Bedrock knowledge base not encrypted with CMK

Severity: High
Service: Bedrock
Check ID: BEDROCK_KNOWLEDGE_BASE_NO_ENCRYPTION

What this check finds

A Bedrock knowledge base is not encrypted with a customer-managed KMS key, reducing key management control.

Passing looks like: Bedrock knowledge base encrypted with CMK.

How to fix it

Create a new knowledge base with CMK encryption or re-configure storage encryption via S3/OpenSearch KMS key settings.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Bedrock knowledge base not encrypted with CMK
Framework	Controls
PCI-DSS v4.0.1	3.5 Primary account number (PAN) is secured wherever it is stored
HIPAA Security Rule	164.312(a)(2)(iv) Encryption and Decryption of ePHI at Rest
SOC 2 — Trust Services Criteria	CC6.7 Encryption and Secret Management C1.1 Encryption of Confidential Data
NIST SP 800-53 Rev5 (Moderate)	SC-28 Protection of Information at Rest
NIST Cybersecurity Framework 2.0	PR.DS-01 Data-at-rest is protected
ISO/IEC 27001:2022 Annex A	A.8.24 Use of cryptography

AI risk mappings

AI risk taxonomies mapped to Bedrock knowledge base not encrypted with CMK
Framework	Controls
OWASP Top 10 for LLM Applications (2025)	LLM08 Vector and Embedding Weaknesses
MITRE ATLAS (Adversarial Threat Landscape for AI Systems)	AML.T0057 LLM Data Leakage

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Bedrock checks

All Bedrock checks