Back to All Checks
Medium Bedrock Regional

Amazon Bedrock data sources should be encrypted with customer managed AWS KMS keys

Description

Flags Amazon Bedrock knowledge-base data sources not encrypted at rest with a customer-managed KMS key. Without a serverSideEncryptionConfiguration.kmsKeyArn the data source relies on default service encryption.

Remediation

Data sources cannot be re-encrypted in place. Recreate the data source under its knowledge base with serverSideEncryptionConfiguration.kmsKeyArn set to a customer-managed KMS key, then re-ingest the data.

Steps

  1. Open the Amazon Bedrock console and select the knowledge base, then the affected data source.
  2. Note the data source configuration (source location, chunking, parsing).
  3. Delete the data source and create a new one under the same knowledge base with serverSideEncryptionConfiguration.kmsKeyArn set to a customer-managed KMS key.
  4. Run a sync/ingestion job on the new data source to re-index the content.
Start Your Free Security Check