View a markdown version of this page

IAM permissions for user-managed setup (3LO) - Amazon Bedrock
Amazon Bedrock permissions for the sign-in flowAWS Secrets Manager permissions for the generated secretCombined policy example

IAM permissions for user-managed setup (3LO)

With user-managed setup (3LO), you sign in to a third-party data source (such as SharePoint, OneDrive, or Confluence) directly from the Amazon Bedrock Knowledge Bases console, and Amazon Bedrock Managed Knowledge Base handles authentication. To complete this flow, the IAM principal that starts the sign-in must be able to request the authorization URL and exchange the resulting code for a token. The principal must also be able to create the AWS Secrets Manager secret that stores the token. This page describes the IAM permissions you must grant to that principal.

Note

The permissions on this page apply to the console user who initiates user-managed setup (3LO). They are separate from the permissions granted to the knowledge base execution role, which needs read and write access to the secret for token refresh. For the execution role permissions, see the connector-specific setup pages, such as User-managed setup (3LO), User-managed setup (3LO), or User-managed setup (3LO).

Amazon Bedrock permissions for the sign-in flow

You need the following Amazon Bedrock permissions to start the user-managed setup (3LO) sign-in flow. Amazon Bedrock uses GetDataSourceAuthorizationUrl to build the third-party authorization URL that opens in the sign-in popup. It uses CreateDataSourceToken to exchange the authorization code for a token after you authorize the connection.

{
    "Version": "2012-10-17",
    "Statement": [{
        "Sid": "BedrockManagedKb3LO",
        "Effect": "Allow",
        "Action": [
            "bedrock:GetDataSourceAuthorizationUrl",
            "bedrock:CreateDataSourceToken"
        ],
        "Resource": "*"
    }]
}

AWS Secrets Manager permissions for the generated secret

When you sign in, Amazon Bedrock Managed Knowledge Base creates a secret in your AWS account to store the 3LO refresh token. You need secretsmanager:CreateSecret permission on the secrets that Amazon Bedrock creates.

When you choose Sign in, you can optionally provide a secret name prefix. Amazon Bedrock Managed Knowledge Base includes this prefix in the generated secret ARN. With a prefix, you can scope the Resource element to only the secrets that Amazon Bedrock creates for user-managed setup. If you do not provide a prefix, Amazon Bedrock uses default as the prefix.

The generated secret ARN follows this pattern:

arn:aws:secretsmanager:region:account-id:secret:bedrock-managedkb-oauth/your-prefix/connector-type/uuid

Attach the following policy to grant secretsmanager:CreateSecret scoped to secrets with your prefix:

{
    "Version": "2012-10-17",
    "Statement": [{
        "Sid": "BedrockManagedKb3LOCreateSecret",
        "Effect": "Allow",
        "Action": [
            "secretsmanager:CreateSecret"
        ],
        "Resource": [
            "arn:aws:secretsmanager:region:account-id:secret:bedrock-managedkb-oauth/your-prefix/*"
        ]
    }]
}
Note

If you do not provide a secret name prefix, replace the your-prefix segment in the Resource element with default, so that it scopes to arn:aws:secretsmanager:region:account-id:secret:bedrock-managedkb-oauth/default/*.

Combined policy example

The following policy combines the Amazon Bedrock and AWS Secrets Manager permissions that the console user needs to complete user-managed setup (3LO):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BedrockManagedKb3LO",
            "Effect": "Allow",
            "Action": [
                "bedrock:GetDataSourceAuthorizationUrl",
                "bedrock:CreateDataSourceToken"
            ],
            "Resource": "*"
        },
        {
            "Sid": "BedrockManagedKb3LOCreateSecret",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:CreateSecret"
            ],
            "Resource": [
                "arn:aws:secretsmanager:region:account-id:secret:bedrock-managedkb-oauth/your-prefix/*"
            ]
        }
    ]
}