Loading

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action

Identifies an Amazon Bedrock API key (bearer token) being used to perform a destructive or anti-recovery control-plane action, such as deleting a guardrail, deleting a custom or imported model, removing provisioned throughput, or disabling model invocation logging. Bedrock API keys are bearer credentials intended for model invocation (InvokeModel, Converse); using one to delete Bedrock resources or disable logging is inconsistent with that purpose and is characteristic of LLMjacking or sabotage following key theft. Every Bedrock API key call is identifiable in CloudTrail by "additionalEventData.callWithBearerToken" being true. The rule matches regardless of outcome, because a destructive attempt via a bearer token is suspicious even when denied.

Rule type: esql
Rule indices:

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-30m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Data Source: AWS
  • Data Source: Amazon Web Services
  • Data Source: AWS CloudTrail
  • Data Source: Amazon Bedrock
  • Use Case: Threat Detection
  • Tactic: Impact
  • Tactic: Defense Evasion
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2
This rule requires AWS CloudTrail logs ingested via the Elastic AWS integration. See https://docs.elastic.co/integrations/aws/cloudtrail for setup details.

Amazon Bedrock API keys are bearer tokens created for model invocation. In CloudTrail, every request made with one carries "additionalEventData.callWithBearerToken" set to true, which distinguishes it from a standard SigV4-signed call. The AmazonBedrockLimitedAccess policy attached to Bedrock API key phantom users also permits destructive Bedrock control-plane actions, so a stolen or misused key can delete guardrails and models or disable logging.

Using an API key to delete guardrails, custom or imported models, or provisioned throughput, or to disable model invocation logging, is inconsistent with the credential's purpose. It is characteristic of LLMjacking operations (which frequently disable guardrails and logging) or of sabotage following credential theft.

  • Identify the specific action in "event.action" and the affected resource in "aws.cloudtrail.request_parameters".
  • Identify the principal in "aws.cloudtrail.user_identity.arn"/"aws.cloudtrail.user_identity.type" and review "source.ip", "source.as.number", and "user_agent.original"; generic HTTP clients (python-requests, aiohttp, curl) are a further LLMjacking indicator.
  • Review the same principal's other Bedrock API key activity for model-invocation spikes, cross-region use, or additional destructive actions.
  • Determine whether model invocation logging or guardrails were disabled, and when, to scope any window of reduced visibility.
  • Sanctioned automation may manage Bedrock resources with an API key. Confirm the principal and change, and exclude known maintenance identities after validation.
  • If unauthorized, revoke the Bedrock API key (attach an inline deny on "bedrock:CallWithBearerToken" to the phantom user or deactivate the service-specific credential) and restore the deleted resource or re-enable logging.
  • Check the phantom user for IAM access keys created as a persistence pivot and revoke them.
  • Review the principal's recent activity and prefer short-term keys or STS going forward.
FROM logs-aws.cloudtrail-* METADATA _id, _version, _index
| WHERE event.provider == "bedrock.amazonaws.com"
    AND aws.cloudtrail.additional_eventdata RLIKE """.*callWithBearerToken=true.*"""
    AND event.action IN (
        "DeleteGuardrail",
        "DeleteModelInvocationLoggingConfiguration",
        "PutModelInvocationLoggingConfiguration",
        "DeleteImportedModel",
        "DeleteCustomModel",
        "DeleteModelCustomizationJob",
        "DeleteProvisionedModelThroughput",
        "DeleteMarketplaceModelEndpoint"
    )
| KEEP _id, _version, _index, @timestamp, aws.*, cloud.*, event.*, source.*, user.*, user_agent.*

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK