AWS bedrock-agentcore documentation change
Summary
Updated terminology from 'Amazon Bedrock AgentCore Policy' to 'Policy in AgentCore' throughout document, simplified policy engine references, and clarified role permissions
Security assessment
Changes are primarily terminology updates and clarifications of existing security documentation. No evidence of addressing specific vulnerabilities or security incidents. The updates maintain existing security guidance about Cedar policies and IAM permissions without introducing new security features or mitigations.
Diff
diff --git a/bedrock-agentcore/latest/devguide/policy-permissions.md b/bedrock-agentcore/latest/devguide/policy-permissions.md index 143f2c3e2..1800f0531 100644 --- a//bedrock-agentcore/latest/devguide/policy-permissions.md +++ b//bedrock-agentcore/latest/devguide/policy-permissions.md @@ -7 +7 @@ OverviewGateway Execution RoleResource Management RoleWhen Are Role Updates Requ -# AgentCore Gateway and AgentCore Policy IAM Permissions +# AgentCore Gateway and Policy in AgentCore IAM Permissions @@ -9 +9 @@ OverviewGateway Execution RoleResource Management RoleWhen Are Role Updates Requ -This guide provides the required IAM permissions for using Amazon Bedrock AgentCore Gateway with Amazon Bedrock AgentCore Policy for fine-grained authorization control using Cedar policies. +This guide provides the required IAM permissions for using Amazon Bedrock AgentCore Gateway with Policy in AgentCore for fine-grained authorization control using Cedar policies. @@ -13 +13 @@ This guide provides the required IAM permissions for using Amazon Bedrock AgentC -When integrating Amazon Bedrock AgentCore Gateway with Amazon Bedrock AgentCore Policy, two distinct IAM roles are required: +When integrating Amazon Bedrock AgentCore Gateway with Policy in AgentCore, two distinct IAM roles are required: @@ -17 +17 @@ When integrating Amazon Bedrock AgentCore Gateway with Amazon Bedrock AgentCore - 2. **Resource Management Role** \- The IAM role that administrators use to create and manage Amazon Bedrock AgentCore Gateway and Amazon Bedrock AgentCore Policy resources + 2. **Resource Management Role** \- The IAM role that administrators use to create and manage Amazon Bedrock AgentCore Gateway and Policy in AgentCore resources @@ -22 +22 @@ When integrating Amazon Bedrock AgentCore Gateway with Amazon Bedrock AgentCore -Both roles serve different purposes and require specific permissions. The Gateway Execution Role needs permissions to run Amazon Bedrock AgentCore Gateway operations, while the Resource Management Role needs permissions to configure and manage Amazon Bedrock AgentCore Gateway and Amazon Bedrock AgentCore Policy resources. +Both roles serve different purposes and require specific permissions. The Gateway Execution Role needs permissions to run Amazon Bedrock AgentCore Gateway operations, while the Resource Management Role needs permissions to configure and manage Amazon Bedrock AgentCore Gateway and Policy in AgentCore resources. @@ -28 +28 @@ The Gateway Execution Role is assumed by the Amazon Bedrock AgentCore Gateway se - * Evaluate Cedar policies through the Amazon Bedrock AgentCore Policy + * Evaluate Cedar policies through Policy in AgentCore @@ -39 +39 @@ The Gateway Execution Role is assumed by the Amazon Bedrock AgentCore Gateway se -###### Critical Permissions for Amazon Bedrock AgentCore Policy Integration +###### Critical Permissions for Policy in AgentCore Integration @@ -41 +41 @@ The Gateway Execution Role is assumed by the Amazon Bedrock AgentCore Gateway se -The execution role must include these three permissions to use Amazon Bedrock AgentCore Gateway with Amazon Bedrock AgentCore Policy: +The execution role must include these three permissions to use Amazon Bedrock AgentCore Gateway with Policy in AgentCore: @@ -47 +47 @@ The execution role must include these three permissions to use Amazon Bedrock Ag - 3. `bedrock-agentcore:GetPolicyEngine` \- Retrieves Amazon Bedrock AgentCore Policy configuration + 3. `bedrock-agentcore:GetPolicyEngine` \- Retrieves the policy engine configuration @@ -94 +94 @@ Replace the following placeholders: -This policy grants the Amazon Bedrock AgentCore Gateway the necessary permissions to evaluate Cedar policies through the Amazon Bedrock AgentCore Policy. The permissions are split into two statements following least-privilege principles. +This policy grants the Amazon Bedrock AgentCore Gateway the necessary permissions to evaluate Cedar policies through Policy in AgentCore. The permissions are split into two statements following least-privilege principles. @@ -106 +106 @@ Replace these placeholders: - * `<policy-engine-id>` with the Amazon Bedrock AgentCore Policy ID (or use `*` for all policy engines) + * `<policy-engine-id>` with the policy engine ID (or use `*` for all policy engines) @@ -151 +151 @@ Replace these placeholders: -The Resource Management Role is used by administrators to create and manage Amazon Bedrock AgentCore Gateway and Amazon Bedrock AgentCore Policy resources. This role requires permissions to: +The Resource Management Role is used by administrators to create and manage Amazon Bedrock AgentCore Gateway and Policy in AgentCore resources. This role requires permissions to: @@ -166 +166 @@ The Resource Management Role is used by administrators to create and manage Amaz -This role is separate from the Gateway Execution Role and is only needed when setting up or modifying Amazon Bedrock AgentCore Gateway and Amazon Bedrock AgentCore Policy configurations. +This role is separate from the Gateway Execution Role and is only needed when setting up or modifying Amazon Bedrock AgentCore Gateway and Policy in AgentCore configurations. @@ -306 +306 @@ While the Resource field is included for consistency, these permission-only acti -Determine whether Amazon Bedrock AgentCore Policy permissions need to be added to the Amazon Bedrock AgentCore Gateway execution role based on how the Amazon Bedrock AgentCore Gateway was created. +Determine whether Policy in AgentCore permissions need to be added to the Amazon Bedrock AgentCore Gateway execution role based on how the Amazon Bedrock AgentCore Gateway was created. @@ -313 +313 @@ Determine whether Amazon Bedrock AgentCore Policy permissions need to be added t -The starter toolkit automatically creates an execution role with `bedrock-agentcore:*` wildcard permissions that include all Amazon Bedrock AgentCore Policy actions. The role is fully configured and ready to use. +The starter toolkit automatically creates an execution role with `bedrock-agentcore:*` wildcard permissions that include all Policy in AgentCore actions. The role is fully configured and ready to use. @@ -320 +320 @@ The starter toolkit automatically creates an execution role with `bedrock-agentc -Custom IAM roles require the Amazon Bedrock AgentCore Policy permissions documented in this guide to be added manually. Follow the permission policies in the sections above. +Custom IAM roles require the Policy in AgentCore permissions documented in this guide to be added manually. Follow the permission policies in the sections above. @@ -331 +331 @@ Even when using the starter toolkit, production environments may require replaci -This section covers common issues when configuring IAM permissions for Amazon Bedrock AgentCore Gateway with Amazon Bedrock AgentCore Policy. +This section covers common issues when configuring IAM permissions for Amazon Bedrock AgentCore Gateway with Policy in AgentCore. @@ -337 +337 @@ This section covers common issues when configuring IAM permissions for Amazon Be -**Root Cause:** The Gateway Execution Role is missing the required Amazon Bedrock AgentCore Policy permissions. Without these permissions, the Gateway cannot perform policy authorization. +**Root Cause:** The Gateway Execution Role is missing the required Policy in AgentCore permissions. Without these permissions, the Gateway cannot perform policy authorization. @@ -361 +361 @@ If you attach a Policy Engine to an existing Gateway using the Policy Engine con -**Symptom:** Amazon Bedrock AgentCore Policy appears to work in LOG_ONLY mode but fails silently without proper error messages. +**Symptom:** Policy engine appears to work in LOG_ONLY mode but fails silently without proper error messages. @@ -369 +369 @@ If you attach a Policy Engine to an existing Gateway using the Policy Engine con -**Symptom:** Amazon Bedrock AgentCore Gateway returns errors indicating it cannot find or access the Amazon Bedrock AgentCore Policy. +**Symptom:** Amazon Bedrock AgentCore Gateway returns errors indicating it cannot find or access the policy engine. @@ -478 +478 @@ The following example demonstrates how to create both required IAM roles using t -This example shows only the Amazon Bedrock AgentCore Policy permissions. Additional permissions for Amazon Bedrock AgentCore Gateway targets (Lambda, API Gateway, etc.) should be added based on your specific integration requirements. +This example shows only the Policy in AgentCore permissions. Additional permissions for Amazon Bedrock AgentCore Gateway targets (Lambda, API Gateway, etc.) should be added based on your specific integration requirements. @@ -482 +482 @@ This example shows only the Amazon Bedrock AgentCore Policy permissions. Additio -After configuring the execution role with the required Amazon Bedrock AgentCore Policy permissions, proceed to create and configure Amazon Bedrock AgentCore Policy resources. For detailed guidance, refer to: +After configuring the execution role with the required Policy in AgentCore permissions, proceed to create and configure Policy resources. For detailed guidance, refer to: @@ -497 +497 @@ After configuring the execution role with the required Amazon Bedrock AgentCore - 3. **Test with LOG_ONLY Mode** \- Always test Amazon Bedrock AgentCore Policy integration in LOG_ONLY mode before enforcing policies + 3. **Test with LOG_ONLY Mode** \- Always test policy engine integration in LOG_ONLY mode before enforcing policies @@ -503 +503 @@ After configuring the execution role with the required Amazon Bedrock AgentCore - 6. **Use Resource Tags** \- Apply tags to organize and manage Amazon Bedrock AgentCore Gateway and Amazon Bedrock AgentCore Policy resources + 6. **Use Resource Tags** \- Apply tags to organize and manage Amazon Bedrock AgentCore Gateway and Policy in AgentCore resources