Amazon Bedrock data sources should be encrypted with customer managed AWS KMS keys

Flags Amazon Bedrock knowledge-base data sources not encrypted at rest with a customer-managed KMS key. Without a serverSideEncryptionConfiguration.kmsKeyArn the data source relies on default service encryption.

service: Bedrock
severity: Low
scope: evaluated in every region

How to fix it

Set at creation: fixing it means replacing the resource.

Set serverSideEncryptionConfiguration.kmsKeyArn to a KMS key you own on the data source under its knowledge base. It cannot be re-encrypted in place, so the data source is recreated and the data re-ingested, which means paying to re-embed it. The default is Bedrock's own service encryption: encrypted, with no key in your account.

In the console

Bedrock → Knowledge bases → the knowledge base → Data source → Create with a customer managed key

With the AWS CLI

aws bedrock-agent create-data-source --knowledge-base-id <id> --name <name> --data-source-configuration file://data-source.json --server-side-encryption-configuration kmsKeyArn=<kms-key-arn>

See which of your accounts this check is failing on.

Book a demo