AWS bedrock medium security documentation change
Summary
Updated S3 bucket ARN examples, added inference profile prerequisites link, standardized policy examples with placeholder account IDs (111122223333), and improved policy documentation structure
Security assessment
The replacement of specific S3 bucket ARNs ('amzn-s3-demo-bucket1' to 's3-invocation-logs-bucket') and account IDs (509399623855 to 111122223333) reduces risks of accidental exposure from using real resource names in examples. These changes enforce security best practices for documentation by using non-specific placeholders.
Diff
diff --git a/bedrock/latest/userguide/rft-access-security.md b/bedrock/latest/userguide/rft-access-security.md index adf912c8f..db9912fc3 100644 --- a//bedrock/latest/userguide/rft-access-security.md +++ b//bedrock/latest/userguide/rft-access-security.md @@ -37 +37 @@ Before adding RFT-specific IAM permissions, you must add the following IAM servi -Add these permissions to your existing model customization service role for RFT functionality: +Add these permissions to your existing model customization service role for RFT functionality. @@ -59 +59 @@ You must add Lambda invocation permissions. The following shows an example polic -### API invocation log access +### Invocation log access @@ -76,2 +76,2 @@ You need to provide Amazon S3 bucket access permissions for the input bucket. Th - "arn:aws:s3:::amzn-s3-demo-bucket1", - "arn:aws:s3:::amzn-s3-demo-bucket1/*" + "arn:aws:s3:::s3-invocation-logs-bucket", + "arn:aws:s3:::s3-invocation-logs-bucket/*" @@ -96,0 +97,2 @@ Only add these permissions to your Lambda execution role if you create your own +The following is an example for bedrock LLM as judge invocation using foundation model: + @@ -113 +115 @@ Only add these permissions to your Lambda execution role if you create your own -The following shows an example policy you can use for inference profile invocations: +The following is an example for bedrock LLM as judge invocation using inference profile: @@ -131 +133 @@ The following shows an example policy you can use for inference profile invocati - "bedrock:InferenceProfileArn": "arn:aws:bedrock:us-east-1:509399623855:inference-profile/us.amazon.nova-premier-v1:0" + "bedrock:InferenceProfileArn": "arn:aws:bedrock:us-east-1:111122223333:inference-profile/us.amazon.nova-premier-v1:0" @@ -141 +143 @@ The following shows an example policy you can use for inference profile invocati - "arn:aws:bedrock:us-east-1:509399623855:inference-profile/us.amazon.nova-premier-v1:0" + "arn:aws:bedrock:us-east-1:111122223333:inference-profile/us.amazon.nova-premier-v1:0" @@ -146,0 +149,2 @@ The following shows an example policy you can use for inference profile invocati +For information about inference profile prerequisites, see [ Prerequisites for inference profiles](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-prereq.html). +