API KEYS FOR BEDROCK: A BRIEF SECURITY OVERVIEW

Summary from the TLDR InfoSec newsletter

AWS has introduced the ability to create Bedrock API keys, which are special API keys that are explicitly scoped to Bedrock. Long-term API keys are tied to an automatically generated or existing IAM user, can be configured with an expiration of up to 100 years, and are composed of a magic 3-byte prefix, a human-readable section, and a base64-encoded secret. Short-term API keys are scoped to a specific user's session and have the format `bedrock-api-key-[BASE64]` where [BASE64] is a base64-encoded pre-signed URL.