AWS bedrock-agentcore high security documentation change
Summary
Updated principal.id format documentation for IAM-authenticated gateways, standardized assumed-role ARN format, and restructured pattern matching examples.
Security assessment
Corrects critical ARN format documentation for assumed roles (removing session names) to enable stable exact matching. Fixes previous misleading examples that could lead to insecure policies if implemented, directly addressing authorization vulnerabilities.
Diff
diff --git a/bedrock-agentcore/latest/devguide/policy-conditions.md b/bedrock-agentcore/latest/devguide/policy-conditions.md index 953f55cb0..c766d8637 100644 --- a//bedrock-agentcore/latest/devguide/policy-conditions.md +++ b//bedrock-agentcore/latest/devguide/policy-conditions.md @@ -93 +93 @@ For IAM-authenticated gateways, the principal has an `id` attribute containing t -The `principal.id` attribute contains the full IAM ARN in one of these formats: +#### Principal entity format @@ -95 +95 @@ The `principal.id` attribute contains the full IAM ARN in one of these formats: - * **IAM user:** `arn:aws:iam::123456789012:user/username` +The Cedar principal for IAM-authenticated gateways is `AgentCore::IamEntity`. The `principal.id` attribute contains the caller’s IAM ARN. @@ -97 +97 @@ The `principal.id` attribute contains the full IAM ARN in one of these formats: - * **IAM role (assumed):** `arn:aws:sts::123456789012:assumed-role/role-name/session-name` +For callers authenticating via an assumed IAM role, the `principal.id` and Cedar entity ID use the format: @@ -99 +99 @@ The `principal.id` attribute contains the full IAM ARN in one of these formats: - * **IAM role:** `arn:aws:iam::123456789012:role/role-name` +`arn:aws:sts::<account-id>:assumed-role/<role-name>` @@ -100,0 +101 @@ The `principal.id` attribute contains the full IAM ARN in one of these formats: +For example, if a caller assumes the role `MyServiceRole`, the Cedar entity ID is: @@ -101,0 +103 @@ The `principal.id` attribute contains the full IAM ARN in one of these formats: +`AgentCore::IamEntity::"arn:aws:sts::123456789012:assumed-role/MyServiceRole"` @@ -102,0 +105 @@ The `principal.id` attribute contains the full IAM ARN in one of these formats: +This format is stable across invocations, so you can use `principal ==` for exact role matching. @@ -104 +107 @@ The `principal.id` attribute contains the full IAM ARN in one of these formats: -Use the `like` operator with wildcards to match patterns in the IAM ARN: +#### Pattern matching with `like` @@ -105,0 +109 @@ Use the `like` operator with wildcards to match patterns in the IAM ARN: +You can also use the `like` operator with wildcards for broader matching: @@ -107,5 +110,0 @@ Use the `like` operator with wildcards to match patterns in the IAM ARN: - // Match specific AWS account - principal.id like "*:123456789012:*" - - // Match specific IAM role - principal.id like "arn:aws:iam::*:role/AdminRole" @@ -114 +113,4 @@ Use the `like` operator with wildcards to match patterns in the IAM ARN: - principal.id like "arn:aws:iam::123456789012:role/*" + principal.id like "arn:aws:sts::123456789012:assumed-role/*" + + // Match specific AWS account (any ARN format) + principal.id like "*:123456789012:*" @@ -116,2 +118,2 @@ Use the `like` operator with wildcards to match patterns in the IAM ARN: - // Match assumed role sessions - principal.id like "arn:aws:sts::*:assumed-role/ServiceRole/*" + // Match a specific IAM role name across any account + principal.id like "arn:aws:sts::*:assumed-role/AdminRole"