AWS bedrock medium security documentation change
Summary
Added documentation about required KMS decrypt permissions for encrypted S3 data sources and removed preview notice for S3 Vectors integration
Security assessment
The change explicitly adds guidance for decrypting KMS-encrypted data sources, which directly relates to data protection and access control. The added KMS:Decrypt permission with service-specific conditions improves security posture by enforcing least privilege for key usage. This qualifies as security documentation as it addresses encryption management.
Diff
diff --git a/bedrock/latest/userguide/kb-permissions.md b/bedrock/latest/userguide/kb-permissions.md index cc29f11c6..cd9878065 100644 --- a//bedrock/latest/userguide/kb-permissions.md +++ b//bedrock/latest/userguide/kb-permissions.md @@ -5 +5 @@ -Trust relationshipPermissions to access Amazon Bedrock modelsPermissions to access your data sourcesPermissions to chat with your documentPermissions for multimodal contentPermissions to access your Amazon Kendra GenAI indexPermissions to access your vector database in Amazon OpenSearch ServerlessPermissions to access your vector database in OpenSearch Managed ClustersPermissions to access your Amazon Aurora database clusterPermissions to access your vector database in Amazon Neptune AnalyticsPermissions to access your vector store in Amazon S3 VectorsPermissions to access a vector database configured with an AWS Secrets Manager secretPermissions for AWS to manage a AWS KMS key for transient data storage during data ingestionPermissions for AWS to manage a data sources from another user's AWS account. +Trust relationshipPermissions to access Amazon Bedrock modelsPermissions to access your data sourcesPermissions to decrypt your AWS KMS key for encrypted data sources in Amazon S3Permissions to chat with your documentPermissions for multimodal contentPermissions to access your Amazon Kendra GenAI indexPermissions to access your vector database in Amazon OpenSearch ServerlessPermissions to access your vector database in OpenSearch Managed ClustersPermissions to access your Amazon Aurora database clusterPermissions to access your vector database in Amazon Neptune AnalyticsPermissions to access your vector store in Amazon S3 VectorsPermissions to access a vector database configured with an AWS Secrets Manager secretPermissions for AWS to manage a AWS KMS key for transient data storage during data ingestionPermissions for AWS to manage a data sources from another user's AWS account. @@ -49,0 +50,2 @@ A policy cannot be shared between multiple roles when the service role is used. + * Permissions to decrypt your AWS KMS key for encrypted data sources in Amazon S3 + @@ -363,0 +366,25 @@ JSON +## Permissions to decrypt your AWS KMS key for encrypted data sources in Amazon S3 + +If you encrypted your data sources in Amazon S3 with a AWS KMS key, attach the following policy to your Amazon Bedrock Knowledge Bases service role to allow Amazon Bedrock to decrypt your key. Replace `${Region}` and `${AccountId}` with the Region and account ID to which the key belongs. Replace `${KeyId}` with the ID of your AWS KMS key. + + + { + "Version": "2012-10-17", + "Statement": [{ + "Effect": "Allow", + "Action": [ + "kms:Decrypt" + ], + "Resource": [ + "arn:aws:kms:${Region}:${AccountId}:key/${KeyId}" + ], + "Condition": { + "StringEquals": { + "kms:ViaService": [ + "s3.${Region}.amazonaws.com" + ] + } + } + }] + } + @@ -697,4 +723,0 @@ If you choose to use Amazon S3 Vectors for your knowledge base, attach the follo -###### Important - -The Amazon S3 Vectors integration with Amazon Bedrock Knowledge Bases is in preview release and is subject to change. -