Use Customer-Managed Keys to Encrypt Agent Sessions

Sign in to the AWS Management Console.

Navigate to Amazon Bedrock console available at https://console.aws.amazon.com/bedrock/.

In the main navigation panel, under Builder tools, select Agents.

In the Agents section, click on the name (link) of the agent that you want to examine, available in the Name column.

In the Agent overview section, check the KMS key attribute value to identify the Amazon KMS key used to encrypt the session data for the selected Amazon Bedrock agent. If the KMS key attribute does not have a value, your Amazon Bedrock agent session data is encrypted using an AWS-managed key (default key provided by AWS) instead of using a Customer Managed Key (CMK).

Repeat steps no. 4 and 5 for each Bedrock agent available within the current AWS region.

Change the AWS cloud region from the navigation bar to repeat the Audit process for other regions.

Sign in to the AWS Management Console.

To create your own KMS Customer Managed Key (CMK), navigate to Key Management Service (KMS) console available at https://console.aws.amazon.com/kms/.

In the main navigation panel, choose Customer managed keys.

Choose Create Key to initiate the key setup process.

For Step 1 Configure key, perform the following actions:

1. Choose Symmetric for Key type.
2. Select KMS for Key usage.
3. Choose Advanced options, select KMS - recommended for Key material origin, and choose whether to allow your KMS key to be replicated into other AWS cloud regions. If Single-Region key is selected, the AWS region must match the region of your Amazon Bedrock agent.
4. Select Next to continue the key setup process.

For Step 2 Add labels, provide the following details:

1. Provide a unique name (alias) for your KMS key in the Alias box.
2. (Optional) Enter a short description in the Description box.
3. (Optional) Choose Add tag from the Tags - optional section to create any necessary tag sets. Tags can be used to categorize and identify your KMS keys and help you track your AWS costs.
4. Select Next to continue the setup.

For Step 3 Define key administrative permissions, perform the following operations:

1. For Key administrators, select which IAM users and/or roles can administer your new key through the KMS API. You may need to add additional permissions for the users or roles to administer the key from the AWS Management Console.
2. For Key deletion, choose whether to allow key administrators to delete your KMS key.
3. Select Next to continue the setup process.

For Step 4 Define key usage permissions, perform the following actions:

1. For Key users, select which IAM users and/or roles can use your KMS key in cryptographic operations.
2. (Optional) For Other AWS accounts section, specify the AWS accounts that can use your key. To configure cross-account access, choose Add another AWS account and enter the ID of the AWS cloud account that can use your KMS key for cryptographic operations. The administrators of the AWS accounts you specify at this step are responsible for managing the permissions that allow their IAM users and/or roles to use your key.
3. Select Next to continue the setup.

For Step 5 Review, review the key configuration and key policy, then choose Finish to create your new Amazon KMS Customer Managed Key (CMK).

Once your new KMS Customer Managed Key (CMK) is available, navigate to Amazon Bedrock console available at https://console.aws.amazon.com/bedrock/.

In the main navigation panel, under Builder tools, select Agents.

In the Agents section, select the Amazon Bedrock agent that you want to configure, and choose Edit.

To be able to encrypt agent sessions with your Amazon KMS Customer Managed Key (CMK), you must configure the agent service role permissions to allow Amazon Bedrock to encrypt and decrypt agent resources on your behalf. To add the necessary permissions, perform the following actions:

1. In the Agent overview section, click on the ARN (link) of the service role associated with the agent, available under Permissions, to open the role page in Amazon IAM.
2. Select the Permissions tab, choose Add permissions, select Create inline policy, choose the JSON tab, and paste the policy document listed below (JSON format). Replace \<aws-region\>, \<aws-account-id\>, \<kms-key-id\>, and \<agent-id\> with your own AWS resource information.
3. Choose Next, provide a unique name for your new inline policy in the Policy name box, and choose Create policy to create an attach the identity-based policy to your agent service role.
   	{
   		"Version": "2012-10-17",
   		"Statement": [
   			{
   				"Effect": "Allow",
   				"Action": [
   					"kms:GenerateDataKey",
   					"kms:Decrypt"
   				],
   				"Resource": "arn:aws:kms:<aws-region>:<aws-account-id>:key/<kms-key-id>",
   				"Condition": {
   					"StringEquals": {
   						"kms:EncryptionContext:aws:bedrock:arn": "arn:aws:bedrock:<aws-region>:<aws-account-id>:agent/<agent-id>"
   					}
   				}
   			}
   		]
   	}
   	

Navigate back to the Bedrock agent configuration page to apply the encryption key. In the KMS key selection section, check the Customize encryption settings (advanced) setting checkbox, and choose the ID of the Amazon KMS Customer Managed Key (CMK) created earlier in the Remediation process, from the Choose an AWS KMS key dropdown list.

Choose Save and exit to apply the configuration changes and return to the Agents listing page.

Repeat steps no. 12 - 15 for each Amazon Bedrock agent that you want to encrypt, available in the current AWS region.

Change the AWS cloud region from the navigation bar and repeat the Remediation process for other regions.