Bedrock AgentCore memory not encrypted with a customer-managed key

What it checks

Bedrock AgentCore memory not encrypted with a customer-managed key

Where it applies

Terraform: aws_bedrockagentcore_memory

CloudFormation: AWS::BedrockAgentCore::Memory

How to fix it

1. Create an aws_kms_key with enable_key_rotation = true and a key policy allowing bedrock-agentcore.amazonaws.com to use it.
2. Set encryption_key_arn = aws_kms_key.<name>.arn on the aws_bedrockagentcore_memory resource.

Frameworks

• NIST 800-53 rev5 SC-28
• NIST 800-53 rev5 SC-12

These mappings are advisory, not an attestation of compliance.

All rules