AWS Bedrock Best Practices

Best practice rules for Amazon Bedrock

• Amazon Bedrock Service Role Policy Too Permissive

  Ensure that policies attached to Amazon Bedrock service roles adhere to the Principle of Least Privilege.

• Check for Long-Term API Keys

  To prevent credential exposure, use short-term Amazon Bedrock API keys instead of long-term API keys.

• Check for Missing Amazon Bedrock Agent Service Role

  Ensure that Amazon Bedrock agents are referencing active (available) service roles.

• Check for Missing Model Customization Job Security Groups

  Ensure that Bedrock model customization jobs are referencing active (available) VPC security groups.

• Configure Agent Idle Session Timeout

  Ensure that Amazon Bedrock Agents have an appropriate idle session timeout configured to limit the window of exposure for compromised or hijacked sessions.

• Configure Data Deletion Policy for Knowledge Base Data

  Ensure that the vector store data is retained when the knowledge base data sources are deleted.

• Configure Permissions Boundaries for IAM Identities used by Amazon Bedrock

  For enhanced security, ensure that permissions boundaries are set for IAM identities used by Amazon Bedrock.

• Configure Prompt Attack Strength for Amazon Bedrock Guardrails

  Ensure that prompt attack strength is set to HIGH for Amazon Bedrock guardrails.

• Configure Sensitive Information Filters for Amazon Bedrock Guardrails

  Ensure that sensitive information filters are configured for Amazon Bedrock guardrails.

• Cross-Service Confused Deputy Prevention

  Ensure that policies attached to Amazon Bedrock service roles are configured to prevent cross-service impersonation.

• Enable Deletion Protection for Model Invocation Log Storage

  Ensure that the Amazon S3 bucket storing Amazon Bedrock model invocation logs has versioning enabled together with MFA Delete or S3 Object Lock to prevent unauthorized deletion of log data.

• Enable Encryption for Model Invocation Log S3 Destination

  Ensure that the Amazon S3 bucket used to store Amazon Bedrock model invocation logs is encrypted with a customer-managed KMS key (CMK).

• Enable Model Invocation Logging

  Ensure that model invocation logging is enabled in the Amazon Bedrock account level settings.

• Knowledge Base Data Source Credentials Use Secrets Manager with Rotation

  Ensure that Amazon Bedrock Knowledge Base data sources connecting to external SaaS services store their credentials in AWS Secrets Manager with automatic rotation enabled.

• Protect Model Customization Jobs using a VPC

  Ensure that Bedrock model customization jobs are protected by a Virtual Private Cloud (VPC).

• Restrict Agent Action Group Lambda Functions

  Ensure that the AWS Lambda functions configured as executors for Amazon Bedrock Agent action groups use least-privilege IAM roles and belong to your own AWS account.

• Restrict Knowledge Base S3 Data Source Public Access

  Ensure that Amazon S3 buckets configured as data sources for Amazon Bedrock Knowledge Bases are not publicly accessible.

• Use Customer-Managed Keys to Encrypt Agent Sessions

  Ensure that agent session data is encrypted with Amazon KMS Customer Managed Keys (CMKs).

• Use Customer-Managed Keys to Encrypt Amazon Bedrock Guardrails

  Ensure that Bedrock guardrails are encrypted with Amazon KMS Customer Managed Keys (CMKs).

• Use Customer-Managed Keys to Encrypt Amazon Bedrock Studio Workspaces

  Ensure that Bedrock Studio workspaces are encrypted with Amazon KMS Customer Managed Keys (CMKs).

• Use Customer-Managed Keys to Encrypt Custom Models

  Ensure that AWS Bedrock custom models are encrypted with Amazon KMS Customer-Managed Keys (CMKs).

• Use Customer-Managed Keys to Encrypt Knowledge Base Transient Data

  Ensure that knowledge base transient data is encrypted with Amazon KMS Customer Managed Keys (CMKs).

• Use Guardrails to Protect Agent Sessions

  Ensure that Bedrock agent sessions are associated with guardrails for protection.

• Validate Model Invocation Log Destination Ownership

  Ensure that the Amazon S3 bucket or CloudWatch Logs log group configured as the destination for Amazon Bedrock model invocation logs belongs to the same AWS account and is not publicly accessible.