AWS bedrock: Salesforce KB data source adds OAuth 2.0 JWT Bearer and document-level ACLs
Summary
Removes the warning that Salesforce data sources have no document-level ACLs (all authenticated users could see all crawled content) and documents new OAuth 2.0 JWT Bearer authentication plus document-level access control, including prerequisites and setup steps.
Security assessment
The diff deletes the explicit warning that 'Salesforce data sources don't support document-level access control lists (ACLs). All authenticated users who can query the knowledge base can see all crawled content.' and replaces it with support for per-user ACL filtering via OAUTH2_WITH_JWT_BEARER, which checks each querying user's Salesforce permissions at query time. This directly addresses an over-exposure/authorization weakness where any authenticated user could read all crawled content.
Evidence
+ * Document-level access control (ACLs), with OAuth 2.0 JWT Bearer authentication
Diff
diff --git a/bedrock/latest/userguide/kb-managed-ds-salesforce.md b/bedrock/latest/userguide/kb-managed-ds-salesforce.md index cdb060b..63ee80d 100644 --- a//bedrock/latest/userguide/kb-managed-ds-salesforce.md +++ b//bedrock/latest/userguide/kb-managed-ds-salesforce.md @@ -7 +7 @@ -Supported featuresAuthentication methodPrerequisitesHow to set up a Salesforce data source +Supported featuresAuthentication methodsPrerequisitesHow to set up a Salesforce data source @@ -13,4 +12,0 @@ Salesforce is a cloud-based customer relationship management (CRM) platform for -###### Important - -Salesforce data sources don't support document-level access control lists (ACLs). All authenticated users who can query the knowledge base can see all crawled content. - @@ -25 +21 @@ With a Salesforce data source, you can use the following features: - * OAuth 2.0 Client Credentials (2LO) authentication + * OAuth 2.0 Client Credentials (2LO) and OAuth 2.0 JWT Bearer authentication @@ -30,0 +27,2 @@ With a Salesforce data source, you can use the following features: + * Document-level access control (ACLs), with OAuth 2.0 JWT Bearer authentication + @@ -34 +32 @@ With a Salesforce data source, you can use the following features: -## Authentication method +## Authentication methods @@ -37,0 +36,2 @@ To connect a Salesforce data source, use OAuth 2.0 Client Credentials (2LO) auth +To use document-level access control, use the `OAUTH2_WITH_JWT_BEARER` authentication type. The content crawl continues to use the Client Credentials Flow, and the connector also uses the OAuth 2.0 JWT Bearer Flow to check each querying user's access in Salesforce at query time. The `OAUTH2_WITH_JWT_BEARER` authentication type is available only when `aclEnabled` is `true`. Complete the Client Credentials setup first, and then see [Set up OAuth 2.0 JWT Bearer authentication for Salesforce document-level access controls](./kb-managed-salesforce-jwt-bearer-setup.html). + @@ -49,0 +50,2 @@ In Salesforce, make sure that you complete the following prerequisites: + * (Optional, for document-level access control) Configure the External Client App for the OAuth 2.0 JWT Bearer Flow. See [Set up OAuth 2.0 JWT Bearer authentication for Salesforce document-level access controls](./kb-managed-salesforce-jwt-bearer-setup.html). + @@ -69,0 +72,2 @@ Setting up a Salesforce data source involves the following steps: + 3. **(Optional) Enable document-level access control.** Filter query results by each user's Salesforce permissions. Requires OAuth 2.0 JWT Bearer authentication. See [Set up OAuth 2.0 JWT Bearer authentication for Salesforce document-level access controls](./kb-managed-salesforce-jwt-bearer-setup.html) and [Document-level access controls](./kb-managed-ds-salesforce-acl.html). +