AWS bedrock-agentcore documentation change

Service: bedrock-agentcore · 2026-04-22 · Documentation medium

File: bedrock-agentcore/latest/devguide/memory-organization.md

Summary

Updated IAM policy example for memory access control: clarified policy description, changed 'StringLike' to 'StringEquals' for namespace condition, and added a new policy statement for 'namespacePath' hierarchy access using 'StringLike'.

Security assessment

This change enhances IAM policy documentation for fine-grained access control to memory records. It provides more precise condition operators (StringEquals vs StringLike) and adds support for namespacePath hierarchy, improving security by enabling better least-privilege policies. However, there is no evidence of a specific security issue being fixed.

Diff

diff --git a/bedrock-agentcore/latest/devguide/memory-organization.md b/bedrock-agentcore/latest/devguide/memory-organization.md
index c7227d030..5106c92e9 100644
--- a//bedrock-agentcore/latest/devguide/memory-organization.md
+++ b//bedrock-agentcore/latest/devguide/memory-organization.md
@@ -77 +77 @@ You can create IAM policies to restrict memory access by the scopes you define,
-The following policy restricts access to retrieving memories to a specific namespace prefix. In this example, the policy allows access only to memories in namespaces starting with `summaries/agent1/` , such as `summaries/agent1/session1/` or `summaries/agent1/session2/`.
+The following policy restricts access to retrieving memories to a specific namespace or records under a particular namespacePath hierarchy. In this example, the policy allows access only to memories with exact namespaces such as `summaries/agent1/` OR with namespaces under the following namespacePath hierarchy with `summaries/agent1/` , such as `summaries/agent1/session1/` or `summaries/agent1/session2/`.
@@ -91 +91 @@ The following policy restricts access to retrieving memories to a specific names
-            "StringLike": {
+            "StringEquals": {
@@ -94,0 +95,13 @@ The following policy restricts access to retrieving memories to a specific names
+        },
+        {
+          "Sid": "SpecificNamespacePathAccess",
+          "Effect": "Allow",
+          "Action": [
+            "bedrock-agentcore:RetrieveMemoryRecords"
+          ],
+          "Resource": "arn:aws:bedrock-agentcore:us-east-1:123456789012:memory/memory_id",
+          "Condition": {
+            "StringLike": {
+              "bedrock-agentcore:namespacePath": "summaries/agent1/*"
+            }
+          }