Skip to content

Commit 0f5ca36

Browse files
vma1996vma1996
authored
chore: remove workload access permissions from runtime execution policy (#274)
1 parent 4599529 commit 0f5ca36

File tree

3 files changed

+125
-144
lines changed

3 files changed

+125
-144
lines changed

‎documentation/docs/user-guide/runtime/permissions.md‎

Lines changed: 125 additions & 128 deletions
Original file line numberDiff line numberDiff line change
@@ -61,121 +61,131 @@ Attach the following policy to your IAM user or role:
6161

6262
```json
6363
{
64-
"Version": "2012-10-17",
65-
"Statement": [
66-
{
67-
"Sid": "IAMRoleManagement",
68-
"Effect": "Allow",
69-
"Action": [
70-
"iam:CreateRole",
71-
"iam:DeleteRole",
72-
"iam:GetRole",
73-
"iam:PutRolePolicy",
74-
"iam:DeleteRolePolicy",
75-
"iam:AttachRolePolicy",
76-
"iam:DetachRolePolicy",
77-
"iam:TagRole",
78-
"iam:ListRolePolicies",
79-
"iam:ListAttachedRolePolicies"
80-
],
81-
"Resource": [
82-
"arn:aws:iam::*:role/*BedrockAgentCore*",
83-
"arn:aws:iam::*:role/service-role/*BedrockAgentCore*"
84-
]
85-
},
86-
{
87-
"Sid": "CodeBuildProjectAccess",
88-
"Effect": "Allow",
89-
"Action": [
90-
"codebuild:StartBuild",
91-
"codebuild:BatchGetBuilds",
92-
"codebuild:ListBuildsForProject",
93-
"codebuild:CreateProject",
94-
"codebuild:UpdateProject",
95-
"codebuild:BatchGetProjects"
96-
],
97-
"Resource": [
98-
"arn:aws:codebuild:*:*:project/bedrock-agentcore-*",
99-
"arn:aws:codebuild:*:*:build/bedrock-agentcore-*"
100-
]
101-
},
102-
{
103-
"Sid": "CodeBuildListAccess",
104-
"Effect": "Allow",
105-
"Action": [
106-
"codebuild:ListProjects"
107-
],
108-
"Resource": "*"
109-
},
110-
{
111-
"Sid": "IAMPassRoleAccess",
112-
"Effect": "Allow",
113-
"Action": [
114-
"iam:PassRole"
115-
],
116-
"Resource": [
117-
"arn:aws:iam::*:role/AmazonBedrockAgentCore*",
118-
"arn:aws:iam::*:role/service-role/AmazonBedrockAgentCore*"
119-
]
120-
},
121-
{
122-
"Sid": "CloudWatchLogsAccess",
123-
"Effect": "Allow",
124-
"Action": [
125-
"logs:GetLogEvents",
126-
"logs:DescribeLogGroups",
127-
"logs:DescribeLogStreams"
128-
],
129-
"Resource": [
130-
"arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/*",
131-
"arn:aws:logs:*:*:log-group:/aws/codebuild/*"
132-
]
133-
},
134-
{
135-
"Sid": "S3Access",
136-
"Effect": "Allow",
137-
"Action": [
138-
"s3:GetObject",
139-
"s3:PutObject",
140-
"s3:ListBucket",
141-
"s3:CreateBucket",
142-
"s3:PutLifecycleConfiguration"
143-
],
144-
"Resource": [
145-
"arn:aws:s3:::bedrock-agentcore-*",
146-
"arn:aws:s3:::bedrock-agentcore-*/*"
147-
]
148-
},
149-
{
150-
"Sid": "ECRRepositoryAccess",
151-
"Effect": "Allow",
152-
"Action": [
153-
"ecr:CreateRepository",
154-
"ecr:DescribeRepositories",
155-
"ecr:GetRepositoryPolicy",
156-
"ecr:InitiateLayerUpload",
157-
"ecr:CompleteLayerUpload",
158-
"ecr:PutImage",
159-
"ecr:UploadLayerPart",
160-
"ecr:BatchCheckLayerAvailability",
161-
"ecr:GetDownloadUrlForLayer",
162-
"ecr:BatchGetImage",
163-
"ecr:ListImages",
164-
"ecr:TagResource"
165-
],
166-
"Resource": [
167-
"arn:aws:ecr:*:*:repository/bedrock-agentcore-*"
168-
]
169-
},
170-
{
171-
"Sid": "ECRAuthorizationAccess",
172-
"Effect": "Allow",
173-
"Action": [
174-
"ecr:GetAuthorizationToken"
175-
],
176-
"Resource": "*"
177-
}
178-
]
64+
"Version": "2012-10-17",
65+
"Statement": [{
66+
"Sid": "IAMRoleManagement",
67+
"Effect": "Allow",
68+
"Action": [
69+
"iam:CreateRole",
70+
"iam:DeleteRole",
71+
"iam:GetRole",
72+
"iam:PutRolePolicy",
73+
"iam:DeleteRolePolicy",
74+
"iam:AttachRolePolicy",
75+
"iam:DetachRolePolicy",
76+
"iam:TagRole",
77+
"iam:ListRolePolicies",
78+
"iam:ListAttachedRolePolicies"
79+
],
80+
"Resource": [
81+
"arn:aws:iam::*:role/*BedrockAgentCore*",
82+
"arn:aws:iam::*:role/service-role/*BedrockAgentCore*"
83+
]
84+
},
85+
{
86+
"Sid": "CodeBuildProjectAccess",
87+
"Effect": "Allow",
88+
"Action": [
89+
"codebuild:StartBuild",
90+
"codebuild:BatchGetBuilds",
91+
"codebuild:ListBuildsForProject",
92+
"codebuild:CreateProject",
93+
"codebuild:UpdateProject",
94+
"codebuild:BatchGetProjects"
95+
],
96+
"Resource": [
97+
"arn:aws:codebuild:*:*:project/bedrock-agentcore-*",
98+
"arn:aws:codebuild:*:*:build/bedrock-agentcore-*"
99+
]
100+
},
101+
{
102+
"Sid": "CodeBuildListAccess",
103+
"Effect": "Allow",
104+
"Action": [
105+
"codebuild:ListProjects"
106+
],
107+
"Resource": "*"
108+
},
109+
{
110+
"Sid": "IAMPassRoleAccess",
111+
"Effect": "Allow",
112+
"Action": [
113+
"iam:PassRole"
114+
],
115+
"Resource": [
116+
"arn:aws:iam::*:role/AmazonBedrockAgentCore*",
117+
"arn:aws:iam::*:role/service-role/AmazonBedrockAgentCore*"
118+
]
119+
},
120+
{
121+
"Sid": "CloudWatchLogsAccess",
122+
"Effect": "Allow",
123+
"Action": [
124+
"logs:GetLogEvents",
125+
"logs:DescribeLogGroups",
126+
"logs:DescribeLogStreams"
127+
],
128+
"Resource": [
129+
"arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/*",
130+
"arn:aws:logs:*:*:log-group:/aws/codebuild/*"
131+
]
132+
},
133+
{
134+
"Sid": "S3Access",
135+
"Effect": "Allow",
136+
"Action": [
137+
"s3:GetObject",
138+
"s3:PutObject",
139+
"s3:ListBucket",
140+
"s3:CreateBucket",
141+
"s3:PutLifecycleConfiguration"
142+
],
143+
"Resource": [
144+
"arn:aws:s3:::bedrock-agentcore-*",
145+
"arn:aws:s3:::bedrock-agentcore-*/*"
146+
]
147+
},
148+
{
149+
"Sid": "ECRRepositoryAccess",
150+
"Effect": "Allow",
151+
"Action": [
152+
"ecr:CreateRepository",
153+
"ecr:DescribeRepositories",
154+
"ecr:GetRepositoryPolicy",
155+
"ecr:InitiateLayerUpload",
156+
"ecr:CompleteLayerUpload",
157+
"ecr:PutImage",
158+
"ecr:UploadLayerPart",
159+
"ecr:BatchCheckLayerAvailability",
160+
"ecr:GetDownloadUrlForLayer",
161+
"ecr:BatchGetImage",
162+
"ecr:ListImages",
163+
"ecr:TagResource"
164+
],
165+
"Resource": [
166+
"arn:aws:ecr:*:*:repository/bedrock-agentcore-*"
167+
]
168+
},
169+
{
170+
"Sid": "ECRAuthorizationAccess",
171+
"Effect": "Allow",
172+
"Action": [
173+
"ecr:GetAuthorizationToken"
174+
],
175+
"Resource": "*"
176+
},
177+
{
178+
"Sid": "BedrockAgentCoreRuntimeIdentityServiceLinkedRolePermissions",
179+
"Effect": "Allow",
180+
"Action": "iam:CreateServiceLinkedRole",
181+
"Resource": "arn:aws:iam::*:role/aws-service-role/runtime-identity.bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreRuntimeIdentity",
182+
"Condition": {
183+
"StringEquals": {
184+
"iam:AWSServiceName": "runtime-identity.bedrock-agentcore.amazonaws.com"
185+
}
186+
}
187+
}
188+
]
179189
}
180190
```
181191

@@ -316,19 +326,6 @@ The Runtime Execution Role is an IAM role that AgentCore Runtime assumes to run
316326
}
317327
}
318328
},
319-
{
320-
"Sid": "GetAgentAccessToken",
321-
"Effect": "Allow",
322-
"Action": [
323-
"bedrock-agentcore:GetWorkloadAccessToken",
324-
"bedrock-agentcore:GetWorkloadAccessTokenForJWT",
325-
"bedrock-agentcore:GetWorkloadAccessTokenForUserId"
326-
],
327-
"Resource": [
328-
"arn:aws:bedrock-agentcore:region:accountId:workload-identity-directory/default",
329-
"arn:aws:bedrock-agentcore:region:accountId:workload-identity-directory/default/workload-identity/agentName-*"
330-
]
331-
},
332329
{
333330
"Sid": "BedrockModelInvocation",
334331
"Effect": "Allow",

‎src/bedrock_agentcore_starter_toolkit/utils/runtime/templates/execution_role_policy.json.j2‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -143,19 +143,6 @@
143143
"arn:aws:bedrock-agentcore:{{ region }}:{{ account_id }}:workload-identity-directory/default/workload-identity/{{ agent_name }}-*"
144144
]
145145
},
146-
{
147-
"Sid": "BedrockAgentCoreIdentityGetWorkloadAccessToken",
148-
"Effect": "Allow",
149-
"Action": [
150-
"bedrock-agentcore:GetWorkloadAccessToken",
151-
"bedrock-agentcore:GetWorkloadAccessTokenForJWT",
152-
"bedrock-agentcore:GetWorkloadAccessTokenForUserId"
153-
],
154-
"Resource": [
155-
"arn:aws:bedrock-agentcore:{{ region }}:{{ account_id }}:workload-identity-directory/default",
156-
"arn:aws:bedrock-agentcore:{{ region }}:{{ account_id }}:workload-identity-directory/default/workload-identity/{{ agent_name }}-*"
157-
]
158-
},
159146
{
160147
"Sid": "BedrockModelInvocation",
161148
"Effect": "Allow",

‎tests/utils/runtime/test_policy_template.py‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -129,9 +129,6 @@ def test_policy_has_required_permissions(self):
129129
"xray:GetSamplingRules",
130130
"xray:GetSamplingTargets",
131131
"cloudwatch:PutMetricData",
132-
"bedrock-agentcore:GetWorkloadAccessToken",
133-
"bedrock-agentcore:GetWorkloadAccessTokenForJWT",
134-
"bedrock-agentcore:GetWorkloadAccessTokenForUserId",
135132
"bedrock:InvokeModel",
136133
"bedrock:InvokeModelWithResponseStream",
137134
]

0 commit comments

Comments
 (0)