Amazon Bedrock IDE KMS Permissions

KMS Key Policy — Amazon DataZone domain key and the Tooling blueprint Key: manually set the following key policy to the domain key and the Tooling blueprint key.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allow administrators to manage key",
            "Effect": "Allow",
            "Principal": {
                "AWS": "${ADMINISTRATOR_IAM_PRINCIPAL_ARN}"
            },
            "Action": [
                "kms:Create*",
                "kms:Describe*",
                "kms:Enable*",
                "kms:List*",
                "kms:Put*",
                "kms:Update*",
                "kms:Revoke*",
                "kms:Disable*",
                "kms:Get*",
                "kms:Delete*",
                "kms:TagResource",
                "kms:UntagResource",
                "kms:ScheduleKeyDeletion",
                "kms:CancelKeyDeletion",
                "kms:RotateKeyOnDemand"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow administrators and SageMaker domain execution role to encrypt and decrypt DataZone data",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "${ADMINISTRATOR_IAM_PRINCIPAL_ARN}",
                    "arn:aws:iam::${ACCOUNT_ID}:role/service-role/AmazonSageMakerDomainExecution"
                ]
            },
            "Action": [
                "kms:CreateGrant",
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "kms:EncryptionContext:aws:datazone:domainId": "dzd*"
                }
            }
        },
        {
            "Sid": "Allow SageMaker provisioning role to manage Amazon Bedrock resources",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::${ACCOUNT_ID}:role/service-role/AmazonSageMakerProvisioning-${ACCOUNT_ID}"
            },
            "Action": [
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:GenerateDataKey"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "kms:ViaService": [
                        "s3.*.amazonaws.com",
                        "bedrock.*.amazonaws.com"
                    ]
                }
            }
        },
        {
            "Sid": "Allow SageMaker provisioning role to create grants for Amazon Bedrock resources",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::${ACCOUNT_ID}:role/service-role/AmazonSageMakerProvisioning-${ACCOUNT_ID}"
            },
            "Action": "kms:CreateGrant",
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": "true"
                }
            }
        },
        {
            "Sid": "Allow SageMaker IAM roles to encrypt and decrypt data in tooling default S3 bucket",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::${ACCOUNT_ID}:root"
            },
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "*",
            "Condition": {
                "Null": {
                    "aws:PrincipalTag/AmazonDataZoneProject": "false"  
                },
                "StringLike": {
                    "kms:ViaService": "s3.*.amazonaws.com"
                },
                "ArnLike": {
                    "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::amazon-sagemaker*"
                }
            }
        },
        {
            "Sid": "Allow SageMaker IAM roles to encrypt and decrypt Bedrock IDE Lambda environment variables",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::${ACCOUNT_ID}:root"
            },
            "Action": [
                "kms:CreateGrant",
                "kms:Decrypt",
                "kms:Encrypt"
            ],
            "Resource": "*",
            "Condition": {
                "Null": {
                    "aws:PrincipalTag/AmazonDataZoneProject": "false"  
                },
                "StringLike": {
                    "kms:ViaService": "lambda.*.amazonaws.com"
                },
                "ArnLike": {
                    "kms:EncryptionContext:aws:lambda:FunctionArn": "arn:aws:lambda:*:*:function:amazon-bedrock-ide*"
                }
            }
        },
        {
            "Sid": "Allow SageMaker IAM roles to encrypt and decrypt Bedrock IDE secrets",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::${ACCOUNT_ID}:root"
            },
            "Action": [
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "*",
            "Condition": {
                "Null": {
                    "aws:PrincipalTag/AmazonDataZoneProject": "false"  
                },
                "StringLike": {
                    "kms:ViaService": "secretsmanager.*.amazonaws.com"
                },
                "ArnLike": {
                    "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*"
                }
            }
        },
        {
            "Sid": "Allow SageMaker IAM roles to encrypt and decrypt Amazon Bedrock data",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::${ACCOUNT_ID}:root"
            },
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "*",
            "Condition": {
                "Null": {
                    "aws:PrincipalTag/AmazonDataZoneProject": "false"  
                },
                "StringLikeIfExists": {
                    "kms:ViaService": "bedrock.*.amazonaws.com"
                },
                "ForAnyValue:StringLike": {
                    "kms:EncryptionContextKeys": [
                        "aws:bedrock*",
                        "evaluationJobArn"
                    ]
                }
            }
        },
        {
            "Sid": "Allow CloudWatch Logs to encrypt and decrypt Bedrock IDE log groups",
            "Effect": "Allow",
            "Principal": {
                "Service": "logs.amazonaws.com"
            },
            "Action": [
                "kms:Decrypt*",
                "kms:Describe*",
                "kms:Encrypt*",
                "kms:GenerateDataKey*",
                "kms:ReEncrypt*"
            ],
            "Resource": "*",
            "Condition": {
                "ArnLike": {
                    "kms:EncryptionContext:aws:logs:arn": "arn:aws:logs:*:*:log-group:/aws/lambda/amazon-bedrock-ide*"
                }
            }
        },
        {
            "Sid": "Allow Amazon Bedrock to encrypt and decrypt Amazon Bedrock data",
            "Effect": "Allow",
            "Principal": {
                "Service": "bedrock.amazonaws.com"
            },
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "*",
            "Condition": {
                "ForAnyValue:StringLike": {
                    "kms:EncryptionContextKeys": [
                        "aws:bedrock*",
                        "evaluationJobArn"
                    ]
                }
            }
        },
        {
            "Sid": "Allow Amazon Bedrock to create and revoke grants for Amazon Bedrock resources",
            "Effect": "Allow",
            "Principal": {
                "Service": "bedrock.amazonaws.com"
            },
            "Action": [
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:RevokeGrant"
            ],
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": "true"
                }
            }
        }
    ]
}
        

AmazonSageMakerDomainExecution role — inline Policy: manually attach the following to the AmazonSageMakerDomainExecution role or any role that is used for domain execution role in IAM console.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "KmsDescribeKeyPermissions",
            "Effect": "Allow",
            "Action": "kms:DescribeKey",
            "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${DOMAIN_KEY_ID}",
        },
        {
            "Sid": "KmsPermissions",
            "Effect": "Allow",
            "Action": [
                "kms:CreateGrant",
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${DOMAIN_KEY_ID}",
            "Condition": {
                "StringLike": {
                    "kms:EncryptionContext:aws:datazone:domainId": "dzd*"
                }
            }
        }
    ]
}

AmazonSageMakerProvisioning-<domainAccountId> role - inline Policy: manually attach the following to the AmazonSageMakerProvisioning-<domainAccountId> role or the role that is used as the provisioning role in the IAM console.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "KmsDescribeKeyPermissions",
            "Effect": "Allow",
            "Action": "kms:DescribeKey",
            "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}"
        },
        {
            "Sid": "ToolingDefaultS3BucketKmsPermissions",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}",
            "Condition": {
                "StringLike": {
                    "kms:ViaService": "s3.*.amazonaws.com"
                },
                "ArnLike": {
                    "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::amazon-sagemaker*"
                }
            }
        },
        {
            "Sid": "LambdaFunctionKmsPermissions",
            "Effect": "Allow",
            "Action": [
                "kms:CreateGrant",
                "kms:Decrypt",
                "kms:Encrypt"
            ],
            "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}",
            "Condition": {
                "StringLike": {
                    "kms:ViaService": "lambda.*.amazonaws.com"
                },
                "ArnLike": {
                    "kms:EncryptionContext:aws:lambda:FunctionArn": "arn:aws:lambda:*:*:function:amazon-bedrock-ide*"
                }
            }
        },
        {
            "Sid": "SecretsManagerKmsPermissions",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}",
            "Condition": {
                "StringLike": {
                    "kms:ViaService": "secretsmanager.*.amazonaws.com"
                },
                "ArnLike": {
                    "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock-ide/*"
                }
            }
        },
        {
            "Sid": "BedrockKmsPermissions",
            "Effect": "Allow",
            "Action": [
                "kms:CreateGrant",
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}",
            "Condition": {
                "StringLike": {
                    "kms:ViaService": "bedrock.*.amazonaws.com"
                },
                "ForAnyValue:StringLike": {
                    "kms:EncryptionContextKeys": "aws:bedrock*:arn"
                }
            }
        }
    ]
}