Amazon Bedrock uses encryption to protect data at rest and data in transit.
Encryption in transit
Within AWS, all inter-network data in transit supports TLS 1.2 encryption.
Requests to the Amazon Bedrock API and console are made over a secure (SSL) connection. You pass AWS Identity and Access Management (IAM) roles to Amazon Bedrock to provide permissions to access resources on your behalf for training and deployment.
Encryption at rest
Amazon Bedrock provides Encryption of model customization jobs and artifacts at rest.
Key management
Use the AWS Key Management Service to manage the keys that you use to encrypt your resources. For more information, see AWS Key Management Service concepts. You can encrypt the following resources with a KMS key.
-
Through Amazon Bedrock
-
Model customization jobs and their output custom models – During job creation in the console or by specifying the
customModelKmsKeyIdfield in the CreateModelCustomizationJob API call. -
Agents – During agent creation in the console or by specifying the
customerEncryptionKeyArnfield in the CreateAgent API call. -
Data source ingestion jobs for knowledge bases – During knowledge base creation in the console or by specifying the
kmsKeyArnfield in the CreateDataSource or UpdateDataSource API call. -
Vector stores in Amazon OpenSearch Service – During vector store creation. For more information, see Creating, listing, and deleting Amazon OpenSearch Service collections and Encryption of data at rest for Amazon OpenSearch Service.
-
Model evaluations jobs – When you create a model evaluation job in console or by specify a key ARN in
customerEncryptionKeyIdin the CreateEvaluationJob API call.
-
-
Through Amazon S3 – For more information, see Using server-side encryption with AWS KMS keys (SSE-KMS).
-
Training, validation, and output data for model customization
-
Data sources for knowledge bases
-
-
Through AWS Secrets Manager – For more information, see Secret encryption and decryption in AWS Secrets Manager
-
Vector stores for third-party models
-
After you encrypt a resource, you can find the ARN of the KMS key by selecting a resource and viewing its Details in the console or by using the following Get API calls.
