AWS bedrock-agentcore documentation change
Summary
Updated documentation structure and branding from 'Gateway' to 'Amazon Bedrock AgentCore Gateway', converted management events list to table format, added link to enabling CloudTrail data event logging guide, and clarified authentication/JWT implementation details
Security assessment
The change adds documentation about JWT-based authentication implementation details and explicitly warns against using PII in JWT 'sub' claims. While this improves security transparency, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/bedrock-agentcore/latest/devguide/gateway-event-types.md b/bedrock-agentcore/latest/devguide/gateway-event-types.md index c6ab0662d..90ff14d2e 100644 --- a//bedrock-agentcore/latest/devguide/gateway-event-types.md +++ b//bedrock-agentcore/latest/devguide/gateway-event-types.md @@ -5 +5 @@ -Gateway Management Events in CloudTrailGateway Data Events in CloudTrail +Amazon Bedrock AgentCore Gateway management events in CloudTrailAmazon Bedrock AgentCore Gateway data events in CloudTrail @@ -7 +7 @@ Gateway Management Events in CloudTrailGateway Data Events in CloudTrail -# Gateway Event Types +# Amazon Bedrock AgentCore Gateway event types @@ -9 +9 @@ Gateway Management Events in CloudTrailGateway Data Events in CloudTrail -This section provides information about the types of events that Gateway logs to CloudTrail. +This section provides information about the types of events that Amazon Bedrock AgentCore Gateway logs to CloudTrail. @@ -11 +11,10 @@ This section provides information about the types of events that Gateway logs to -## Gateway Management Events in CloudTrail +###### Topics + + * Amazon Bedrock AgentCore Gateway management events in CloudTrail + + * Amazon Bedrock AgentCore Gateway data events in CloudTrail + + + + +## Amazon Bedrock AgentCore Gateway management events in CloudTrail @@ -32,22 +41,12 @@ Gateway logs management events for the following operations: - * `CreateGateway` \- Creates a new gateway - - * `UpdateGateway` \- Updates an existing gateway - - * `DeleteGateway` \- Deletes a gateway - - * `GetGateway` \- Gets information about a gateway - - * `ListGateways` \- Lists all gateways - - * `CreateGatewayTarget` \- Creates a new target for a gateway - - * `UpdateGatewayTarget` \- Updates an existing gateway target - - * `DeleteGatewayTarget` \- Deletes a gateway target - - * `GetGatewayTarget` \- Gets information about a gateway target - - * `ListGatewayTargets` \- Lists all targets for a gateway - - - +Operation | Description +---|--- +CreateGateway | Creates a new gateway +CreateGatewayTarget | Creates a new target for a gateway +DeleteGateway | Deletes a gateway +DeleteGatewayTarget | Deletes a gateway target +GetGateway | Gets information about a gateway +GetGatewayTarget | Gets information about a gateway target +ListGatewayTargets | Lists all targets for a gateway +ListGateways | Lists all gateways +UpdateGateway | Updates an existing gateway +UpdateGatewayTarget | Updates an existing gateway target @@ -55 +54 @@ Gateway logs management events for the following operations: -## Gateway Data Events in CloudTrail +## Amazon Bedrock AgentCore Gateway data events in CloudTrail @@ -57 +56 @@ Gateway logs management events for the following operations: -Data events provide information about the resource operations performed on or in a resource. These are also known as data plane operations. Data events are often high-volume activities. You must explicitly enable data events as they are not logged by default. The CloudTrail _Event history_ doesn't record data events. +Data events provide information about the resource operations performed on or in a resource. These are also known as data plane operations. Data events are often high-volume activities. You must explicitly enable data events because they are not logged by default. The CloudTrail _Event history_ doesn't record data events. @@ -61 +60 @@ Additional charges apply for logging data events. For more information about Clo -You can enable logging data events for the Gateway resource types by using the CloudTrail console, AWS CLI, or CloudTrail API operations. +To learn how to enable logging data events for the Gateway resource types, see [Enable CloudTrail data event logging for Amazon Bedrock AgentCore Gateway resources](./enabling-cloudtrail-data-event-logging.html). @@ -65 +64 @@ The following table lists the Gateway resource types for which you can enable da -Data event type (console) | resources.type value | Data APIs logged to CloudTrail +Data event type | resources.type value | Data APIs logged to CloudTrail @@ -67 +66 @@ Data event type (console) | resources.type value | Data APIs logged to CloudTrai -Bedrock-AgentCore gateway | `AWS::BedrockAgentCore::Gateway` | InvokeGateway +Bedrock-AgentCore gateway | AWS::BedrockAgentCore::Gateway | InvokeGateway @@ -69 +68 @@ Bedrock-AgentCore gateway | `AWS::BedrockAgentCore::Gateway` | InvokeGateway -### Identity Information in Data Events +### Identity information in data events @@ -71 +70 @@ Bedrock-AgentCore gateway | `AWS::BedrockAgentCore::Gateway` | InvokeGateway -Gateway data events differ from standard AWS data events in how identity information is stored. Since the Data API follows the MCP protocol and uses JWT token-based authentication rather than SigV4, Gateway data events don't have standard AWS identity information. Instead, identity is captured by logging specific JWT claims including the "sub" claim. +Amazon Bedrock AgentCore Gateway data events differ from standard AWS data events in how identity information is stored. Because the Data API follows the MCP protocol and uses JSON Web Token (JWT)-based authentication rather than SigV4, Amazon Bedrock AgentCore Gateway data events don't have standard AWS identity information. Instead, identity is captured by logging specific JWT claims, including the "sub" claim. @@ -77 +76 @@ We recommend that you avoid using any personally identifiable information (PII) -### Error Information in Data Events +### Error information in data events @@ -79 +78 @@ We recommend that you avoid using any personally identifiable information (PII) -Gateway provides error information as part of the `responseElements` field rather than as top-level `errorCode` and `errorMessage` fields. If you're looking for specific error types such as AccessDenied events, parse through the `responseElements` field in the CloudTrail event. +Amazon Bedrock AgentCore Gateway provides error information as part of the `responseElements` field rather than as top-level `errorCode` and `errorMessage` fields. If you're looking for specific error types such as AccessDenied events, parse through the `responseElements` field in the CloudTrail event. @@ -81 +80 @@ Gateway provides error information as part of the `responseElements` field rathe -### Data Event Routing +### Data event routing @@ -83 +82 @@ Gateway provides error information as part of the `responseElements` field rathe -Since Gateway uses JWT tokens for authentication rather than SigV4 credentials, data events are only routed to the resource owner account. +Because Amazon Bedrock AgentCore Gateway uses JWT tokens for authentication rather than SigV4 credentials, data events are only routed to the resource owner account. @@ -91 +90 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Logging Gateway API calls with CloudTrail +Log AgentCore Gateway API calls with CloudTrail @@ -93 +92 @@ Logging Gateway API calls with CloudTrail -Enabling CloudTrail Data Event Logging for Gateway +Enable data event logging for gateway resources