket/example-prefix/*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "{{accountId}}" - } - } - } - -###### Trust policy for execution role - -Add the following trust policy to the execution role: - -JSON - - -**** - - - + "Resource": [ + "arn:aws:s3:::your-recording-bucket", + "arn:aws:s3:::your-recording-bucket/*" + ] + }, @@ -91,3 +64 @@ JSON - "Version":"2012-10-17", - "Statement": [{ - "Sid": "BedrockAgentCoreBuiltInTools", + "Sid": "CloudWatchLogsPermissions", @@ -95,39 +66,7 @@ JSON - "Principal": { - "Service": "bedrock-agentcore.amazonaws.com" - }, - "Action": "sts:AssumeRole", - "Condition": { - "StringEquals": { - "aws:SourceAccount": "111122223333" - }, - "ArnLike": { - "aws:SourceArn": "arn:aws:bedrock-agentcore:us-east-1:111122223333:*" - } - } - }] - } - - -Once you start a browser session and interact with the browser through either the automation endpoint or live view, session recording automatically generates and uploads data to your specified Amazon S3 bucket in chunks. - -The following shows the settings and Amazon S3 location where your recording will be stored. - -Boto3 - - - - ## Request - response = cp_client.create_browser( - name="my_custom_browser", - description="Test browser for development", - networkConfiguration={ - "networkMode": "PUBLIC" - }, - executionRoleArn="arn:aws:iam::123456789012:role/Sessionreplay", - clientToken=str(uuid.uuid4()), - recording={ - "enabled": True, - "s3Location": { - "bucket": "session-record-123456789012", - "prefix": "replay-data" - } + "Action": [ + "logs:CreateLogGroup", + "logs:CreateLogStream", + "logs:PutLogEvents", + "logs:DescribeLogStreams" + ], + "Resource": "*" @@ -135,21 +73,0 @@ Boto3 - ) - -API - - - - awscurl \ - --region <Region> \ - --service bedrock-agentcore \ - --request PUT \ - --header "Content-Type: application/json" \ - --data '{ - "name": "dsi_browser_2", - "description": "Test sandbox for development", - "networkConfiguration": { - "networkMode": "PUBLIC" - }, - "clientToken": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z" - }' \ - https://bedrock-agentcore.<Region>.amazonaws.com/browsers - ) @@ -157 +75 @@ API -Once you starts a browser session and interact with the browser either via automation end point or via live view, the session recording will start getting generated and pushed to your provided s3 in chunks. +Replace `your-recording-bucket` with your actual Amazon S3 bucket name. @@ -159 +77 @@ Once you starts a browser session and interact with the browser either via autom -You can either use the AWS Management Console or programmatically use the browser session replay functionality to perform live view, access and review recordings, and for recording insights. +The following sections show you how to use session replay and some programmatic examples. @@ -163 +81 @@ You can either use the AWS Management Console or programmatically use the browse - * [Live view and session replay (console)](./session-replay-console-usage.html) + * [How to use session replay](./session-replay-how-to-use.html) @@ -165 +83 @@ You can either use the AWS Management Console or programmatically use the browse - * [Live view and session replay examples (API)](./session-replay-programmatic-usage.html) + * [Session replay programmatic examples](./session-replay-programmatic-usage.html) @@ -178 +96 @@ CloudWatch Metrics for AgentCore Browser -Live view and session replay (console) +How to use session replay