AWS bedrock-agentcore medium security documentation change
Summary
Updated documentation title and content to use full service name (Amazon Bedrock AgentCore Gateway). Added security consideration about using separate AWS account for CloudTrail S3 bucket. Minor wording improvements.
Security assessment
Added explicit guidance about storing logs in a separate AWS account - a security best practice for isolation and centralized monitoring. This helps prevent log tampering and improves audit capabilities.
Diff
diff --git a/bedrock-agentcore/latest/devguide/enabling-cloudtrail-data-event-logging.md b/bedrock-agentcore/latest/devguide/enabling-cloudtrail-data-event-logging.md index 69a42b628..344cce0e5 100644 --- a//bedrock-agentcore/latest/devguide/enabling-cloudtrail-data-event-logging.md +++ b//bedrock-agentcore/latest/devguide/enabling-cloudtrail-data-event-logging.md @@ -5 +5 @@ -# Enabling CloudTrail Data Event Logging for Gateway +# Enable CloudTrail data event logging for Amazon Bedrock AgentCore Gateway resources @@ -7 +7 @@ -You can use CloudTrail data events to get information about Gateway requests. To enable CloudTrail data events for Gateway, you must create a trail manually in CloudTrail backed by an Amazon S3 bucket. +You can use CloudTrail data events to get information about Amazon Bedrock AgentCore Gateway requests. To enable CloudTrail data events for Gateway, you must create a trail manually in CloudTrail backed by an Amazon S3 bucket. @@ -9 +9 @@ You can use CloudTrail data events to get information about Gateway requests. To -###### Note +###### Key considerations @@ -13 +13 @@ You can use CloudTrail data events to get information about Gateway requests. To - * With a Gateway that is generating a high workload, you could quickly generate thousands of logs in a short amount of time. Be mindful of how long you choose to enable CloudTrail data events for a busy Gateway. + * With a gateway that is generating a high workload, you could quickly generate thousands of logs in a short amount of time. Be mindful of how long you choose to enable CloudTrail data events for a busy Gateway. @@ -14,0 +15 @@ You can use CloudTrail data events to get information about Gateway requests. To + * CloudTrail stores gateway data event logs in an Amazon S3 bucket of your choosing. Consider using a bucket in a separate AWS account to better organize events from multiple resources into a central place for easier querying and analysis. @@ -18 +18,0 @@ You can use CloudTrail data events to get information about Gateway requests. To -CloudTrail stores Gateway data event logs in an Amazon S3 bucket of your choosing. Consider using a bucket in a separate AWS account to better organize events from multiple resources into a central place for easier querying and analysis. @@ -20 +20 @@ CloudTrail stores Gateway data event logs in an Amazon S3 bucket of your choosin -When you log data events for a trail in CloudTrail, you must use advanced event selectors to log data events for Gateway operations. +When you log data events for a trail in CloudTrail, you must use advanced event selectors to log data events for gateway operations. @@ -25 +25 @@ AWS CLI -To enable CloudTrail data events for Gateway using the AWS CLI, you can use the following command: +To enable CloudTrail data events for gateway resources using the AWS CLI, you can run the following command in a terminal: @@ -51 +50 @@ AWS CDK -Here's an example of how to create a CloudTrail trail with Gateway data events using AWS CDK: +The following example demonstrates how to create a CloudTrail trail with AgentCore Gateway data events using the AWS CDK: @@ -183 +181 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Gateway Event Types +Gateway event types @@ -185 +183 @@ Gateway Event Types -Understanding Gateway CloudTrail Events +Understanding AgentCore Gateway CloudTrail events