AWS bedrock-agentcore medium security documentation change

Service: bedrock-agentcore · 2026-05-10 · Security-related medium

File: bedrock-agentcore/latest/devguide/policy-common-patterns.md

Summary

Updated action names from double underscore (__) to triple underscore (___) format in policy examples

Security assessment

Corrects potential policy syntax errors that could lead to misconfigured access controls. Prevents possible authorization bypass by ensuring proper policy enforcement syntax.

Diff

diff --git a/bedrock-agentcore/latest/devguide/policy-common-patterns.md b/bedrock-agentcore/latest/devguide/policy-common-patterns.md
index 49f83b0aa..49981713e 100644
--- a//bedrock-agentcore/latest/devguide/policy-common-patterns.md
+++ b//bedrock-agentcore/latest/devguide/policy-common-patterns.md
@@ -37 +37 @@ Disable a specific tool while keeping others operational:
-      action == AgentCore::Action::"RefundTool__process_refund",
+      action == AgentCore::Action::"RefundTool___process_refund",
@@ -91 +91 @@ Permit access only to users with specific roles:
-      action == AgentCore::Action::"AdminAPI__delete_resource",
+      action == AgentCore::Action::"AdminAPI___delete_resource",
@@ -108 +108 @@ Permit access only to callers using specific IAM roles:
-      action == AgentCore::Action::"AdminAPI__delete_resource",
+      action == AgentCore::Action::"AdminAPI___delete_resource",
@@ -136 +136 @@ Cedar supports various data types in conditions. These examples use OAuth princi
-      action == AgentCore::Action::"TravelAPI__search_flights",
+      action == AgentCore::Action::"TravelAPI___search_flights",
@@ -149 +149 @@ Cedar supports various data types in conditions. These examples use OAuth princi
-      action == AgentCore::Action::"PaymentAPI__process_payment",
+      action == AgentCore::Action::"PaymentAPI___process_payment",
@@ -162 +162 @@ Cedar supports various data types in conditions. These examples use OAuth princi
-      action == AgentCore::Action::"ShippingAPI__calculate_rate",
+      action == AgentCore::Action::"ShippingAPI___calculate_rate",
@@ -175 +175 @@ Cedar supports various data types in conditions. These examples use OAuth princi
-      action == AgentCore::Action::"OrderAPI__create_order",
+      action == AgentCore::Action::"OrderAPI___create_order",