AWS bedrock documentation change

Service: bedrock · 2026-05-13 · Documentation low

File: bedrock/latest/userguide/inline-agent-prereq.md

Summary

Added comprehensive IAM policy example for InvokeInlineAgent permissions including model access, knowledge base retrieval, guardrail application, Lambda invocation, S3 access, and KMS operations

Security assessment

Documents granular permissions requirements without evidence of fixing a vulnerability. Enhances security documentation for inline agent feature by specifying least-privilege access patterns

Diff

diff --git a/bedrock/latest/userguide/inline-agent-prereq.md b/bedrock/latest/userguide/inline-agent-prereq.md
index 48be87df5..8419447e3 100644
--- a//bedrock/latest/userguide/inline-agent-prereq.md
+++ b//bedrock/latest/userguide/inline-agent-prereq.md
@@ -36,0 +37,67 @@ As a best practice for security purposes, replace the `${region}`, `${account-id
+        {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Sid": "InvokeInlineAgent",
+                "Effect": "Allow",
+                "Action": "bedrock:InvokeInlineAgent",
+                "Resource": "*"
+            },
+            {
+                "Sid": "InvokeFoundationModel",
+                "Effect": "Allow",
+                "Action": "bedrock:InvokeModel",
+                "Resource": "arn:aws:bedrock:region::foundation-model/model-id"
+            },
+            {
+                "Sid": "KnowledgeBaseAccess",
+                "Effect": "Allow",
+                "Action": [
+                    "bedrock:Retrieve",
+                    "bedrock:RetrieveAndGenerate"
+                ],
+                "Resource": "arn:aws:bedrock:region:account-id:knowledge-base/knowledge-base-id"
+            },
+            {
+                "Sid": "GuardrailAccess",
+                "Effect": "Allow",
+                "Action": "bedrock:ApplyGuardrail",
+                "Resource": "arn:aws:bedrock:region:account-id:guardrail/guardrail-id"
+            },
+            {
+                "Sid": "LambdaInvoke",
+                "Effect": "Allow",
+                "Action": "lambda:InvokeFunction",
+                "Resource": "arn:aws:lambda:region:account-id:function:function-name"
+            },
+            {
+                "Sid": "S3AccessForKBAndActions",
+                "Effect": "Allow",
+                "Action": [
+                    "s3:GetObject",
+                    "s3:GetObjectMetadata"
+                ],
+                "Resource": "arn:aws:s3:::bucket-name/*"
+            },
+            {
+                "Sid": "S3AccessForCodeInterpreter",
+                "Effect": "Allow",
+                "Action": [
+                    "s3:GetObjectVersion",
+                    "s3:GetObjectVersionAttributes",
+                    "s3:GetObjectAttributes"
+                ],
+                "Resource": "arn:aws:s3:::bucket-name/path/to/file"
+            },
+            {
+                "Sid": "KMSAccess",
+                "Effect": "Allow",
+                "Action": [
+                    "kms:GenerateDataKey*",
+                    "kms:Decrypt"
+                ],
+                "Resource": "arn:aws:kms:region:account-id:key/key-id"
+            }
+        ]
+    }
+