AWS bedrock high security documentation change

Service: bedrock · 2026-06-19 · Security-related high

File: bedrock/latest/userguide/kb-permissions.md

Summary

Added documentation for Web Crawler, Microsoft OneDrive, and Google Drive data sources including required IAM policies for accessing secrets and decrypting credentials

Security assessment

The change adds IAM policies requiring secretsmanager:GetSecretValue and kms:Decrypt permissions with strict resource constraints. This demonstrates security best practices for credential access and encryption, addressing potential unauthorized access vulnerabilities by enforcing least-privilege access to secrets and KMS keys.

Diff

diff --git a/bedrock/latest/userguide/kb-permissions.md b/bedrock/latest/userguide/kb-permissions.md
index a46f889ea..b588074fb 100644
--- a//bedrock/latest/userguide/kb-permissions.md
+++ b//bedrock/latest/userguide/kb-permissions.md
@@ -166,0 +167,6 @@ Select from the following data sources to attach the necessary permissions for t
+  * Permissions to access your Web Crawler data source
+
+  * Permissions to access your Microsoft OneDrive data source
+
+  * Permissions to access your Google Drive data source
+
@@ -331,0 +338,129 @@ JSON
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "secretsmanager:GetSecretValue"
+                ],
+                "Resource": [
+                    "arn:aws:secretsmanager:us-east-1:123456789012:secret:SecretId"
+                ]
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "kms:Decrypt"
+                ],
+                "Resource": [
+                    "arn:aws:kms:us-east-1:123456789012:key/KeyId"
+                ],
+                "Condition": {
+                    "StringLike": {
+                        "kms:ViaService": [
+                            "secretsmanager.us-east-1.amazonaws.com"
+                        ]
+                    }
+                }
+            }
+        ]
+    }
+    
+
+### Permissions to access your Web Crawler data source
+
+Attach the following policy to provide permissions for the role to access websites through the Web Crawler. If your website requires authentication, include permissions to access the AWS Secrets Manager secret that stores your credentials.
+
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "secretsmanager:GetSecretValue"
+                ],
+                "Resource": [
+                    "arn:aws:secretsmanager:us-east-1:123456789012:secret:SecretId"
+                ]
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "kms:Decrypt"
+                ],
+                "Resource": [
+                    "arn:aws:kms:us-east-1:123456789012:key/KeyId"
+                ],
+                "Condition": {
+                    "StringLike": {
+                        "kms:ViaService": [
+                            "secretsmanager.us-east-1.amazonaws.com"
+                        ]
+                    }
+                }
+            }
+        ]
+    }
+    
+
+### Permissions to access your Microsoft OneDrive data source
+
+Attach the following policy to provide permissions for the role to access Microsoft OneDrive.
+
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "secretsmanager:GetSecretValue"
+                ],
+                "Resource": [
+                    "arn:aws:secretsmanager:us-east-1:123456789012:secret:SecretId"
+                ]
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "kms:Decrypt"
+                ],
+                "Resource": [
+                    "arn:aws:kms:us-east-1:123456789012:key/KeyId"
+                ],
+                "Condition": {
+                    "StringLike": {
+                        "kms:ViaService": [
+                            "secretsmanager.us-east-1.amazonaws.com"
+                        ]
+                    }
+                }
+            }
+        ]
+    }
+    
+
+### Permissions to access your Google Drive data source
+
+Attach the following policy to provide permissions for the role to access Google Drive.
+
+JSON
+    
+