AWS bedrock-agentcore documentation change
Summary
Added global cross-region inference for Policy in AgentCore and updated data residency warnings
Security assessment
The changes introduce global data processing for Policy in AgentCore (expanding beyond geographical boundaries) and explicitly warn about data residency/compliance risks. While this documents security implications of data leaving source geographies, it doesn't address a specific vulnerability but rather adds security guidance about a new feature.
Diff
diff --git a/bedrock-agentcore/latest/devguide/cross-region-inference.md b/bedrock-agentcore/latest/devguide/cross-region-inference.md index 8213a0a32..48c75662a 100644 --- a//bedrock-agentcore/latest/devguide/cross-region-inference.md +++ b//bedrock-agentcore/latest/devguide/cross-region-inference.md @@ -7 +7 @@ -Supported Regions for AgentCore Memory cross-region inferenceSupported Regions for Policy in AgentCore cross-region inferenceSupported Regions for AgentCore Evaluations cross-region inference +Supported Regions for AgentCore Memory cross-region inferenceSupported Regions for Policy in AgentCore cross-region inferenceGlobal cross-region inference for Policy in AgentCoreSupported Regions for AgentCore Evaluations cross-region inference @@ -11 +11 @@ Supported Regions for AgentCore Memory cross-region inferenceSupported Regions f -With cross-region inference, Amazon Bedrock AgentCore Memory, Policy in AgentCore, and AgentCore Evaluations will automatically select the optimal region within your geography (as described in more detail below) to process your inference request, maximizing available compute resources and model availability, and providing the best customer experience. +With cross-region inference, Amazon Bedrock AgentCore Memory, Policy in AgentCore, and AgentCore Evaluations will automatically select the optimal region (as described in more detail below) to process your inference request, maximizing available compute resources and model availability, and providing the best customer experience. @@ -13 +13 @@ With cross-region inference, Amazon Bedrock AgentCore Memory, Policy in AgentCor -For AgentCore Memory, Policy in AgentCore, and AgentCore Evaluations, cross-region inference requests are kept within the AWS Regions that are part of the geography where the data originally resides. For example, a request made within the US is kept within the AWS Regions in the US. Although the data remains stored only in the primary region, when using cross-region inference, your input prompts and output results may move outside of your primary region. All data will be transmitted encrypted across Amazon’s secure network. +For AgentCore Memory, Policy in AgentCore (in select regions), and AgentCore Evaluations, cross-region inference requests are kept within the AWS Regions that are part of the geography where the data originally resides. For example, a request made within the US is kept within the AWS Regions in the US. Although the data remains stored only in the primary region, when using cross-region inference, your input prompts and output results may move outside of your primary region. All data will be transmitted encrypted across Amazon’s secure network. For Policy in AgentCore, inference requests originating in Canada (Central) (ca-central-1) and South America (São Paulo) (sa-east-1) use global cross-region inference and will be securely routed to all available compute resources across all global commercial AWS Regions. For more information, see Global cross-region inference for Policy in AgentCore. @@ -24,0 +25,2 @@ There’s no additional cost for using cross-region inference. Amazon CloudWatch + * Global cross-region inference for Policy in AgentCore + @@ -50,0 +53,11 @@ Asia Pacific | Asia Pacific (Tokyo) (ap-northeast-1) Asia Pacific (Seoul) (ap-n +## Global cross-region inference for Policy in AgentCore + +Effective 4/30, Policy in AgentCore supports global cross-region inference from the following source AWS Regions. An inference request originating in these source Regions will be securely routed to all available compute resources across all global commercial AWS Regions. Unlike geography-bounded cross-region inference, input prompts and output results may be processed outside the geography where the source Region is located. All data will be transmitted encrypted across Amazon’s secure network. + +Customers with data residency or compliance requirements should assess whether global cross-region inference fits their compliance framework, because requests may be processed in any global commercial AWS Region. + +Source AWS Region +--- +Canada (Central) (ca-central-1) +South America (São Paulo) (sa-east-1) +