Bedrock agent conversation data not encrypted with a customer-managed key

What it checks

Bedrock agent conversation data not encrypted with a customer-managed key

Where it applies

Terraform: aws_bedrockagent_agent

CloudFormation: AWS::Bedrock::Agent

How to fix it

1. Create an aws_kms_key resource with enable_key_rotation = true and a key policy allowing bedrock.amazonaws.com to use it.
2. Set customer_encryption_key_arn = aws_kms_key.<name>.arn on the aws_bedrockagent_agent resource.

Frameworks

• NIST 800-53 rev5 SC-28
• NIST 800-53 rev5 SC-12

These mappings are advisory, not an attestation of compliance.

All rules