Configure Data Deletion Policy for Knowledge Base Data

Sign in to the AWS Management Console.

Navigate to Amazon Bedrock console available at https://console.aws.amazon.com/bedrock/.

In the main navigation panel, under Build, select Knowledge bases.

Select the Knowledge bases tab to list the Amazon Bedrock knowledge bases available in the current AWS region.

Click on the name (link) of the knowledge base that you want to examine, available in the Name column.

In the Data source section, click on the name (link) of the knowledge base data source that you want to examine, available in the Data source name column.

In the Data source overview section, check the Data deletion policy attribute value to determine the deletion policy configured for the selected data source. If the Data deletion policy attribute value is set to DELETE, the vector store data is not retained after the selected Amazon Bedrock knowledge base data source is deleted.

Repeat steps no. 6 and 7 for each data source configured for the selected knowledge base.

Repeat steps no. 5 - 8 for each Amazon Bedrock knowledge base available within the current AWS region.

Change the AWS cloud region from the navigation bar to repeat the Audit process for other regions.

Run list-knowledge-bases command (OSX/Linux/UNIX) to list the identifier (ID) of each Amazon Bedrock knowledge base available in the selected AWS cloud region:

aws bedrock-agent list-knowledge-bases
--region us-east-1
--query 'knowledgeBaseSummaries[*].knowledgeBaseId'

The command output should return the requested knowledge base identifiers (IDs):

[
    "ABCDACBDAB"
]

Run list-data-sources command (OSX/Linux/UNIX) using the ID of the knowledge base that you want to examine as the identifier parameter to list the identifier (ID) of each data source configured for the selected knowledge base:

aws bedrock-agent list-data-sources
--region us-east-1
--knowledge-base-id ABCDACBDAB
--query 'dataSourceSummaries[*].dataSourceId'

The command output should return the requested data source identifiers (IDs). Note that list-data-sources does not return the data deletion policy value — this can only be retrieved through the get-data-source command below:

[
    "MNOP9012QR"
]

Run get-data-source command (OSX/Linux/UNIX) using the IDs of the knowledge base and the data source that you want to examine as identifier parameters and output query filters to describe the data deletion policy configured for the selected data source:

aws bedrock-agent get-data-source
--region us-east-1
--knowledge-base-id ABCDACBDAB
--data-source-id MNOP9012QR
--query 'dataSource.dataDeletionPolicy'

The command output should return the configured data deletion policy value:

"DELETE"

If the get-data-source command output returns "DELETE", the vector store data is not retained after the selected Amazon Bedrock knowledge base data source is deleted, therefore the data deletion policy configuration is not compliant.

Repeat steps no. 3 - 6 for each Amazon Bedrock knowledge base available in the selected AWS region.

Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 - 7 to perform the Audit process for other regions.

Sign in to the AWS Management Console.

Navigate to Amazon Bedrock console available at https://console.aws.amazon.com/bedrock/.

In the main navigation panel, under Build, select Knowledge bases.

Select the Knowledge bases tab to list the Amazon Bedrock knowledge bases available in the current AWS cloud region.

Click on the name (link) of the knowledge base that you want to access, available in the Name column.

In the Data source section, select the knowledge base data source that you want to configure, and choose Edit to change the data source deletion policy.

Choose Advanced settings - optional, and select Retain from the Data deletion policy dropdown list, to set the data deletion policy to "RETAIN" for the selected Amazon Bedrock knowledge base data source.

Choose Submit to apply the configuration changes.

Repeat steps no. 6 - 8 for each data source configured for the selected knowledge base.

Repeat steps no. 5 - 9 for each Amazon Bedrock knowledge base available in the selected AWS region.

Change the AWS cloud region from the navigation bar to repeat the Remediation process for other regions.

Run get-data-source command (OSX/Linux/UNIX) to retrieve the current configuration of the data source that you want to reconfigure (see Audit section part II to identify the right resource):

aws bedrock-agent get-data-source
--region us-east-1
--knowledge-base-id ABCDACBDAB
--data-source-id MNOP9012QR
--query 'dataSource.[name,dataSourceConfiguration]'

The command output should return the data source name and configuration required for the update command:

[
    "cc-bedrock-kb-datasource",
    {
        "type": "S3",
        "s3Configuration": {
            "bucketArn": "arn:aws:s3:::cc-bedrock-kb-data"
        }
    }
]

Run update-data-source command (OSX/Linux/UNIX) using the knowledge base ID, data source ID, name, and data source configuration retrieved at the previous step to update the data deletion policy to "RETAIN". Note: The update-data-source command overwrites all fields, so you must pass the existing values for --name and --data-source-configuration alongside the changed --data-deletion-policy to avoid accidentally clearing those fields:

aws bedrock-agent update-data-source
--region us-east-1
--knowledge-base-id ABCDACBDAB
--data-source-id MNOP9012QR
--name cc-bedrock-kb-datasource
--data-source-configuration '{"type":"S3","s3Configuration":{"bucketArn":"arn:aws:s3:::cc-bedrock-kb-data"}}'
--data-deletion-policy RETAIN

The command output should return the updated data source configuration confirming the new data deletion policy value:

{
    "dataSource": {
        "knowledgeBaseId": "ABCDACBDAB",
        "dataSourceId": "MNOP9012QR",
        "name": "cc-bedrock-kb-datasource",
        "dataSourceConfiguration": {
            "type": "S3",
            "s3Configuration": {
                "bucketArn": "arn:aws:s3:::cc-bedrock-kb-data"
            }
        },
        "dataDeletionPolicy": "RETAIN"
    }
}

Repeat steps no. 1 - 4 for each Amazon Bedrock knowledge base data source that you want to configure, available in the selected AWS region.

Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 - 5 to perform the Remediation process for other regions.