AWS Bedrock AgentCore Resource Created with IAM Execution Role

  1[metadata]
  2creation_date = "2026/08/25"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the creation of an AWS Bedrock AgentCore resource (code interpreter, agent runtime, browser, or harness) with an
 11IAM execution role attached. When an attacker with iam:PassRole permission creates an AgentCore resource and attaches a
 12privileged role, subsequent invocations inside that resource execute as the attached role — enabling privilege
 13escalation to roles that trust bedrock-agentcore.amazonaws.com.
 14"""
 15false_positives = [
 16    """
 17    Legitimate provisioning of Bedrock AgentCore resources by CI/CD pipelines or platform engineers. Validate the caller
 18    identity against expected provisioning principals and verify the attached role is commensurate with the workload's
 19    documented requirements.
 20    """,
 21]
 22from = "now-9m"
 23index = ["logs-aws.cloudtrail-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "AWS Bedrock AgentCore Resource Created with IAM Execution Role"
 27note = """## Triage and analysis
 28
 29### Investigating AWS Bedrock AgentCore Resource Created with IAM Execution Role
 30
 31AWS Bedrock AgentCore services (code interpreters, agent runtimes, browsers, harnesses) run user workloads inside isolated MicroVMs. When an IAM role is attached at creation time, all code executing inside the resource assumes that role's identity. An attacker with iam:PassRole and bedrock-agentcore:Create* permissions can attach a privileged role and then invoke the resource to operate as that role.
 32
 33The four Create* events covered here are management-plane events logged to CloudTrail by default. The subsequent Start*/Invoke* data-plane events are NOT captured by the default management events trail and cannot be detected without enabling data-plane logging.
 34
 35### Possible investigation steps
 36
 37- Check the caller identity (`aws.cloudtrail.user_identity.arn`) against expected provisioning principals. Unexpected users or roles creating AgentCore resources should be investigated.
 38- Examine `aws.cloudtrail.request_parameters` for the attached role ARN (`executionRoleArn` or `roleArn`) and evaluate whether that role has permissions beyond what the AgentCore workload legitimately requires.
 39- Check for subsequent `StartCodeInterpreterSession`, `StartBrowserSession`, or `InvokeAgentRuntime` events from the same caller against the newly created resource (requires data-plane logging to be enabled).
 40- Review the IAM PassRole permission of the calling identity and whether it is constrained by `iam:PassedToService` conditions.
 41
 42### False positive analysis
 43
 44- Automated provisioning by CDK/CloudFormation/Terraform with a known service account.
 45- Platform engineering pipelines deploying Bedrock-based AI workloads.
 46- Filter on `user_agent.original` for known IaC tools.
 47
 48### Response and remediation
 49
 50- Suspend the calling identity's iam:PassRole permission while investigating.
 51- Delete the newly created AgentCore resource to stop active sessions.
 52- Rotate the attached execution role's credentials if exploitation is confirmed.
 53- Enable data-plane logging for bedrock-agentcore to detect subsequent session invocations.
 54"""
 55references = [
 56    "https://www.beyondtrust.com/blog/entry/aws-agentcore-privilege-escalation",
 57]
 58risk_score = 47
 59rule_id = "2d8f6e1a-4b7c-4f9d-8e3a-1c5d2f8b9a0e"
 60severity = "medium"
 61tags = [
 62    "Domain: Cloud",
 63    "Data Source: AWS",
 64    "Data Source: Amazon Web Services",
 65    "Platform: AWS",
 66    "Data Source: AWS CloudTrail",
 67    "Service: AWS Bedrock",
 68    "Service: AWS IAM",
 69    "Tactic: Privilege Escalation",
 70    "Tactic: Persistence",
 71    "Rule Type: Custom Query (KQL)",
 72    "Resources: Investigation Guide",
 73    "Domain: GenAI",
 74]
 75timestamp_override = "event.ingested"
 76type = "query"
 77
 78query = '''
 79event.dataset: "aws.cloudtrail" and
 80  event.provider: "bedrock-agentcore.amazonaws.com" and
 81  event.action: (
 82    "CreateCodeInterpreter" or
 83    "CreateAgentRuntime" or
 84    "CreateBrowser" or
 85    "CreateHarness"
 86  ) and
 87  event.outcome: "success" and
 88  aws.cloudtrail.request_parameters: (*executionRoleArn* or *roleArn*) and
 89  not aws.cloudtrail.user_identity.invoked_by: ("bedrock-agentcore.amazonaws.com" or "cloudformation.amazonaws.com")
 90'''
 91
 92
 93[[rule.threat]]
 94framework = "MITRE ATT&CK"
 95[[rule.threat.technique]]
 96id = "T1078"
 97name = "Valid Accounts"
 98reference = "https://attack.mitre.org/techniques/T1078/"
 99[[rule.threat.technique.subtechnique]]
100id = "T1078.004"
101name = "Cloud Accounts"
102reference = "https://attack.mitre.org/techniques/T1078/004/"
103
104
105
106[rule.threat.tactic]
107id = "TA0004"
108name = "Privilege Escalation"
109reference = "https://attack.mitre.org/tactics/TA0004/"
110[[rule.threat]]
111framework = "MITRE ATT&CK"
112[[rule.threat.technique]]
113id = "T1098"
114name = "Account Manipulation"
115reference = "https://attack.mitre.org/techniques/T1098/"
116
117
118[rule.threat.tactic]
119id = "TA0003"
120name = "Persistence"
121reference = "https://attack.mitre.org/tactics/TA0003/"