AWS bedrock-agentcore documentation change

Service: bedrock-agentcore · 2026-04-22 · Documentation medium

File: bedrock-agentcore/latest/devguide/specify-long-term-memory-organization.md

Summary

Updated IAM policy example for memory access control: clarified policy description, changed 'StringLike' to 'StringEquals' for namespace condition, and added a new policy statement for 'namespacePath' hierarchy access using 'StringLike'.

Security assessment

This change mirrors the update in memory-organization.md, enhancing IAM policy examples for controlling access to memory records. It improves security documentation by showing more precise access control methods but does not indicate a security issue fix.

Diff

diff --git a/bedrock-agentcore/latest/devguide/specify-long-term-memory-organization.md b/bedrock-agentcore/latest/devguide/specify-long-term-memory-organization.md
index 11586174f..6438a0a2c 100644
--- a//bedrock-agentcore/latest/devguide/specify-long-term-memory-organization.md
+++ b//bedrock-agentcore/latest/devguide/specify-long-term-memory-organization.md
@@ -60 +60 @@ You can create IAM policies to restrict memory access by the scopes you define,
-The following policy restricts access to retrieving memories to a specific namespace prefix. In this example, the policy allows access only to memories in namespaces starting with `summaries/agent1/` , such as `summaries/agent1/session1/` or `summaries/agent1/session2/`.
+The following policy restricts access to retrieving memories to a specific namespace or records under a particular namespacePath hierarchy. In this example, the policy allows access only to memories with exact namespaces such as `summaries/agent1/` OR with namespaces under the following namespacePath hierarchy with `summaries/agent1/` , such as `summaries/agent1/session1/` or `summaries/agent1/session2/`.
@@ -74 +74 @@ The following policy restricts access to retrieving memories to a specific names
-            "StringLike": {
+            "StringEquals": {
@@ -77,0 +78,13 @@ The following policy restricts access to retrieving memories to a specific names
+        },
+        {
+          "Sid": "SpecificNamespacePathAccess",
+          "Effect": "Allow",
+          "Action": [
+            "bedrock-agentcore:RetrieveMemoryRecords"
+          ],
+          "Resource": "arn:aws:bedrock-agentcore:us-east-1:123456789012:memory/memory_id",
+          "Condition": {
+            "StringLike": {
+              "bedrock-agentcore:namespacePath": "summaries/agent1/*"
+            }
+          }