Merge pull request #16 from aws-samples/fix/security-findings

Enable access logging on provisioned S3 bucket and scope down some
IAM role permissions.

Co-authored-by: Aamna Najmi <anajmi@amazon.de>

Author: athewsey

infra/modules/agentcore-iam-role/bedrock-agentcore-policy.tf

@@ -11,7 +11,11 @@ resource "aws_iam_policy" "bedrock_permissions" {
           "bedrock:InvokeModel",
           "bedrock:InvokeModelWithResponseStream"
         ]
-        Resource = "*"
+        Resource = [
+          "arn:aws:bedrock:${data.aws_region.current.name}::foundation-model/anthropic.*",
+          "arn:aws:bedrock:${data.aws_region.current.name}::foundation-model/amazon.*",
+          "arn:aws:bedrock:${data.aws_region.current.name}::foundation-model/meta.*"
+        ]
       }
     ]
   })
@@ -28,8 +32,7 @@ resource "aws_iam_policy" "ecr_permissions" {
         Effect = "Allow"
         Action = [
           "ecr:BatchGetImage",
-          "ecr:GetDownloadUrlForLayer",
-          "ecr:GetAuthorizationToken"
+          "ecr:GetDownloadUrlForLayer"
         ]
         Resource = [
           "arn:aws:ecr:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:repository/*"
@@ -41,6 +44,8 @@ resource "aws_iam_policy" "ecr_permissions" {
         Action = [
           "ecr:GetAuthorizationToken"
         ]
+        # This action does not accept any restrictions on the resource, per the docs:
+        # https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerregistry.html
         Resource = "*"
       }
     ]
@@ -100,9 +105,14 @@ resource "aws_iam_policy" "monitoring_permissions" {
           "xray:GetSamplingRules",
           "xray:GetSamplingTargets"
         ]
-        Resource = "*"
+        Resource = [
+          "arn:aws:xray:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:trace/*"
+        ]
       },
       {
+        # WILDCARD JUSTIFICATION: CloudWatch PutMetricData requires Resource="*" 
+        # as per AWS documentation. Condition restricts to bedrock-agentcore namespace only.
+        # Reference: https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricData.html
         Effect   = "Allow"
         Resource = "*"
         Action   = "cloudwatch:PutMetricData"

infra/modules/kb-stack/main.tf

@@ -12,6 +12,49 @@ resource "aws_s3_bucket_public_access_block" "kb_bucket_pab" {
   restrict_public_buckets = true
 }
 
+# Access logging bucket
+resource "aws_s3_bucket" "access_logs" {
+  bucket_prefix = "${var.name}-access-logs"
+}
+
+resource "aws_s3_bucket_public_access_block" "access_logs_pab" {
+  bucket = aws_s3_bucket.access_logs.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+# Enable access logging
+resource "aws_s3_bucket_logging" "kb_bucket_logging" {
+  bucket = aws_s3_bucket.kb_bucket.id
+
+  target_bucket = aws_s3_bucket.access_logs.id
+  target_prefix = "access-logs/"
+}
+
+# Lifecycle configuration
+resource "aws_s3_bucket_lifecycle_configuration" "kb_bucket_lifecycle" {
+  bucket = aws_s3_bucket.kb_bucket.id
+
+  rule {
+    id     = "knowledge_base_lifecycle"
+    status = "Enabled"
+
+    filter {}
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    transition {
+      days          = 90
+      storage_class = "GLACIER"
+    }
+  }
+}
+
 # IAM Role for Bedrock
 resource "aws_iam_role" "bedrock_role" {
   name = "${var.name}-bedrock-role"

infra/modules/knowledge-base/main.tf

@@ -7,7 +7,16 @@ resource "aws_iam_role_policy" "bedrock_kb_sample_kb_model" {
     Version = "2012-10-17"
     Statement = [
       {
-        Action   = ["aoss:*"]
+        Action   = [
+          "aoss:CreateIndex",
+          "aoss:DescribeIndex",
+          "aoss:UpdateIndex",
+          "aoss:DeleteIndex",
+          "aoss:WriteDocument",
+          "aoss:ReadDocument",
+          "aoss:SearchDocument",
+          "aoss:DeleteDocument"
+        ]
         Effect   = "Allow"
         Resource = [var.opensearch_arn]
       },