AWS bedrock-agentcore medium security documentation change

Service: bedrock-agentcore · 2026-06-19 · Security-related medium

File: bedrock-agentcore/latest/devguide/batch-evaluations-encryption.md

Summary

Added CLI examples for KMS encryption during batch evaluations, including a new '--kms-key' parameter and mapped service operations to agentcore CLI commands.

Security assessment

The change explicitly documents how to enable encryption of batch evaluation results using KMS keys through both policy examples and CLI implementations, directly adding security feature documentation.

Diff

diff --git a/bedrock-agentcore/latest/devguide/batch-evaluations-encryption.md b/bedrock-agentcore/latest/devguide/batch-evaluations-encryption.md
index 0d4eb2723..2d823f312 100644
--- a//bedrock-agentcore/latest/devguide/batch-evaluations-encryption.md
+++ b//bedrock-agentcore/latest/devguide/batch-evaluations-encryption.md
@@ -83 +83 @@ The following key policy provides the minimum permissions required for batch eva
-            "StringLike": {
+            "ArnLike": {
@@ -118,0 +119,11 @@ Specify the `kmsKeyArn` parameter when calling `StartBatchEvaluation`:
+AgentCore CLI
+    
+
+With the AgentCore CLI, use the `--kms-key` option to specify a single KMS key ARN for encrypting batch evaluation results. The AgentCore CLI uses the `--kms-key` flag, which differs from the AWS CLI’s `--kms-key-arn` flag and the boto3 `kmsKeyArn` parameter.
+    
+    
+    agentcore run batch-evaluation \
+      -r MyAgent \
+      -e Builtin.Correctness \
+      --kms-key arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
+
@@ -201,0 +213,15 @@ To restore access, re-enable the key or update the key policy to grant the requi
+The batch evaluation lifecycle operations described above map to AgentCore CLI commands. The `stop` and `archive` commands target the job via the `-i, --id <id>` option. The `view batch-evaluation` command takes the ID as a positional argument:
+
+  * **StartBatchEvaluation** — `agentcore run batch-evaluation --kms-key <arn>` (use `-r/--runtime` and `-e/--evaluator`)
+
+  * **GetBatchEvaluation** — `agentcore view batch-evaluation <id>`
+
+  * **ListBatchEvaluations** — `agentcore view batch-evaluation` or `agentcore batch-evaluations history`
+
+  * **StopBatchEvaluation** — `agentcore stop batch-evaluation -i <id>`
+
+  * **DeleteBatchEvaluation** — `agentcore archive batch-evaluation -i <id>`
+
+
+
+