AWS bedrock medium security documentation change
Summary
Updated documentation to specify using S3 bucket logs instead of CloudWatch Logs for reinforcement fine-tuning input, added permissions requirements for accessing S3 logs, simplified filtering instructions, and removed deprecated details about prompt limits.
Security assessment
The change explicitly adds a requirement to configure Amazon Bedrock permissions for accessing S3 logs (via a new link to security documentation). This addresses access control for sensitive training data in logs, a security concern. However, there is no mention of patching a specific vulnerability.
Diff
diff --git a/bedrock/latest/userguide/rft-option-2.md b/bedrock/latest/userguide/rft-option-2.md index b5044b65b..ec34a4942 100644 --- a//bedrock/latest/userguide/rft-option-2.md +++ b//bedrock/latest/userguide/rft-option-2.md @@ -9 +9 @@ Add request metadata to prompts and responses in your invocation logs for reinfo -When you create a reinforcement fine-tuning job, you can have Amazon Bedrock use existing teacher responses from CloudWatch Logs invocation logs as training data. For Amazon Bedrock, an invocation log is a detailed record of model invocations. +When you create a reinforcement fine-tuning job, you can have Amazon Bedrock use existing invocation logs from your S3 bucket as training data. For Amazon Bedrock, an invocation log is a detailed record of model invocations. @@ -11 +11 @@ When you create a reinforcement fine-tuning job, you can have Amazon Bedrock use -To use invocation logs for reinforcement fine-tuning, set the model invocation logging on, use one of the model invocation operations, and make sure that you've set up an Amazon S3 bucket as the destination for the logs. Before you can start the reinforcement fine-tuning job, you must provide Amazon Bedrock permissions to access the logs. For more information about setting up the invocation logs, see Monitor model invocation using CloudWatch Logs. +To use invocation logs for reinforcement fine-tuning, set the model invocation logging on, use one of the model invocation operations, and make sure that you've set up an Amazon S3 bucket as the destination for the logs. For more information about setting up the invocation logs, see [Monitor model invocation using CloudWatch Logs and Amazon S3](https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html). @@ -13 +13 @@ To use invocation logs for reinforcement fine-tuning, set the model invocation l -With this option, you can specify if you want Amazon Bedrock to use only the prompts, or to use prompt-response pairs from the invocation log. If you want Amazon Bedrock to use only prompts, then Amazon Bedrock might add proprietary data synthesis techniques to generate diverse and higher-quality responses from the teacher model. If you want Amazon Bedrock to use prompt-response pairs, then Amazon Bedrock won't re-generate responses from the teacher model. Amazon Bedrock will directly use the responses from the invocation log to fine-tune the student model. +Before you can start the reinforcement fine-tuning job with invocation logs from an S3 bucket as input, you must provide Amazon Bedrock permissions to access the logs from an S3 Bucket. For more information, see [Invocation log access](./rft-access-security.html#rft-api-log-permissions). @@ -15,7 +15 @@ With this option, you can specify if you want Amazon Bedrock to use only the pro -###### Important - -You can provide a maximum of 20K prompts or prompt-response pairs to Amazon Bedrock for reinforcement fine-tuning the student model. To ensure that the student model is fine-tuned to meet your specific requirements, we highly recommend that you use responses from your invocation logs. Additionally, make sure that you have at least 100 prompt-response pairs generated from the model in your invocation logs that exactly match with the teacher model you've chosen. - -You can optionally add request metadata to the prompt-response pairs in the invocation log using one of the model invocation operations and then later use it to filter the logs. Amazon Bedrock can use the filtered logs to fine-tune the student model. - -To filter the logs using multiple request metadata, use a single operation Boolean operator AND, OR, or NOT. You cannot combine operations. For single request metadata filtering, use the Boolean operator NOT. +You can optionally add request metadata to the prompt-response pairs in the invocation log using one of the model invocation operations and then later use it to filter the logs. Amazon Bedrock can use the filtered logs to fine-tune the model. @@ -25 +19 @@ To filter the logs using multiple request metadata, use a single operation Boole -The model invocation logging collects invocation logs, model input data (prompts), and model output data (responses) for all invocations used in Amazon Bedrock. If you've enabled logging, you can collect the logs whenever you interact with Amazon Bedrock foundation models through any Invoke or Converse API operations. If you want Amazon Bedrock to use the prompts and associated responses from the invocation log to fine-tune the student model, then you must give Amazon Bedrock access to these logs. Using the responses that a model has already generated makes it quicker to fine-tune the student model. Using responses from the invocation logs also makes reinforcement fine-tuning more cost-effective. However, Amazon Bedrock's proprietary data synthesis techniques are not added, which may result in a more performant reinforcement fine-tuning job. +With invocation logs, you can identify the training dataset prompts that you want Amazon Bedrock to use for reinforcement fine-tuning using request metadata attached to invocation logs. @@ -27,3 +21 @@ The model invocation logging collects invocation logs, model input data (prompts -With invocation logs, you can identify the prompt-response pairs that you want Amazon Bedrock to use for reinforcement fine-tuning. These prompt-response pairs can be for specific use cases. To be able to identify the prompt-response pairs to use for reinforcement fine-tuning, you must add a request metadata string to the prompt-response pairs when you invoke a model or use the Converse API operation. The request metadata is provided in the format: "priority" : "High". - -As you continue to interact with the model using the Invoke or Converse API operations, the interactions and the request metadata are logged in the invocation logs. The following is an example of an invocation log from an InvokeModel call that shows the request metadata: +The following is an example of an invocation log from an `InvokeModel` call with the `requestMetadata`: @@ -75 +67 @@ The request metadata must meet the following requirements: - * Provided in the JSON key:value format. + * Provided in the JSON `key:value` format. @@ -86,3 +78 @@ The request metadata must meet the following requirements: -You can apply filters to the request metadata to selectively choose which prompt-response pairs to include for fine-tuning the student model. For example, you might want to include only those with "project" : "CustomerService" and "priority" : "High" request metadata. - -To filter the logs using multiple request metadata, use a single Boolean operator AND, OR, or NOT. You cannot combine operations. For single request metadata filtering, use the Boolean operator NOT. +Once invocation logs with request metadata are available, you can apply filters based on the request metadata to selectively choose which prompts to include for fine-tuning the model. For example, you might want to include only those with `"project": "CustomerService"` and `"priority": "High"` request metadata. @@ -90 +80 @@ To filter the logs using multiple request metadata, use a single Boolean operato -You can specify the invocation log as your input data source and what filters to use to select the prompt-response pairs when you start a reinforcement fine-tuning job. You can start a reinforcement fine-tuning job in the Amazon Bedrock console, using the API, AWS CLI, or SDK. +To filter the logs using multiple request metadata, use a single Boolean operator `AND` or `OR`. You cannot combine these operators. For single request metadata filtering, use the `Equals` or `Not Equals` operator.