Medium
BedrockAgentCore
Regional
Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys
Description
Flags Amazon Bedrock AgentCore Gateways not encrypted at rest with a KMS key you manage. Without a kmsKeyArn the gateway relies on the default AWS-owned key.
Remediation
Create AgentCore Gateways with a customer managed KMS key so you control the encryption key lifecycle and access policy.
Steps
- Open the Amazon Bedrock AgentCore console and go to Gateways.
- Create a new gateway (the encryption key is set at creation time).
- Under Encryption, choose a customer managed AWS KMS key.
- Grant the AgentCore service principal usage on the KMS key policy.
- Migrate targets to the new gateway and delete the unencrypted one.