c1.2 Encrypt inference data with customer managed KMS keys

Why a customer managed key

By default Amazon Bedrock encrypts data with an AWS managed key, which you cannot inspect, restrict, or audit at the policy level. A customer managed key (CMK) lets you decide exactly which principals and which services may use the key, rotate it on your schedule, and see every use in CloudTrail. For regulated inference workloads this control over the key — not just the data — is usually the requirement.

Scope the key to Bedrock with a key policy

The key policy is the root of trust for a KMS key. Grant the Bedrock service principal only the operations it needs, and constrain them to Bedrock with the kms:ViaService condition so the key cannot be used through other services:

{
  "Sid": "AllowBedrockToUseTheKey",
  "Effect": "Allow",
  "Principal": { "Service": "bedrock.amazonaws.com" },
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:GenerateDataKey",
    "kms:CreateGrant",
    "kms:DescribeKey"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": { "kms:ViaService": "bedrock.us-east-1.amazonaws.com" }
  }
}

Bedrock creates a grant on the key (via kms:CreateGrant) so it can use the CMK for long-running work such as model customization; keep that permission in the policy above.

Encrypt the data that leaves the model too

Prompts and completions are also written wherever you send model invocation logs. Point that logging at an S3 bucket or CloudWatch Logs group that is itself encrypted with the same CMK, so the stored copy of the inference data is protected with the key you control, not the default aws/s3 key. See Monitor model invocation using CloudWatch Logs and Amazon S3.

Turn on rotation and least-privilege decrypt

• Enable automatic annual key rotation on the CMK.
• In the key policy, separate key administrators (who manage the key) from key users (who may Decrypt); the runtime role should be able to decrypt, not administer.
• Watch KMS usage from Bedrock with CloudTrail — see Monitoring your encryption keys for the Amazon Bedrock service.

Naming note: replace us-east-1 in the kms:ViaService value with your Region. Use a distinct CMK (and separate kms:ViaService line) per Region rather than a single shared key.