AWS cli medium security documentation change
Summary
Added requirement for kms:Decrypt permissions when using customer-managed KMS keys with encrypted evaluators, including link to encryption documentation.
Security assessment
Explicitly documents a required security permission (kms:Decrypt) for encryption scenarios, preventing potential misconfiguration that could expose encrypted data. The change references encryption-at-rest documentation and validates permissions at creation time.
Diff
diff --git a/cli/latest/reference/bedrock-agentcore-control/create-online-evaluation-config.md b/cli/latest/reference/bedrock-agentcore-control/create-online-evaluation-config.md index 1fd49556b..70d91afdd 100644 --- a//cli/latest/reference/bedrock-agentcore-control/create-online-evaluation-config.md +++ b//cli/latest/reference/bedrock-agentcore-control/create-online-evaluation-config.md @@ -15 +15 @@ - * [AWS CLI 2.34.38 Command Reference](../../index.html) » + * [AWS CLI 2.34.40 Command Reference](../../index.html) » @@ -384 +384 @@ JSON Syntax: -> The Amazon Resource Name (ARN) of the IAM role that grants permissions to read from CloudWatch logs, write evaluation results, and invoke Amazon Bedrock models for evaluation. +> The Amazon Resource Name (ARN) of the IAM role that grants permissions to read from CloudWatch logs, write evaluation results, and invoke Amazon Bedrock models for evaluation. If the configuration references evaluators encrypted with a customer managed KMS key, this role must also have `kms:Decrypt` permission on the KMS key. The service validates this permission at configuration creation time. For more information, see [Encryption at rest for AgentCore Evaluations](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/evaluations-encryption.html) . @@ -640 +640 @@ failureReason -> (string) - * [AWS CLI 2.34.38 Command Reference](../../index.html) » + * [AWS CLI 2.34.40 Command Reference](../../index.html) »