AWS bedrock documentation change
Summary
Specified that CORS is not required for LLM-as-a-judge jobs and only needed for human-based evaluations.
Security assessment
Change clarifies scope of CORS requirements without evidence of security vulnerability remediation. It corrects documentation inaccuracies but doesn't address security flaws.
Diff
diff --git a/bedrock/latest/userguide/model-evaluation-prompt-datasets-judge.md b/bedrock/latest/userguide/model-evaluation-prompt-datasets-judge.md index 02440303a..6d629650d 100644 --- a//bedrock/latest/userguide/model-evaluation-prompt-datasets-judge.md +++ b//bedrock/latest/userguide/model-evaluation-prompt-datasets-judge.md @@ -17 +17 @@ Custom prompt datasets must be stored in Amazon S3, and use the JSON line format -For jobs created using the console you must update the Cross Origin Resource Sharing (CORS) configuration on the S3 bucket. To learn more about the required CORS permissions, see [Required Cross Origin Resource Sharing (CORS) permissions on S3 buckets](./model-evaluation-security-cors.html). +CORS configuration is not required for LLM-as-a-judge evaluation jobs. For human-based evaluation jobs, CORS is required on the S3 output bucket. To learn more, see [Required Cross Origin Resource Sharing (CORS) permissions on S3 buckets](./model-evaluation-security-cors.html).