Skip to content

Commit 530369e

Browse files
cyphronixcyphronix
committed
update README.md file
1 parent df55394 commit 530369e

File tree

1 file changed

+85
-0
lines changed
  • aws_sra_examples/solutions/genai/bedrock_org

1 file changed

+85
-0
lines changed

‎aws_sra_examples/solutions/genai/bedrock_org/README.md‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,11 @@ aws cloudformation create-stack \
102102
ParameterKey=pBedrockPromptInjectionFilterParams,ParameterValue='"{\"deploy\": \"true\", \"accounts\": [\"222222222222\",\"333333333333\"], \"regions\": [\"us-east-1\"], \"filter_params\": {\"log_group_name\": \"model-invocation-log-group\", \"input_path\": \"input.inputBodyJson.messages[0].content\"}}"' \
103103
ParameterKey=pBedrockSensitiveInfoFilterParams,ParameterValue='"{\"deploy\": \"true\", \"accounts\": [\"222222222222\",\"333333333333\"], \"regions\": [\"us-east-1\"], \"filter_params\": {\"log_group_name\": \"model-invocation-log-group\", \"input_path\": \"input.inputBodyJson.messages[0].content\"}}"' \
104104
ParameterKey=pBedrockCentralObservabilityParams,ParameterValue='"{\"deploy\": \"true\", \"bedrock_accounts\": [\"222222222222\",\"333333333333\"], \"regions\": [\"us-east-1\"]}"' \
105+
ParameterKey=pBedrockKBLoggingRuleParams,ParameterValue='"{\"deploy\": \"true\", \"accounts\": [\"222222222222\",\"333333333333\"], \"regions\": [\"us-east-1\",\"us-west-2\"], \"input_params\": {}}"' \
106+
ParameterKey=pBedrockKBIngestionEncryptionRuleParams,ParameterValue='"{\"deploy\": \"true\", \"accounts\": [\"222222222222\",\"333333333333\"], \"regions\": [\"us-east-1\",\"us-west-2\"], \"input_params\": {}}"' \
107+
ParameterKey=pBedrockKBS3BucketRuleParams,ParameterValue='"{\"deploy\": \"true\", \"accounts\": [\"222222222222\",\"333333333333\"], \"regions\": [\"us-east-1\",\"us-west-2\"], \"input_params\": {\"check_retention\": \"true\", \"check_encryption\": \"true\", \"check_access_logging\": \"true\", \"check_object_locking\": \"true\", \"check_versioning\": \"true\"}}"' \
108+
ParameterKey=pBedrockKBVectorStoreSecretRuleParams,ParameterValue='"{\"deploy\": \"true\", \"accounts\": [\"222222222222\",\"333333333333\"], \"regions\": [\"us-east-1\",\"us-west-2\"], \"input_params\": {}}"' \
109+
ParameterKey=pBedrockKBOpenSearchEncryptionRuleParams,ParameterValue='"{\"deploy\": \"true\", \"accounts\": [\"222222222222\",\"333333333333\"], \"regions\": [\"us-east-1\",\"us-west-2\"], \"input_params\": {}}"' \
105110
--capabilities CAPABILITY_NAMED_IAM
106111
```
107112

@@ -139,6 +144,11 @@ Please read the following notes before deploying the stack to ensure successful
139144
| CloudWatch Endpoint Validation | Ensures proper CloudWatch VPC endpoint setup | [pBedrockCWEndpointsRuleParams](#pbedrockcwendpointsruleparams) |
140145
| S3 Endpoint Validation | Ensures proper S3 VPC endpoint setup | [pBedrockS3EndpointsRuleParams](#pbedrocks3endpointsruleparams) |
141146
| Guardrail Encryption | Validates KMS encryption for Bedrock guardrails | [pBedrockGuardrailEncryptionRuleParams](#pbedrockguardrailencryptionruleparams) |
147+
| Knowledge Base Logging | Validates logging configuration for Bedrock Knowledge Base | [pBedrockKBLoggingRuleParams](#pbedrockkbloggingruleparams) |
148+
| Knowledge Base Ingestion Encryption | Validates encryption for Knowledge Base data ingestion | [pBedrockKBIngestionEncryptionRuleParams](#pbedrockkbingestionencryptionruleparams) |
149+
| Knowledge Base S3 Bucket | Validates S3 bucket configurations for Knowledge Base | [pBedrockKBS3BucketRuleParams](#pbedrockkbs3bucketruleparams) |
150+
| Knowledge Base Vector Store Secret | Validates vector store secret configuration | [pBedrockKBVectorStoreSecretRuleParams](#pbedrockkbvectorstoresecretruleparams) |
151+
| Knowledge Base OpenSearch Encryption | Validates OpenSearch encryption configuration | [pBedrockKBOpenSearchEncryptionRuleParams](#pbedrockkbopensearchencryptionruleparams) |
142152

143153
> **Important Note**: The Config rule Lambda execution role needs to have access to any KMS keys used to encrypt Bedrock guardrails. Make sure to grant the appropriate KMS key permissions to the Lambda role to ensure proper evaluation of encrypted guardrail configurations.
144154
@@ -155,6 +165,15 @@ Please read the following notes before deploying the stack to ensure successful
155165
|-----------------|-------------|----------------|
156166
| Central Observability | Configures cross-account/region metric aggregation | [pBedrockCentralObservabilityParams](#pbedrockcentralobservabilityparams) |
157167

168+
### Bedrock Knowledge Base
169+
| Security Control | Description | JSON Parameter |
170+
|-----------------|-------------|----------------|
171+
| KB Logging | Validates logging configuration for Bedrock Knowledge Base | [pBedrockKBLoggingRuleParams](#pbedrockkbloggingruleparams) |
172+
| KB Ingestion Encryption | Validates encryption configuration for Bedrock Knowledge Base | [pBedrockKBIngestionEncryptionRuleParams](#pbedrockkbingestionencryptionruleparams) |
173+
| KB S3 Bucket | Validates S3 bucket configuration for Bedrock Knowledge Base | [pBedrockKBS3BucketRuleParams](#pbedrockkbs3bucketruleparams) |
174+
| KB Vector Store Secret | Validates secret configuration for Bedrock Knowledge Base | [pBedrockKBVectorStoreSecretRuleParams](#pbedrockkbvectorstoresecretruleparams) |
175+
| KB OpenSearch Encryption | Validates encryption configuration for Bedrock Knowledge Base | [pBedrockKBOpenSearchEncryptionRuleParams](#pbedrockkbopensearchencryptionruleparams) |
176+
158177
---
159178
## JSON Parameters
160179

@@ -367,6 +386,72 @@ This section explains the parameters in the CloudFormation template that require
367386
}
368387
```
369388

389+
### `pBedrockKBLoggingRuleParams`
390+
- **Purpose**: Validates logging configuration for Bedrock Knowledge Base.
391+
- **Structure**:
392+
```json
393+
{
394+
"deploy": "true|false",
395+
"accounts": ["account_id1", "account_id2"],
396+
"regions": ["region1", "region2"],
397+
"input_params": {}
398+
}
399+
```
400+
401+
### `pBedrockKBIngestionEncryptionRuleParams`
402+
- **Purpose**: Validates encryption configuration for Bedrock Knowledge Base.
403+
- **Structure**:
404+
```json
405+
{
406+
"deploy": "true|false",
407+
"accounts": ["account_id1", "account_id2"],
408+
"regions": ["region1", "region2"],
409+
"input_params": {}
410+
}
411+
```
412+
413+
### `pBedrockKBS3BucketRuleParams`
414+
- **Purpose**: Validates S3 bucket configuration for Bedrock Knowledge Base.
415+
- **Structure**:
416+
```json
417+
{
418+
"deploy": "true|false",
419+
"accounts": ["account_id1", "account_id2"],
420+
"regions": ["region1", "region2"],
421+
"input_params": {
422+
"check_retention": "true|false",
423+
"check_encryption": "true|false",
424+
"check_access_logging": "true|false",
425+
"check_object_locking": "true|false",
426+
"check_versioning": "true|false"
427+
}
428+
}
429+
```
430+
431+
### `pBedrockKBVectorStoreSecretRuleParams`
432+
- **Purpose**: Validates secret configuration for Bedrock Knowledge Base.
433+
- **Structure**:
434+
```json
435+
{
436+
"deploy": "true|false",
437+
"accounts": ["account_id1", "account_id2"],
438+
"regions": ["region1", "region2"],
439+
"input_params": {}
440+
}
441+
```
442+
443+
### `pBedrockKBOpenSearchEncryptionRuleParams`
444+
- **Purpose**: Validates encryption configuration for Bedrock Knowledge Base.
445+
- **Structure**:
446+
```json
447+
{
448+
"deploy": "true|false",
449+
"accounts": ["account_id1", "account_id2"],
450+
"regions": ["region1", "region2"],
451+
"input_params": {}
452+
}
453+
```
454+
370455
---
371456
## References
372457
- [AWS SRA Generative AI Deep-Dive](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/gen-ai-sra.html)

0 commit comments

Comments
 (0)