AWS Bedrock Guardrail Deleted or Weakened

  1[metadata]
  2creation_date = "2026/06/04"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects deletion, weakening, or version management of AWS Bedrock guardrails via the DeleteGuardrail, UpdateGuardrail,
 11DeleteEnforcedGuardrailConfiguration, or PutEnforcedGuardrailConfiguration APIs. Bedrock guardrails enforce content,
 12topic, word, and sensitive-information policies on model invocations. Deleting a guardrail, loosening its policies,
 13removing or overwriting the organization-enforced guardrail configuration, or creating a new version to enforce a
 14weakened configuration allows an adversary to bypass these protections — the cloud control-plane equivalent of disabling
 15a security tool. This activity should be validated against approved change management and the responsible identity.
 16"""
 17false_positives = [
 18    """
 19    Platform or ML engineering teams may legitimately tune, iterate on, or decommission guardrails as part of normal
 20    development. If this is expected in your environment, the responsible identities can be exempted from the rule.
 21    """,
 22]
 23from = "now-6m"
 24index = ["logs-aws.cloudtrail-*"]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "AWS Bedrock Guardrail Deleted or Weakened"
 28note = """## Triage and analysis
 29
 30### Investigating AWS Bedrock Guardrail Deleted or Weakened
 31
 32AWS Bedrock guardrails enforce content, topic, word, and sensitive-information policies on model
 33invocations. Adversaries who gain access to the Bedrock control plane may delete a guardrail (`DeleteGuardrail`),
 34loosen its policies (`UpdateGuardrail`), remove or overwrite the organization-enforced guardrail
 35configuration (`DeleteEnforcedGuardrailConfiguration` / `PutEnforcedGuardrailConfiguration`) to then enforce it on
 36model deployments. This detection identifies those control-plane changes so responders can confirm
 37intent before accepting the change.
 38
 39#### Possible investigation steps
 40
 41- **Identify the actor and context**
 42  - Review `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.type`,
 43    `aws.cloudtrail.user_identity.access_key_id`, `source.ip`, and `user_agent.original`.
 44  - Confirm a related change request exists and that the identity is authorized to manage guardrails.
 45- **Validate the change**
 46  - For `UpdateGuardrail` / `PutEnforcedGuardrailConfiguration`, inspect
 47    `aws.cloudtrail.flattened.request_parameters` and `aws.cloudtrail.response_elements` to determine
 48    which content, topic, word, or sensitive-information policies were removed or weakened.
 49  - For `DeleteGuardrail` / `DeleteEnforcedGuardrailConfiguration`, identify the targeted guardrail
 50    or org configuration and whether protected workloads still reference it.
 51- **Correlate activity**
 52  - Look for surrounding Bedrock `InvokeModel` / `Converse` activity and other defense-impairing
 53    actions (e.g., logging or detector changes) from the same identity.
 54  - Check for prior enumeration such as `ListGuardrails` or `GetGuardrail`.
 55
 56### Response and remediation
 57
 58- If unauthorized, restore the guardrail and/or org-enforced configuration to its approved state and
 59  re-associate it with affected Bedrock workloads.
 60- Disable the access key in `aws.cloudtrail.user_identity.access_key_id` and review the actor's
 61  recent activity; rotate credentials if compromise is suspected.
 62- Restrict `bedrock:DeleteGuardrail`, `bedrock:UpdateGuardrail`, and the enforced-configuration
 63  permissions to a small set of admin roles, and enforce guardrail state via AWS Config or SCPs.
 64"""
 65references = [
 66    "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteGuardrail.html",
 67    "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html",
 68    "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html",
 69]
 70risk_score = 47
 71rule_id = "cdf7b922-909c-440c-8df0-0efe72aa7bea"
 72severity = "medium"
 73tags = [
 74    "Domain: Cloud",
 75    "Data Source: AWS",
 76    "Data Source: Amazon Web Services",
 77    "Domain: GenAI",
 78    "Platform: AWS",
 79    "Data Source: AWS CloudTrail",
 80    "Service: AWS Bedrock",
 81    "Tactic: Defense Evasion",
 82    "Rule Type: Custom Query (KQL)",
 83    "Resources: Investigation Guide",
 84    "Noise: Unknown",
 85    "Performance: Fast",
 86    "Profile: Recommended",
 87    "Threat: Unauthorized AI Usage",
 88]
 89timestamp_override = "event.ingested"
 90type = "query"
 91
 92query = '''
 93data_stream.dataset: "aws.cloudtrail"
 94    and event.provider: "bedrock.amazonaws.com"
 95    and event.action: (
 96        "DeleteGuardrail" or
 97        "UpdateGuardrail" or
 98        "DeleteEnforcedGuardrailConfiguration" or
 99        "PutEnforcedGuardrailConfiguration"
100    ) and event.outcome: "success"
101    and not user_agent.original: (*Terraform*)
102'''
103
104
105[[rule.threat]]
106framework = "MITRE ATT&CK"
107[[rule.threat.technique]]
108id = "T1562"
109name = "Impair Defenses"
110reference = "https://attack.mitre.org/techniques/T1562/"
111[[rule.threat.technique.subtechnique]]
112id = "T1562.001"
113name = "Disable or Modify Tools"
114reference = "https://attack.mitre.org/techniques/T1562/001/"
115
116
117
118[rule.threat.tactic]
119id = "TA0005"
120name = "Defense Evasion"
121reference = "https://attack.mitre.org/tactics/TA0005/"
122[[rule.threat_mappings]]
123framework = "MITRE ATLAS"
124version = "2026.08"
125[[rule.threat_mappings.threat]]
126framework = "MITRE ATLAS"
127
128[rule.threat_mappings.threat.tactic]
129id = "AML.TA0007"
130name = "Defense Evasion"
131reference = "https://atlas.mitre.org/tactics/AML.TA0007/"
132
133[rule.investigation_fields]
134field_names = [
135    "@timestamp",
136    "user.name",
137    "user_agent.original",
138    "source.ip",
139    "aws.cloudtrail.user_identity.arn",
140    "aws.cloudtrail.user_identity.type",
141    "aws.cloudtrail.user_identity.access_key_id",
142    "event.action",
143    "event.provider",
144    "event.outcome",
145    "cloud.account.id",
146    "cloud.region",
147    "aws.cloudtrail.request_parameters",
148    "aws.cloudtrail.response_elements",
149]