How to govern AWS Bedrock
A step-by-step guide to governing AWS Bedrock with Rencore: detect with 30 policies, review with 15 reports, and remediate with 1 automations.
Governing AWS Bedrock means keeping its access, configuration, and lifecycle under continuous control rather than reacting after something breaks. Rencore governs AWS Bedrock with 30 pre-built policies, 15 reports, and 1 automations, so teams can detect risk, review posture, and remediate with an audit trail. The steps below turn that coverage into a repeatable routine.
Steps
-
Inventory AWS Bedrock
Connect AWS Bedrock and let Rencore build a continuous inventory of its resources, owners, and configuration, so governance starts from what exists rather than a stale export.
-
Detect with policies
Turn on the pre-built policies that cover AWS Bedrock to surface oversharing, sprawl, and misconfiguration on the first scan, before writing a single custom rule.
-
Review by owner and severity
Use the AWS Bedrock reports to review findings by owner, category, and severity, and to share them with stakeholders who do not have a seat in the platform.
-
Remediate and automate
Apply automations to fix findings at scale, route sensitive changes through approvals, and keep every action reversible and logged for the audit trail.
Recommended AWS Bedrock policies
Grounded in the Rencore catalog. See the full AWS Bedrock catalog on the AWS Bedrock connector page.
-
Agent is live and callable
Agents in PREPARED state are callable, raising the likelihood that any weakness is exploited
Severity: Medium -
Flow is live and invocable
Flows in Prepared state are invocable, raising the likelihood that any weakness is exploited
Severity: Medium -
Agent can perform actions
Agents with an enabled action group can invoke external APIs, raising the likelihood of real-world impact
Severity: High -
IAM user has console access
Users with interactive console access are a more readily exploited entry point
Severity: Medium -
IAM user has active access keys
Users with active programmatic credentials are a more likely source of a credential leak
Severity: Medium -
Role assumable by Bedrock
Roles assumable by the Bedrock service have live, runtime-exercised permissions
Severity: Medium -
AWS Bedrock Agent without Guardrail
Detects agents that do not have a guardrail configured
Severity: Medium -
AWS Bedrock Agent using deprecated model
Detects agents using foundation models with LEGACY or EOL lifecycle status
Severity: High -
AWS Bedrock Agent in failed state
Detects agents with FAILED or NOT_PREPARED status
Severity: High -
AWS Bedrock Flow in failed state
Detects flows with Failed status
Severity: High -
AWS Bedrock Knowledge Base in failed state
Detects knowledge bases with FAILED status
Severity: Medium -
AWS Bedrock Agent not updated in 90 days
Detects agents that have not been updated in the last 90 days
Severity: Low
