Medium
BedrockAgentCore
Regional
Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys
Description
Flags Amazon Bedrock AgentCore Memory resources that are not encrypted at rest with a KMS key you manage. Without an encryptionKeyArn the memory relies on the default AWS-owned key.
Remediation
Create AgentCore Memory resources with a customer managed KMS key so you control the encryption key lifecycle and access policy.
Steps
- Open the Amazon Bedrock AgentCore console and go to Memory.
- Create a new memory resource (the encryption key is set at creation time).
- Under Encryption, choose a customer managed AWS KMS key.
- Grant the AgentCore service principal usage on the KMS key policy.
- Migrate workloads to the new memory resource and delete the unencrypted one.