AWS bedrock-agentcore documentation change
Summary
Added Memory resource support to resource-based policies, documented Memory-specific actions, and updated condition keys reference
Security assessment
This change expands documentation of security features by adding Memory as a new resource type that can be protected with resource-based policies. It documents 17 new Memory-specific IAM actions for fine-grained access control, enhancing security documentation but not fixing a specific vulnerability.
Diff
diff --git a/bedrock-agentcore/latest/devguide/resource-based-policies.md b/bedrock-agentcore/latest/devguide/resource-based-policies.md index 329800666..50e5b4fec 100644 --- a//bedrock-agentcore/latest/devguide/resource-based-policies.md +++ b//bedrock-agentcore/latest/devguide/resource-based-policies.md @@ -9 +9 @@ Supported resourcesHow resource-based policies workPolicy structureSupported act -Resource-based policies in Amazon Bedrock AgentCore allow you to control which principals (AWS accounts, IAM users, or IAM roles) can invoke and manage your Amazon Bedrock AgentCore Runtime and Gateway resources. You can attach IAM-style policies directly to your resources to define rules around who can start runtime sessions, invoke a gateway, or perform other management and invocation actions. +Resource-based policies in Amazon Bedrock AgentCore allow you to control which principals (AWS accounts, IAM users, or IAM roles) can invoke and manage your Amazon Bedrock AgentCore resources (currently supported for Runtime, Gateway and Memory). You can attach IAM-style policies directly to your resources to define rules around who can start runtime sessions, invoke a gateway, access memory or perform other management and invocation actions. @@ -11 +11 @@ Resource-based policies in Amazon Bedrock AgentCore allow you to control which p -Resource-based policies work in conjunction with identity-based IAM policies to provide fine-grained access control for your Amazon Bedrock AgentCore resources. While identity-based policies are attached to IAM identities and specify what actions they can perform, resource-based policies are attached directly to resources and specify who can access them. +Resource-based policies work in conjunction with identity-based IAM policies to provide access control for your Amazon Bedrock AgentCore resources. While identity-based policies are attached to IAM identities and specify what actions they can perform, resource-based policies are attached directly to resources and specify who can access them. @@ -43,0 +44,2 @@ Amazon Bedrock AgentCore supports resource-based policies for the following reso + * **Memory** \- Control access to memory operations + @@ -107 +109,2 @@ Example: Granting cross-account access requires policies on both resources: - // Policy for Agent Runtime (attached to arn:aws:bedrock-agentcore:us-west-2:111122223333:runtime/AGENTID) + // Policy for Agent Runtime (attached to + // arn:aws:bedrock-agentcore:us-west-2:111122223333:runtime/AGENTID) @@ -122 +125,2 @@ Example: Granting cross-account access requires policies on both resources: - // Policy for Agent Endpoint (attached to arn:aws:bedrock-agentcore:us-west-2:111122223333:runtime/AGENTID/endpoint/ENDPOINTID) + // Policy for Agent Endpoint (attached to + // arn:aws:bedrock-agentcore:us-west-2:111122223333:runtime/AGENTID/endpoint/ENDPOINTID) @@ -211,0 +216,41 @@ The `Resource` field in the policy document must contain the exact ARN of the re +### Memory actions + + * `bedrock-agentcore:GetMemory` \- Retrieve a Memory resource + + * `bedrock-agentcore:UpdateMemory` \- Update a Memory resource + + * `bedrock-agentcore:DeleteMemory` \- Delete a Memory resource + + * `bedrock-agentcore:CreateEvent` \- Create an event in a Memory resource + + * `bedrock-agentcore:GetEvent` \- Retrieve an event from a Memory resource + + * `bedrock-agentcore:DeleteEvent` \- Delete an event from a Memory resource + + * `bedrock-agentcore:ListEvents` \- List Events from a Memory resource + + * `bedrock-agentcore:ListActors` \- List actors from a Memory resource + + * `bedrock-agentcore:ListSessions` \- List sessions from a Memory resource + + * `bedrock-agentcore:GetMemoryRecord` \- Get a memory record from a Memory resource + + * `bedrock-agentcore:ListMemoryRecords` \- List memory records from a Memory resource + + * `bedrock-agentcore:RetrieveMemoryRecords` \- Search memory records from a Memory resource + + * `bedrock-agentcore:DeleteMemoryRecord` \- Delete a memory record from a Memory resource + + * `bedrock-agentcore:BatchCreateMemoryRecords` \- Batch create memory records in a Memory resource + + * `bedrock-agentcore:BatchUpdateMemoryRecords` \- Batch update memory records in a Memory resource + + * `bedrock-agentcore:BatchDeleteMemoryRecords` \- Batch delete memory records in a Memory resource + + * `bedrock-agentcore:StartMemoryExtractionJob` \- Start an extraction job within a Memory Resource + + * `bedrock-agentcore:ListMemoryExtractionJobs` \- List extraction jobs within a Memory Resource + + + + @@ -214 +259 @@ The `Resource` field in the policy document must contain the exact ARN of the re -You can use condition keys to further refine access control in your policies. For a complete list of available condition keys, see [AWS Global Condition Context Keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html) in the _IAM User Guide_. +You can use condition keys to further refine access control in your policies. For a complete list of available condition keys, see [ Bedrock AgentCore Condition Keys ](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrockagentcore.html) and[AWS Global Condition Context Keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html).