AWS bedrock-agentcore documentation change

Service: bedrock-agentcore · 2025-11-04 · Documentation medium

File: bedrock-agentcore/latest/devguide/security-iam-awsmanpol.md

Summary

Added new AWS managed policies and updated BedrockAgentCoreFullAccess policy with KMS, CloudTrail, S3, and ECR permissions

Security assessment

Documents expanded permissions for security-sensitive services (KMS, CloudTrail) but does not indicate these were missing or causing a prior vulnerability. The changes enable features like Application Signals and semantic search.

Diff

diff --git a/bedrock-agentcore/latest/devguide/security-iam-awsmanpol.md b/bedrock-agentcore/latest/devguide/security-iam-awsmanpol.md
index 96c350412..f1c707e7e 100644
--- a//bedrock-agentcore/latest/devguide/security-iam-awsmanpol.md
+++ b//bedrock-agentcore/latest/devguide/security-iam-awsmanpol.md
@@ -16,0 +17,15 @@ For more information, see [AWS managed policies](https://docs.aws.amazon.com/IAM
+###### Topics
+
+  * AWS managed policy: BedrockAgentCoreFullAccess
+
+  * AWS managed policy: BedrockAgentCoreNetworkServiceRolePolicy
+
+  * AWS managed policy: AmazonBedrockAgentCoreMemoryBedrockModelInferenceExecutionRolePolicy
+
+  * AWS managed policy: BedrockAgentCoreRuntimeIdentityServiceRolePolicy
+
+  * AgentCore updates to AWS managed policies
+
+
+
+
@@ -120,0 +136,11 @@ Change | Description | Date
+BedrockAgentCoreFullAccess – Updated policy | 
+
+  * Added the `cloudtrail:CreateServiceLinkedChannel` permission to allow Amazon Bedrock AgentCore to create a CloudTrail service-linked channel for the Application Signals feature.
+  * Added `kms:CreateGrant` permission to allow the Amazon Bedrock AgentCore Gateway service to create grants on customer managed keys for the S3 vectors service used for semantic search.
+  * Added `kms:ListGrants` permission to check if previously created grants exist.
+  * Added S3 permissions to create bucket, put bucket policy, versioning, put object for buckets with prefix bedrock-agentcore-runtime-.
+  * Added list buckets, list objects in the bucket, and get object permissions.
+  * Added ECR permissions to describe repositories, list images, and describe images.
+  * Added logs `PutResourcePolicy` permissions to enable transaction search.
+
+| November 3, 2025