Logo of Trend Micro
Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Use Customer-Managed Keys to Encrypt Knowledge Base Transient Data

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: High (not acceptable risk)
Rule ID: Bedrock-005

Ensure that your Amazon Bedrock knowledge base transient data is encrypted with Amazon KMS Customer Managed Keys (CMKs) instead of AWS managed keys. This approach grants you more granular control over the data encryption at rest and helps meet compliance requirements. Once configured, while converting your data into embeddings, Amazon Bedrock will encrypt your transient data using your own KMS Customer Managed Key (CMK).

This rule resolution is part of the Conformity Security & Compliance tool for AWS.

Security
Operational
excellence

By default, while converting your data into embeddings, Amazon Bedrock encrypts your transient data with an AWS-managed key. When you use your own KMS Customer Managed Keys (CMKs) to protect your transient data, you have full control over who can use the encryption keys to access your data. This improves data security posture and compliance by adhering to strict encryption requirements for sensitive data. The Amazon KMS service allows you to easily create, rotate, disable, and audit Customer Managed Keys for your knowledge base transient data.

Audit

To obtain the encryption configuration information available for your Amazon Bedrock knowledge base transient data, perform the following operations:

Getting the encryption configuration information for knowledge base data sources via AWS Command Line Interface (CLI) is not currently supported.

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon Bedrock console available at https://console.aws.amazon.com/bedrock/.

03 In the main navigation panel, under Builder tools, select Knowledge bases.

04 Select the Knowledge bases tab to list the Amazon Bedrock knowledge bases available in the current AWS region.

05 Click on the name (link) of the knowledge base that you want to examine, available in the Name column.

06 In the Data source section, click on the name (link) of the knowledge base data source that you want to examine, available in the Data source name column.

07 In the Data source overview section, check the Serverside KMS key attribute value to identify the Amazon KMS key used to encrypt the knowledge base transient data for the selected data source. If the Serverside KMS key attribute does not have a value, the transient data for the selected knowledge base data source is encrypted using an AWS-managed key (default key provided by AWS) instead of using a Customer Managed Key (CMK).

08 Repeat steps no. 6 and 7 for each data source configured for the selected knowledge base.

09 Repeat steps no. 5 - 8 for each Amazon Bedrock knowledge base available within the current AWS region.

10 Change the AWS cloud region from the navigation bar to repeat the Audit process for other regions.

Remediation / Resolution

To encrypt your Amazon Bedrock knowledge base transient data using your own KMS Customer Master Key (CMK), you must reconfigure your knowledge base data sources, by performing the following operations:

Enabling encryption for Amazon Bedrock knowledge base transient data using AWS Command Line Interface (CLI) is not currently supported.

Using AWS Console

01 Sign in to the AWS Management Console.

02 To create your own KMS Customer Managed Key (CMK), navigate to Key Management Service (KMS) console available at https://console.aws.amazon.com/kms/.

03 In the main navigation panel, choose Customer managed keys.

04 Choose Create Key to initiate the key setup process.

05 For Step 1 Configure key, perform the following actions:

  1. Choose Symmetric for Key type.
  2. Select KMS for Key usage.
  3. Choose Advanced options, select KMS - recommended for Key material origin, and choose whether to allow your KMS key to be replicated into other AWS cloud regions. If Single-Region key is selected, the AWS region must match the region of your knowledge base data sources.
  4. Select Next to continue the key setup process.

06 For Step 2 Add labels, provide the following details:

  1. Provide a unique name (alias) for your KMS key in the Alias box.
  2. (Optional) Enter a short description in the Description box.
  3. (Optional) Choose Add tag from the Tags - optional section to create any necessary tag sets. Tags can be used to categorize and identify your KMS keys and help you track your AWS costs.
  4. Select Next to continue the setup.

07 For Step 3 Define key administrative permissions, perform the following operations:

  1. For Key administrators, select which IAM users and/or roles can administer your new key through the KMS API. You may need to add additional permissions for the users or roles to administer the key from the AWS Management Console.
  2. For Key deletion, choose whether to allow key administrators to delete your KMS key.
  3. Select Next to continue the setup process.

08 For Step 4 Define key usage permissions, perform the following actions:

  1. For Key users, select which IAM users and/or roles can use your KMS key in cryptographic operations.
  2. (Optional) For Other AWS accounts section, specify the AWS accounts that can use your key. To configure cross-account access, choose Add another AWS account and enter the ID of the AWS cloud account that can use your KMS key for cryptographic operations. The administrators of the AWS accounts you specify at this step are responsible for managing the permissions that allow their IAM users and/or roles to use your key.
  3. Select Next to continue the setup.

09 For Step 5 Review, review the key configuration and key policy, then choose Finish to create your new Amazon KMS Customer Managed Key (CMK).

10 Once your new KMS Customer Managed Key (CMK) is available, navigate to Amazon Bedrock console available at https://console.aws.amazon.com/bedrock/.

11 In the main navigation panel, under Builder tools, select Knowledge bases.

12 Select the Knowledge bases tab to list the Amazon Bedrock knowledge bases available in the current AWS cloud region.

13 Click on the name (link) of the knowledge base that you want to access, available in the Name column.

14 In the Data source section, select the knowledge base data source that you want to configure, and choose Edit.

15 Choose Advanced settings - optional, select Customize encryption settings (Advanced) under KMS Key for transient data storage, and choose the ID of the Amazon KMS Customer Managed Key (CMK) created earlier in the Remediation process, from the Choose an AWS KMS key - optional dropdown list.

16 Choose Submit to apply the configuration changes.

17 Repeat steps no. 14 - 16 for each data source configured for the selected knowledge base.

18 Repeat steps no. 13 - 17 for each Amazon Bedrock knowledge base available in the selected AWS region.

19 Change the AWS cloud region from the navigation bar to repeat the Remediation process for other regions.

References

Publication date Jun 13, 2024

Related Bedrock rules