AWS bedrock-agentcore documentation change

Service: bedrock-agentcore · 2026-06-07 · Documentation low

File: bedrock-agentcore/latest/devguide/harness-security.md

Summary

Added IAM policy requirements for S3 skill access, updated API key provider coverage to include LiteLLM, and documented S3 bucket placeholder

Security assessment

Documents new IAM permissions (s3:GetObject, s3:ListBucket) required for secure skill retrieval from S3. Expands authentication documentation but doesn't address a specific vulnerability.

Diff

diff --git a/bedrock-agentcore/latest/devguide/harness-security.md b/bedrock-agentcore/latest/devguide/harness-security.md
index 11e36e583..ef21c1ef0 100644
--- a//bedrock-agentcore/latest/devguide/harness-security.md
+++ b//bedrock-agentcore/latest/devguide/harness-security.md
@@ -393 +393 @@ Add this policy when your harness uses a gateway configured with SigV4 inbound a
-#### API key credential provider (OpenAI, Gemini, or MCP header ARN references)
+#### Skill sources in Amazon S3 and Git
@@ -395 +395,26 @@ Add this policy when your harness uses a gateway configured with SigV4 inbound a
-Add this policy when your harness uses an API key credential provider for model providers such as OpenAI or Gemini.
+Add this policy when your harness fetches a skill from an Amazon S3 source. The execution role lists and downloads the skill objects under the bucket prefix.
+    
+    
+    {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Sid": "AgentCoreSkillS3Access",
+          "Effect": "Allow",
+          "Action": [
+            "s3:GetObject",
+            "s3:ListBucket"
+          ],
+          "Resource": [
+            "arn:aws:s3:::<skillBucket>",
+            "arn:aws:s3:::<skillBucket>/*"
+          ]
+        }
+      ]
+    }
+
+To fetch a skill from a private Git repository, the harness reads a personal access token from an API key credential provider. Grant the **API key credential provider** policy shown below for the credential provider that holds the token.
+
+#### API key credential provider (OpenAI, Gemini, LiteLLM, or MCP header ARN references)
+
+Add this policy when your harness uses an API key credential provider for model providers such as OpenAI, Gemini, or LiteLLM.
@@ -472,0 +498 @@ Placeholder | Description
+`<skillBucket>` |  The name of the S3 bucket that holds your skill files.