Enable Encryption for Model Invocation Log S3 Destination

Sign in to the AWS Management Console.

Navigate to Amazon Bedrock console available at https://console.aws.amazon.com/bedrock/.

In the main navigation panel, select Settings to access the account level settings available for Amazon Bedrock.

In the Model invocation logging section, verify that the Model invocation logging toggle switch is enabled and that an S3 location is configured under Select the logging destinations. Note the destination bucket name.

Navigate to the Amazon S3 console at https://console.aws.amazon.com/s3/ and click on the name of the log destination bucket identified at the previous step to access the bucket configuration settings.

Select the Properties tab from the console menu to access the bucket properties.

In the Default encryption section, check the Encryption type value to determine the Server-Side Encryption (SSE) configuration used by the log destination bucket:

1. If the Encryption type is set to Server-side encryption with Amazon S3 managed keys (SSE-S3), the destination bucket is encrypted with an Amazon S3-managed key, therefore the encryption configuration for the log destination bucket is not compliant.
2. If the Encryption type is set to Server-side encryption with AWS Key Management Service keys (SSE-KMS) but the AWS KMS key value is aws/s3 (i.e. the default key managed by the KMS service for Amazon S3), the encryption configuration for the log destination bucket is not compliant.
3. If the Encryption type is set to Server-side encryption with AWS Key Management Service keys (SSE-KMS) and the AWS KMS key value references a customer-managed CMK from your account, the encryption configuration for the log destination bucket is compliant.

Change the AWS cloud region from the console navigation bar and repeat steps no. 3 – 7 for each region where Amazon Bedrock model invocation logging is configured with an Amazon S3 destination.

Run get-model-invocation-logging-configuration command (OSX/Linux/UNIX) with custom output filters to return the name of the Amazon S3 bucket configured as the destination for Amazon Bedrock model invocation logging in the selected AWS region:

aws bedrock get-model-invocation-logging-configuration
--region us-east-1
--query 'loggingConfig.s3Config.bucketName'

The command output should return the requested S3 bucket name:

"cc-bedrock-invocation-logs"

If the output returns null, model invocation logging is not configured with an Amazon S3 destination in the selected region and there is no destination bucket to validate.

Run get-bucket-encryption command (OSX/Linux/UNIX) using the name of the log destination bucket returned at the previous step as the identifier and custom query filters to return the Server-Side Encryption (SSE) configuration used by the selected S3 bucket:

aws s3api get-bucket-encryption
--bucket cc-bedrock-invocation-logs
--query 'ServerSideEncryptionConfiguration.Rules[*].ApplyServerSideEncryptionByDefault'

The command output should return one of the following results:

1. If the command output returns "SSEAlgorithm": "AES256", as shown in the example below, the log destination bucket is configured to use Server-Side Encryption with an Amazon S3-managed key (SSE-S3), therefore the encryption configuration for the log destination bucket is not compliant:

   [
       {
           "SSEAlgorithm": "AES256"
       }
   ]
   

2. If the command output returns "aws:kms" as the value for the "SSEAlgorithm" attribute but the Amazon Resource Name (ARN) referenced by the "KMSMasterKeyID" attribute is "arn:aws:kms:us-east-1:<aws-account-id>:alias/aws/s3" (i.e. the default AWS-managed key for Amazon S3), the encryption configuration for the log destination bucket is not compliant:

   [
       {
           "SSEAlgorithm": "aws:kms",
           "KMSMasterKeyID": "arn:aws:kms:us-east-1:<aws-account-id>:alias/aws/s3"
       }
   ]
   

3. If the command output returns "aws:kms" as the value for the "SSEAlgorithm" attribute and the "KMSMasterKeyID" attribute references a customer-managed CMK from your account (i.e. a key/<key-id> ARN), as shown in the example below, the encryption configuration for the log destination bucket is compliant:

   [
       {
           "SSEAlgorithm": "aws:kms",
           "KMSMasterKeyID": "arn:aws:kms:us-east-1:123456789012:key/abcdabcd-1234-abcd-1234-abcd1234abcd"
       }
   ]
   

Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 4 for each region where Amazon Bedrock model invocation logging is configured with an Amazon S3 destination.

Sign in to the AWS Management Console.

Navigate to Amazon S3 console at https://console.aws.amazon.com/s3/.

Click on the name of the Amazon Bedrock log destination bucket that you want to reconfigure (see Audit section part I to identify the right resource).

Select the Properties tab from the console menu to access the bucket properties.

In the Default encryption section, choose Edit to modify the Server-Side Encryption (SSE) feature configuration.

Within the Default encryption section, perform the following actions:

1. For Encryption type, select Server-side encryption with AWS Key Management Service keys (SSE-KMS) to encrypt your log objects using an encryption key protected by AWS Key Management Service.
2. For AWS KMS key, select Choose from your AWS KMS keys and choose your customer-managed CMK from the dropdown list, or select Enter AWS KMS key ARN and provide the ARN of the customer-managed CMK that you want to use.
3. (Optional) For Bucket Key, select Enable to configure the S3 bucket to use an S3 Bucket Key and reduce the cost of SSE-KMS requests.
4. Choose Save changes to apply the configuration changes.

Change the AWS cloud region from the console navigation bar and repeat steps no. 3 – 6 for each region where a non-compliant model invocation log destination bucket is configured.

Define the configuration parameters required for the put-bucket-encryption command. Save the following parameters to a JSON file named sse-kms-config.json (replace the highlighted key ARN with the ARN of your own customer-managed CMK):

{
    "Rules": [
        {
            "ApplyServerSideEncryptionByDefault": {
                "KMSMasterKeyID": "arn:aws:kms:us-east-1:123456789012:key/abcdabcd-1234-abcd-1234-abcd1234abcd",
                "SSEAlgorithm": "aws:kms"
            },
            "BucketKeyEnabled": true
        }
    ]
}

Run put-bucket-encryption command (OSX/Linux/UNIX) using the name of the log destination bucket that you want to reconfigure as the identifier (see Audit section part II to identify the right resource) and the configuration parameters defined at the previous step (i.e. sse-kms-config.json), to enable Server-Side Encryption with a customer-managed CMK for the selected S3 bucket (the command does not produce an output):

aws s3api put-bucket-encryption
--bucket cc-bedrock-invocation-logs
--server-side-encryption-configuration file://sse-kms-config.json

Change the AWS cloud region by updating the destination bucket and repeat steps no. 1 and 2 for each region where a non-compliant model invocation log destination bucket is configured.