AWS bedrock-agentcore medium security documentation change
Summary
Updated documentation structure, clarified JWT claim sanitization, added example sections for CloudTrail events, and removed 'Additional Resources' section
Security assessment
Explicitly mentions redaction of data events and sanitization of JWT claims for security purposes. This directly documents security measures in logging practices.
Diff
diff --git a/bedrock-agentcore/latest/devguide/understanding-gateway-cloudtrail-log-entries.md b/bedrock-agentcore/latest/devguide/understanding-gateway-cloudtrail-log-entries.md index 8edb29eb8..ba23df21f 100644 --- a//bedrock-agentcore/latest/devguide/understanding-gateway-cloudtrail-log-entries.md +++ b//bedrock-agentcore/latest/devguide/understanding-gateway-cloudtrail-log-entries.md @@ -5 +5 @@ -Additional Resources +InvokeGateway data event with authentication errorSuccessful InvokeGateway data eventManagement Event @@ -7 +7 @@ Additional Resources -# Understanding Gateway CloudTrail Events +# Understanding Amazon Bedrock AgentCore Gateway CloudTrail events @@ -9 +9 @@ Additional Resources -A trail is a configuration that enables delivery of events as log files to an Amazon S3 bucket that you specify. CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. +A trail is a configuration that enables delivery of events as log files to an Amazon S3 bucket that you specify. CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information such as the requested action, the date and time of the action, and request parameters. @@ -13 +13 @@ A trail is a configuration that enables delivery of events as log files to an Am -The contents of the requests and responses for data events are REDACTED, and the JWT claims have HTML entities sanitized for security purposes. +The contents of the requests and responses for data events are redacted, and the JSON Web Token (JWT) claims have HTML entities sanitized for security purposes. @@ -15 +15 @@ The contents of the requests and responses for data events are REDACTED, and the -InvokeGateway Data Event With Authentication Error +The following sections show examples of CloudTrail events: @@ -16,0 +17 @@ InvokeGateway Data Event With Authentication Error +###### Topics @@ -18 +19,12 @@ InvokeGateway Data Event With Authentication Error -The following example shows a CloudTrail log entry that demonstrates the `InvokeGateway` action with an authentication error: + * InvokeGateway data event with authentication error + + * Successful InvokeGateway data event + + * Management Event + + + + +## InvokeGateway data event with authentication error + +The following example shows a CloudTrail log entry that demonstrates the `InvokeGateway` action with an authentication error. The authentication error can be seen in hte `body` field of the `responseElements`. @@ -83,3 +95 @@ The following example shows a CloudTrail log entry that demonstrates the `Invoke - -Successful InvokeGateway Data Event - +## Successful InvokeGateway data event @@ -172,3 +182 @@ The following example shows a CloudTrail log entry for a successful `InvokeGatew - -Management Event - +## Management Event @@ -263,16 +270,0 @@ The following example shows a CloudTrail log entry for a management event: - -## Additional Resources - -For more information about using CloudTrail with Gateway, see the following resources: - - * [AWS CloudTrail User Guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/) - - * [Creating a Trail for Your AWS Account](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html) - - * [AWS CloudTrail API Reference](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/) - - * [AWS CloudTrail CLI Reference](https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/index.html) - - - - @@ -285 +277 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Enabling CloudTrail Data Event Logging for Gateway +Enable data event logging for gateway resources