AWS bedrock: Zendesk KB data source now documents optional document-level ACLs
Summary
Removed the warning that Zendesk data sources expose all crawled content to every authenticated user and added document-level access control (ACL) as a supported, optional feature with setup step.
Security assessment
The removed text documents a concrete weakness (any authenticated KB user could read all crawled Zendesk content), and the replacement documents per-user ACL filtering of query results, which directly mitigates that over-exposure via Zendesk permissions.
Evidence
-Zendesk data sources don't support document-level access control lists (ACLs). All authenticated users who can query the knowledge base can see all crawled content.
Diff
diff --git a/bedrock/latest/userguide/kb-managed-ds-zendesk.md b/bedrock/latest/userguide/kb-managed-ds-zendesk.md index 03871f5..4e22193 100644 --- a//bedrock/latest/userguide/kb-managed-ds-zendesk.md +++ b//bedrock/latest/userguide/kb-managed-ds-zendesk.md @@ -13,4 +12,0 @@ Zendesk is a cloud-based customer service platform that helps businesses manage -###### Important - -Zendesk data sources don't support document-level access control lists (ACLs). All authenticated users who can query the knowledge base can see all crawled content. - @@ -26,0 +23,2 @@ With a Zendesk data source, you can use the following features: + * Document-level access control (ACLs) + @@ -63,0 +62,2 @@ Setting up a Zendesk data source involves the following steps: + 3. **(Optional) Enable document-level access control.** Filter query results by each user's Zendesk permissions. See [Document-level access controls](./kb-managed-ds-zendesk-acl.html). +