All checks
Low
Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys
Flags Amazon Bedrock AgentCore Gateways not encrypted at rest with a KMS key you manage. Without a kmsKeyArn the gateway relies on the default AWS-owned key.
- service
- BedrockAgentCore
- severity
- Low
- scope
- evaluated in every region
How to fix it
Set at creation: fixing it means replacing the resource.
Set kmsKeyArn to a KMS key you own when creating the gateway. It cannot be added afterwards, so an existing gateway is replaced. The default is an AWS-owned key, which is encrypted but holds no key you can see, write a policy for, or disable. A gateway stores its target configuration and credentials rather than user data.
In the console
Bedrock AgentCore → Gateways → Create → Encryption → customer managed key
With the AWS CLI
aws bedrock-agentcore-control create-gateway --name <name> --role-arn <gateway-role-arn> --protocol-type MCP --authorizer-type CUSTOM_JWT --kms-key-arn <kms-key-arn>See which of your accounts this check is failing on.
Book a demo