All checks
Low
Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys
Flags Amazon Bedrock AgentCore Memory resources that are not encrypted at rest with a KMS key you manage. Without an encryptionKeyArn the memory relies on the default AWS-owned key.
- service
- BedrockAgentCore
- severity
- Low
- scope
- evaluated in every region
How to fix it
Set at creation: fixing it means replacing the resource.
Set encryptionKeyArn to a KMS key you own when creating the memory resource. It cannot be added afterwards, so an existing resource is replaced. The default is an AWS-owned key, which is encrypted but holds no key you can see, write a policy for, or disable.
In the console
Bedrock AgentCore → Memory → Create → Encryption → customer managed key
With the AWS CLI
aws bedrock-agentcore-control create-memory --name <name> --event-expiry-duration 30 --encryption-key-arn <kms-key-arn>See which of your accounts this check is failing on.
Book a demo