Bedrock Agent not encrypted with Customer Master Key (CMK) misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_373
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Terraform, Terraform Plan

Impact

This rule detects whether the AWS Bedrock Agent is encrypted with a Customer Master Key (CMK) instead of default encryption. Using a CMK provides greater control over key management and reduces the risk of unauthorized access, thereby enhancing the data security managed by the Bedrock Agent.

How to Fix

Resource: AWS::Bedrock::Agent

• Arguments: CustomerEncryptionKeyArn

In this CloudFormation framework example, the `customer_encryption_key_arn`` parameter is added to the Bedrock Agent resource configuration, enabling the use of a Customer Master Key (CMK) for encryption. [source,go]

Resources: Pass: Type: AWS::Bedrock::Agent Properties: AgentName: test

• CustomerEncryptionKeyArn: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

---