Bedrock Knowledge Base write access should be condition-scoped in IAM group inline policies

iam
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

This control checks whether your IAM group inline policies for write access to Bedrock Knowledge Base (KB) sources include appropriate security conditions to restrict access. Without these conditions, principals could inadvertently gain excessive permissions, leading to KB poisoning risks.

The control fails if the policy allows any write actions without a condition providing additional security context:

  • Actions containing:
    • bedrock:createknowledgebase
    • bedrock:updateknowledgebase
    • bedrock:deleteknowledgebase
    • bedrock:ingestknowledgebasedocuments
    • bedrock:associateagentknowledgebase
    • bedrock:disassociateagentknowledgebase
    • bedrock:deleteknowledgebasedocuments
    • bedrock:createagent
    • bedrock:updateagent
    • bedrock:deleteagent
    • bedrock:createprompt
    • bedrock:updateprompt
    • bedrock:deleteprompt
    • bedrock:createdatasource
    • bedrock:updatedatasource
    • bedrock:deletedatasource
    • bedrock:createflow
    • bedrock:updateflow
    • bedrock:deleteflow
    • bedrock:create*
    • bedrock:update*
    • bedrock:delete*
    • bedrock:modify*
    • bedrock:*
    • *

The control specifically verifies the presence of security conditions, such as aws:PrincipalArn, aws:SourceIp, aws:ResourceTag, or aws:MultiFactorAuthPresent, ensuring that access is appropriately restricted.

Remediation

See the IAM JSON Policy Elements: Condition and Managing IAM Group Inline Policies documentation for guidance on modifying inline policies to include necessary security conditions.