Encryption at rest for AgentCore Evaluations

Encryption options

Amazon Bedrock AgentCore Evaluations encrypts all data at rest by default using an AWS owned key at no additional charge. You cannot view, manage, or audit the use of this key.

You can optionally encrypt sensitive evaluator data with a customer managed key. When you specify a customer managed AWS KMS key on a custom evaluator, the service encrypts the evaluator’s instructions and rating scale using envelope encryption with the AWS Encryption SDK. All other evaluator metadata (name, level, model configuration, status) remains encrypted with the AWS owned key.

Using a customer managed key gives you more control over the encryption process, including the ability to:

For more information, see Customer managed keys in the AWS Key Management Service Developer Guide.

How AgentCore Evaluations uses a customer managed KMS key

When you specify a customer managed key on a custom evaluator, the service uses the caller’s credentials (via Forward Access Sessions) to encrypt and decrypt the evaluator’s instructions and rating scale. The caller must have kms:GenerateDataKey, kms:Decrypt, and kms:DescribeKey permissions on the key.

For online evaluation, the service decrypts evaluator instructions asynchronously using its own service principal (bedrock-agentcore.amazonaws.com). The service principal must have kms:Decrypt permission in the key policy.

Configuring a customer managed KMS key

AgentCore Evaluations supports only symmetric encryption KMS keys. The KMS key must be in the same AWS Region as the evaluator. For information about creating a symmetric KMS key, see Creating symmetric encryption KMS keys in the AWS Key Management Service Developer Guide.

Configuring permissions to use a customer managed KMS key

The following key policy provides the minimum permissions required for AgentCore Evaluations. The policy has three statements:

{
"Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCallerAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:role/MyEvaluationRole"
      },
      "Action": "kms:DescribeKey",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "bedrock-agentcore.us-east-1.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AllowCallerCryptoOps",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:role/MyEvaluationRole"
      },
      "Action": [
        "kms:GenerateDataKey",
        "kms:Decrypt"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "bedrock-agentcore.us-east-1.amazonaws.com",
          "kms:EncryptionContext:aws:bedrock-agentcore:evaluatorArn": "arn:aws:bedrock-agentcore:us-east-1:111122223333:evaluator/my-evaluator-id"
        }
      }
    },
    {
      "Sid": "AllowServicePrincipalDecrypt",
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock-agentcore.amazonaws.com"
      },
      "Action": "kms:Decrypt",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "111122223333",
          "aws:SourceArn": "arn:aws:bedrock-agentcore:us-east-1:111122223333:evaluator/my-evaluator-id"
        }
      }
    }
  ]
}

The policy contains the following statements:

Creating an evaluator with a customer managed KMS key

To encrypt a custom evaluator, specify the kmsKeyArn parameter when calling CreateEvaluator.

Changing encryption configuration on an existing evaluator

You can change the encryption configuration on an existing evaluator using UpdateEvaluator:

Scoping down access to the customer managed KMS key

You can use the encryption context to scope down access to the customer managed key. AgentCore Evaluations includes the following encryption context in all KMS operations:

{
  "aws:bedrock-agentcore:evaluatorArn": "arn:aws:bedrock-agentcore:us-east-1:111122223333:evaluator/evaluator-id"
}

You can use this encryption context in key policy conditions to restrict KMS operations to specific evaluators, as shown in the AllowCallerCryptoOps statement in the example key policy above. Note that AllowServicePrincipalDecrypt uses aws:SourceArn for scoping rather than encryption context.

Monitoring AgentCore Evaluations interaction with AWS KMS

You can use AWS CloudTrail to track the KMS API requests that AgentCore Evaluations makes on your behalf. The following CloudTrail event names appear in your logs:

In the CloudTrail log entries, the requestParameters.encryptionContext field contains aws:bedrock-agentcore:evaluatorArn with the ARN of the evaluator. For requests made by the service principal during online evaluation, the userIdentity.invokedBy field shows bedrock-agentcore.amazonaws.com.

For more information about monitoring KMS usage, see Logging AWS KMS API calls with AWS CloudTrail in the AWS Key Management Service Developer Guide.

Behavior when a key becomes unavailable

If you disable or delete your customer managed KMS key, or if the key policy no longer grants the required permissions:

To restore access, re-enable the key or update the key policy to grant the required permissions.