Connect Amazon Bedrock to Black Cat SSPM
Connect your Amazon Bedrock account so Black Cat can review the AI agents you have built, their execution roles, action groups, knowledge bases and guardrails.
≈ 10 min · audit access · no write-capable permission
What Black Cat reads, and why
| Permission | What it lets Black Cat do | Status |
|---|---|---|
sts:GetCallerIdentity | Lets Black Cat confirm which AWS account it has been given access to. | Required |
bedrock:ListAgents, bedrock:GetAgent, bedrock:ListTagsForResource | Lets Black Cat inventory your Bedrock agents, their status, owners and configuration. | Required |
bedrock:ListAgentActionGroups, bedrock:GetAgentActionGroup | Lets Black Cat see what actions each agent can take, including code interpretation and shell access. | Required |
bedrock:ListAgentKnowledgeBases | Lets Black Cat see which knowledge bases each agent can draw on. | Required |
iam:ListRolePolicies, iam:GetRolePolicy, iam:ListAttachedRolePolicies, iam:GetPolicy, iam:GetPolicyVersion | Lets Black Cat review the permissions an agent's execution role carries. | Required |
cloudtrail:LookupEvents | Lets Black Cat see when each agent was last invoked. | Optional |
What you'll need
- Access key identifier Required — From the read-only credentials you create for Black Cat in AWS.
- Secret access key Required — Issued with the access key identifier and shown only once by AWS.
- Bedrock region Required — The AWS region your Bedrock agents live in, for example eu-central-1.
- Role to assume — Optional — the read-only role Black Cat should take on instead of using the access key directly.
Where to create it
- Setup guide (Amazon Bedrock) ↗ (opens in new tab)
- Developer documentation (Amazon Bedrock) ↗ (opens in new tab)
What we check on Amazon Bedrock →